CONTENT_LENGTH = 1290
CONTENT_TYPE = text/xml
DOCUMENT_ROOT = /var/www
GATEWAY_INTERFACE = CGI/1.1
HTTP_ACCEPT = */*
HTTP_ALERT_CHECKSUM = 331844cae5be97ecfe1543c2740b7156
HTTP_APPLIANCE_ID = 002590874A14
HTTP_CUSTOMER_ID = 007
HTTP_CUSTOMER_NAME = 'JG'
HTTP_EVENT_ID = 1386
HTTP_EVENT_SIZE = 1290
HTTP_EVENT_TYPE = malware-object
HTTP_EXPECT = 100-continue
HTTP_HOST = xxx.xxx.xxx.xxx
HTTP_USER_AGENT = curl/7.29.0
PATH = /usr/local/bin:/usr/bin:/bin
QUERY_STRING =
REMOTE_ADDR = xxx.xxx.xxx.xxx
REMOTE_PORT = 36078
REQUEST_METHOD = POST
REQUEST_URI = /fenotify/sink.pl
SCRIPT_FILENAME = /var/www/fenotify/sink.pl
SCRIPT_NAME = /fenotify/sink.pl
SERVER_ADDR = xxx.xxx.xxx.xxx
SERVER_ADMIN = webmaster@localhost
SERVER_NAME = xxx.xxx.xxx.xxx
SERVER_PORT = 80
SERVER_PROTOCOL = HTTP/1.1
SERVER_SIGNATURE = <address>Apache/2.2.22 (Ubuntu) Server at xxx.xxx.xxx.xxx Port 80</address>
SERVER_SOFTWARE = Apache/2.2.22 (Ubuntu)
Wrote new event to /var/www/fenotify/nossl/noauth/no_user/xxx.xxx.xxx.xxx/Tuesday-25-April-2017/xxx.xxx.xxx.xxx_malware-event_1493105237_80671.html
malware-callback (Network Security)
<?xml version="1.0" encoding="UTF-8"?>
-<alerts xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.trellix.com/alert/2014/AlertSchema" version="9.0.2.924861" product="Web MPS" msg="concise" appliance-id="002590847FB8" appliance="abc.mrl.trellix.com">
-<alert uuid="f66dff23-a983-4648-b1ad-a4e7478dbf44" severity="crit" sc-version="1073.120" name="malware-callback" id="51" ack="no">
-<explanation protocol="tcp">
-<malware-detected>
<malware name="Trojan.Koceg"/>
</malware-detected>
</explanation>
-<src vlan="0">
<ip>xxx.xxx.xx.xx</ip>
</src>
-<dst>
<ip>xxx.xx.xxx.xxx</ip>
</dst>
<occurred>2020-10-16T13:25:53Z</occurred>
<alert-url>https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=51</alert-url>
<action>notified</action>
<attack-time>2020-10-16T13:25:53Z</attack-time>
</alert>
</alerts>
malware-object (Network Security)
<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="abc.mrl.trellix.com" appliance-id="000BABDC86AD" msg="concise" product="Web MPS" version="9.0.0.916248" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" id="225" name="malware-object" sc-version="1032.118" severity="majr" uuid="2f1bd715-8a70-4a0f-a3bc-2e23ed9e008a">
<explanation analysis="none">
<malware-detected>
<malware name="W32/Korgo-S" type="exe">
<sha1>fba953c4731ce5df6696d2e98b323652a5120a1c</sha1>
<md5sum>0d00761fe435eb14a9745441ed014532</md5sum>
<submitted-at>2020-07-03T11:33:47Z</submitted-at>
<sha256>873c07316958fc3ec0820233511ea94e4723fc9bf80e1e61378ac6c5c9b58c6a</sha256>
<sha512>7d19e1ddf2132246fb38f5a818eadeefaadc4265efd7956e9f2963e
77b641a70855943d429fc942d94876cc61390cec2b38f288391b9ec3285133f9503b67d37</sha512>
<executed-at>2020-07-03T11:38:03Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src vlan="0">
<ip>xxx.xxx.x.xx</ip>
<port>3922</port>
<mac>00:50:8b:08:b8:f6</mac>
</src>
<dst>
<ip>xxx.xxx.x.xxx</ip>
<mac>00:02:b3:a1:87:14</mac>
<port>80</port>
</dst>
<occurred>2020-07-03T11:38:03Z</occurred>
<alert-url>https://abc.mrl.trellix.com/event_stream/events_for_bot?ma_id=225</alert-url>
<action>notified</action>
</alert>
</alerts>
malware-object (Email Security)
<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="abc-123.mrl.trellix.com" appliance-id="AC1F6B72041C" msg="concise" product="Email MPS" version="9.0.2.924983" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" id="1" name="malware-object" sc-version="xxxx.xxx" severity="majr" uuid="d6f7f671-605e-44ce-be1e-20021eb47089">
<explanation analysis="none">
<malware-detected>
<malware name="Malware.Binary" type="one">
<sha1>5a83b64b5ca2922ab1d5b1357bbff4679324e2c0</sha1>
<md5sum>309152c4ecd2990accffa75a53568f86</md5sum>
<submitted-at>2020-10-17T09:49:23Z</submitted-at>
<sha256>05aa4dacb2f3ceebd02cbf68b64cb35b950d582ebb1af7375429b2d3c31b3332</sha256>
<sha512>cf4494867af7711a7e04700c4fe3ea904dbbc4c3aa6aa0cfa3b968f19
c83468c0006a02f68bfd8f399389b555155cf642db343227e10bbfab8a97de7fca11391</sha512>
<executed-at>2020-10-17T09:49:24Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src>
<domain>tesoro.com</domain>
<smtp-mail-from>sample@tesoro.com</smtp-mail-from>
<url>/d6f7f671-605e-44ce-be1e-20021eb47089</url>
</src>
<dst>
<smtp-to>samples@tesoro.com</smtp-to>
</dst>
<occurred>2020-10-17T09:49:24Z</occurred>
<alert-url>https://abc-123.mrl.trellix.com/emps/eanalysis?e_id=1</alert-url>
<action>blocked</action>
<attack-time>2020-10-17T09:49:22Z</attack-time>
</alert>
</alerts>
malware-object (File Protect)
<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="xx-xx-xxx.fxlab.com" appliance-id="86CB1278DFFB" msg="concise" product="File MPS" version="9.0.0.915895" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" id="3722" name="malware-object" sc-version="1030.310" severity="majr" uuid="1597ce18-6654-4890-8553-aa048ed9b09f">
<explanation analysis="none">
<malware-detected>
<malware name="Malware.Binary.pdf" scan="4" type="pdf">
<sha1>174caae1609bd8832db7c6d7d35cfebb791a94ac</sha1>
<md5sum>c0903e4eaa48961a93f019a9e07f16b4</md5sum>
<submitted-at>2020-07-06T07:15:21Z</submitted-at>
<sha256>fd988ab83ca4912d651f58cb1db2504a759020639746139edcc734e3323e5034</sha256>
<sha512>e2d44ed73e14aecd7950100476078f3c9136c6b0b1dac7bd5d5746a9dd87a582ac185bdb127f730857603e465dc17dfb
6266a35c1ecbecb54b4c4bc12856735b</sha512>
<executed-at>2020-07-06T07:17:19Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src>
<url>/data/ma/notify/c0903e4eaa48961a93f019a9e07f16b4.pdf</url>
</src>
<occurred>2020-07-06T07:17:19Z</occurred>
<alert-url>https://xx.xxx.xx.xxx/fmps/fanalysis?ma_id=3722&lms_iden=86CB1278DFFB</alert-url>
<action>notified</action>
</alert>
</alerts>
malware-object (Email Security on Central Management)
<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="xxxx-xxx.mrl.trellix.com" appliance-id="AC1F6B18BBD6" msg="concise" product="Email MPS" version="9.0.0.916210" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" id="477" name="malware-object" sc-version="1028.182" severity="majr" uuid="e304b05d-b668-47b6-bf3d-5a29a7535c95">
<explanation analysis="none">
<malware-detected>
<malware name="Downloader.Upatre" type="exe">
<sha1>f4bba5421b340221266a8134a463f6b892883a7a</sha1>
<md5sum>40633ac4b136663880d2262a14a1d5f2</md5sum>
<submitted-at>2020-06-26T11:59:30Z</submitted-at>
<sha256>3d6a06292d742657eb15c59cdee71c43b65b05d9b31490c14de91fc2c786ffff</sha256>
<sha512>88202476966aaed2e8508f9926b2a8811ea6aabd3f4959e466c
71928d671c14465dc6ab8bd9d99c88d0b3a68aef268334935c1cc4ce79f8c7199b69c86c29193</sha512>
<executed-at>2020-06-26T12:01:27Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src>
<domain>tesoro.com</domain>
<smtp-mail-from>brownie@tesoro.com</smtp-mail-from>
<url>/e304b05d-b668-47b6-bf3d-5a29a7535c95</url>
</src>
<dst>
<smtp-to>brownie@tesoro.com</smtp-to>
</dst>
<occurred>2020-06-26T12:01:27Z</occurred>
<alert-url>https://xx.x.x.xxx/emps/eanalysis?e_id=232&lms_iden=AC1F6B18BBD6</alert-url>
<action>blocked</action>
</alert>
</alerts>
malware-object (Malware Analysis)
<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="AX-xx.eng.trellix.com" appliance-id="0CC47A15B14E" msg="concise" product="MAS" version="9.0.0.916210" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://ww w.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" id="213135" name="malware-object" sc-version="1032.168" severity="majr" uuid="50002eb0-65bd-4521-8d1f-cd1e418229d9">
<explanation analysis="none">
<malware-detected>
<malware name="Exploit.Kit.Blackhole" type="pdf">
<sha1>d63cacc11c55d1567aae9bff8ec964c3b170c1c9</sha1>
<md5sum>8d9cb7acf4d0abe7033aec9617b82369</md5sum>
<submitted-at>2020-07-03T10:12:00Z</submitted-at>
<sha256>1f1407017248125abd633a7f67e41c2359ab7e112c26c446323575a1e9b4018d</sha256>
<sha512>34a583807b124ac52829118436c38a23270ca020f56cf74a7fc309bb17d44dee2
e7b253707430bcc8fd7d5e6487a403f2248001194c44341ffcbb567ee1d348d</sha512>
<executed-at>2020-07-03T10:13:51Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src>
<url>/data/ma/share/source/pdf_7336661</url>
</src>
<occurred>2020-07-03T10:13:51Z</occurred>
<alert-url>https://xxx.xx.xx.xx/malware_analysis/analyses?maid=213135&lms_iden=0CC47A15B14E</alert-url>
<action>notified</action>
</alert>
</alerts>
malware-object (Network Security on Central Management)
<alerts appliance="abc.mrl.trellix.com" appliance-id="0C:C4:7A:90:D3:B6" msg="normal" product="CMS" version="9.0.0.916210" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" appliance-id="00:0B:AB:DD:C0:CD" id="8032" name="malware-object" product="Web MPS" root-infection="153" sc-version="1028.304" sensor="Minato" sensor-ip="xx.x.x.xxx" severity="majr" uuid="f56aa0ea-d085-4b7f-a919-bb41ef348a2c" version="9.0.0.916248">
<explanation analysis="binary" protocol="">
<malware-detected>
<malware name="Malware.Binary" stype="known-md5sum" type="exe">
<downloaded-at>2020-06-22T10:26:29Z</downloaded-at>
<md5sum>ef0130d76576bf27c15f3d99b4ca4aa5</md5sum>
<original>new7.exe</original>
<http-header>
GET /new/new7.exe HTTP/1.1 Accept: */* UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30) Host: www.wopxs.com Via: 1.1 Mimiron:3128 (squid/2.6.STABLE21), 1.0 Bottom-Dell (squid/3.1.8) X-Forwarded-For: 10.5.6.242, unknown Cache-Control: max-age=259200 Connection: keep-alive HTTP/1.0 200 OK Content-Length: 24391 Content-Type: application/octet-stream Last-Modified: Thu, 12 Feb 2009 10:19:06 GMT Accept-Ranges: bytes ETag: "089be55fb8cc91:321" Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Mon, 23 Feb 2009 12:55:43 GMT X-Cache: MISS from perf3 X-Cache-Lookup: MISS from perf3:3128 Via: 1.0 perf3:3128 (squid/2.6.STABLE21) Connection: keep-alive
</http-header>
<submitted-at>2020-06-22T10:26:29Z</submitted-at>
<sha256>
c79b3748d5bd71154748a469cee4d7e1d5c3fb747e0e4651a2a21001c042dc0b
</sha256>
<executed-at>2020-06-22T10:26:31Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src vlan="0">
<proxy>xxx.xxx.xxx.xxx</proxy>
<ip>xx.x.x.xxx</ip>
<port>47158</port>
<mac>bc:30:5b:d1:0a:93</mac>
</src>
<dst>
<ip>xxx.xxx.xxx.xxx</ip>
<mac>00:0e:0c:b9:b5:2e</mac>
<port>80</port>
</dst>
<occurred>2020-06-22T10:26:31Z</occurred>
<alert-url>
https://abc.mrl.trellix.com/event_stream/events_for_bot?ma_id=8032
</alert-url>
<action>notified</action>
</alert>
</alerts>
malware-object (Malware Analysis on Central Management)
<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="abc.xyz.com" appliance-id="00:25:90:86:7E:EE" msg="concise" product="CMS" version="9.0.0.916210" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" appliance-id="AC:1F:6B:1C:35:42" id="38032" name="malware-object" product="MAS" root-infection="621" sc-version="1028.210" sensor="AX-32-132" sensor-ip="10.128.32.132" severity="majr" uuid="d97ed4e0-772e-4372-b961-f5974942f76c" version="9.0.0.916210">
<explanation analysis="none">
<malware-detected>
<malware name="Malware.Binary.pdf" type="pdf">
<md5sum>80266d71f1ac3b71404ddab4e83a61be</md5sum>
<submitted-at>2020-07-03T08:48:46Z</submitted-at>
<sha256>c09a27c25daf3c4dec4fc641642252be899b01ac27909bf109e10206c4de03ef</sha256>
<executed-at>2020-07-03T08:50:47Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src>
<url>pdf_6745886</url>
</src>
<occurred>2020-07-03T08:50:47Z</occurred>
<alert-url>https://abc.xyz.com/malware_analysis/analyses?maid=38032</alert-url>
<action>notified</action>
</alert>
</alerts>
web-infection (Network Security)
<?xml version="1.0" encoding="UTF-8"?>
-<alerts xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.trellix.com/alert/2014/AlertSchema" version="9.0.2.924861" product="Web MPS" msg="concise" appliance-id="002590847FB8" appliance="abc.mrl.trellix.com">
-<alert uuid="9038f862-a4aa-466e-9096-d72b2d6efd67" severity="majr" sc-version="1073.116" name="web-infection" id="3885" ack="no">
-<explanation>
-<malware-detected>
-<malware name="Malware.Binary.url">
<submitted-at>2020-10-16T10:32:44Z</submitted-at>
</malware>
</malware-detected>
</explanation>
-<src vlan="0">
<ip>xxx.xxx.xxx.xxx</ip>
<host>xxx-xxx-xxx-xxx.rev.home.ne.jp</host>
</src>
-<dst>
<ip>xx.xxx.xxx.xxx</ip>
</dst>
<occurred>2020-10-16T10:34:41Z</occurred>
<alert-url>https://abc.mrl.trellix.com/event_stream/events_for_bot?inc_id=3885</alert-url>
<action>notified</action>
<attack-time>2020-10-16T10:31:24Z</attack-time>
</alert>
</alerts>
web-infection (Network Security on Central Management)
<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="abc.mrl.trellix.com" appliance-id="0C:C4:7A:90:D3:B6" msg="concise" product="CMS" version="9.0.0.916210" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert ack="no" appliance-id="00:0B:AB:DC:86:AD" id="192" name="web-infection" product="Web MPS" root-infection="76" sc-version="1031.162" sensor="Honeybee" sensor-ip="xx.x.x.xxx" severity="majr" uuid="6ec98260-b4c5-4f0c-8acb-6a176f96b1e8" version="9.0.0.916248">
<explanation>
<malware-detected>
<malware name="Trojan.Ramnit"/>
</malware-detected>
</explanation>
<src vlan="0">
<ip>xx.xxx.xxx.xx</ip>
</src>
<dst>
<ip>xx.xxx.xxx.xxx</ip>
</dst>
<occurred>2020-07-01T06:54:37Z</occurred>
<alert-url>https://abc.mrl.trellix.com/event_stream/events_for_bot?inc_id=192</alert-url>
<action>notified</action>
</alert>
</alerts>
infection-match (Network Security)
<?xml version="1.0" encoding="UTF-8"?>
-<alerts xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.trellix.com/alert/2014/AlertSchema" version="9.0.2.924861" product="Web MPS" msg="concise" appliance-id="002590847FB8" appliance="abc.mrl.trellix.com">
-<alert uuid="9dab4f9a-d022-4a4b-8aba-03e76bbc49f5" severity="minr" sc-version="1073.116" name="infection-match" id="13" ack="no">
-<explanation>
-<malware-detected>
<malware name="Local.Infection"/>
</malware-detected>
</explanation>
-<src vlan="0">
<ip>xxx.xxx.xxx.xxx</ip>
<host>xxx-xxx-xxx-xxx.rev.home.ne.jp</host>
</src>
-<dst>
<ip>xxx.xxx.xxx.xxx</ip>
</dst>
<occurred>2020-10-16T10:31:22Z</occurred>
<alert-url>https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=13</alert-url>
<action>notified</action>
<attack-time>2020-10-16T10:31:22Z</attack-time>
</alert>
</alerts>
domain-match (Network Security)
<?xml version="1.0" encoding="UTF-8"?>
-<alerts xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.trellix.com/alert/2014/AlertSchema" version="9.0.2.924861" product="Web MPS" msg="concise" appliance-id="002590847FB8" appliance="abc.mrl.trellix.com">
-<alert uuid="3dcdd294-91d5-4a88-bb9f-fc0bbb4b1870" severity="minr" sc-version="1073.116" name="domain-match" id="15" ack="no">
-<explanation>
-<malware-detected>
<malware name="Trojan.Win32.Dogrobot.gen.E"/>
</malware-detected>
</explanation>
-<src vlan="0">
<ip>xxx.xxx.xxx.xxx</ip>
<host>xxx-xxx-xxx-xxx.rev.home.ne.jp</host>
</src>
<occurred>2020-10-16T10:31:23Z</occurred>
<alert-url>https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=15</alert-url>
<action>notified</action>
<attack-time>2020-10-16T10:31:23Z</attack-time>
</alert>
</alerts>
ips-event (Network Security)
<alerts xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" appliance="abc.mrl.trellix.com" appliance-id="000BABDDC0CD" msg="normal" product="Web MPS" version="9.0.0.916432" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert id="12" name="ips-event" uuid="c7a524fc-5623-4d7e-b758-c13153e8c6eb" ack="no" severity="crit" class="IPS">
<explanation>
<ips-detected>
<ips-event>
<sig-id>85302399</sig-id>
<sig-revision>12</sig-revision>
<sig-name>Microsoft Internet Explorer XML Processing Memory Corruption</sig-name>
<match-count>1</match-count>
<cve-id/>
<action-taken>N/A</action-taken>
<attack-mode>client</attack-mode>
<mvx-status>N/A</mvx-status>
</ips-event>
</ips-detected>
</explanation>
<src vlan="0">
<ip>xxx.xx.x.xx</ip>
<port>80</port>
<mac>00:17:a4:aa:f4:93</mac>
</src>
<dst>
<ip>1xxx.xx.x.xxx</ip>
<port>1043</port>
<mac>00:0c:29:b2:fb:4f</mac>
</dst>
<occurred>2020-06-26T13:30:17Z</occurred>
<interface label="A1" mode="tap">pether3</interface>
<alert-url>https://abc.mrl.trellix.com/notification_url/ips_events?ev_id=12</alert-url>
<action>notified</action>
</alert>
</alerts>
riskware-callback (Network Security on Central Management)
<alerts xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" appliance="abc.mrl.trellix.com" appliance-id="AC:1F:6B:12:3E:2C" msg="normal" product="CMS" version="9.0.0.916210" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert appliance-id="00:0B:AB:F3:A9:D7" id="380" root-infection="380" uuid="36e8bce0-1f70-44bf-ae14-90c7946422d7" name="riskware-callback" severity="minr" class="RISKWARE" ack="no" product="Web MPS" version="9.0.0.916432" sensor="Mentos">
<explanation analysis="content" protocol="tcp">
<malware-detected>
<malware name="Adware.MultiPlug" malicious="no" type="">
<url>http://49939.northstar.api.socdn.com/installer/ad0d8641-dff0-11e3-8a58-80c16e6f498c/12932238/config</url>
<executed-at>2020-06-29T07:49:43Z</executed-at>
</malware>
</malware-detected>
<cnc-services>
<cnc-service port="80" protocol="tcp">
<address>49939.northstar.api.socdn.com</address>
<location>US/CA/Milpitas</location>
<channel>GET /installer/ad0d8641-dff0-11e3-8a58-80c16e6f498c/12932238/config HTTP/1.1::~~Accept-Language: en-XX::~~User-Agent: DownloadMR/1.2.4+ (MSIE 8.0; Windows NT 5.1 SP3; DB=ie; 9bf59659-7f5b-02eb-8c69-ce6a8ca6b231; m=wXuH; u=admin; aurora)::~~Host: 49939.northstar.api.socdn.com::~~Connection: Keep-Alive::~~::~~</channel>
</cnc-service>
</cnc-services>
</explanation>
<src vlan="0">
<ip>xx.x.x.xx</ip>
<port>1072</port>
<mac>00:20:18:11:01:43</mac>
</src>
<dst>
<ip>xxx.xx.xxx.x</ip>
<port>80</port>
<mac>00:01:6c:a9:2f:27</mac>
</dst>
<occurred>2020-06-29T07:49:43Z</occurred>
<alert-url>https://abc.mrl.trellix.com/detection/objects?uuid=36e8bce0-1f70-44bf-ae14-90c7946422d7</alert-url>
<action>notified</action>
</alert>
</alerts>
riskware-infection (Network Security on Central Management)
<?xml version="1.0" encoding="UTF-8"?>
<alerts appliance="abc.mrl.trellix.com" appliance-id="0C:C4:7A:90:D3:B6" msg="normal" product="CMS" version="9.0.0.916210" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert appliance-id="00:0B:AB:DC:86:AD" id="235" root-infection="235" uuid="edcc316f-280e-4f64-9ee6-445ea32fefe0" name="riskware-infection" severity="minr" class="RISKWARE" ack="no" product="Web MPS" version="9.0.0.916248" sensor="Honeybee">
<explanation analysis="content" protocol="">
<malware-detected>
<malware name="PUP.Generic.MVX" malicious="no" type="">
<url>xxx.xx.x.x/~kjohnson/CVE-2014-8439/Exploit.html</url>
<executed-at>2020-07-07T10:02:31Z</executed-at>
</malware>
</malware-detected>
<os-changes><analysis mode="web" ftype="url" version="1.5245" product="MPS"/>
<application app-name="InternetExplorer 8.0"/>
<malicious-alert classtype="AnalysisType CACHED_MODE"><display-msg>Track Cached Mode Submissions Objects</display-msg></malicious-alert>
<os name="windows" version="6.1.7601" sp="1" arch="x86"/>
<os_monitor version="17R1.13" build="915950" date="Jun 17 2020" time="08:39:42"/>
<network mode="http_request" timestamp="3837"><processinfo tainted="false"><pid>2232</pid><imagepath>C:\Program Files\Internet Explorer8\iexplore.exe</imagepath><md5sum>2c32e3e596cfe660353753eabefb0540</md5sum></processinfo><protocol_type>tcp</protocol_type><destination_port>8080</destination_port><ipaddress>10.0.0.2</ipaddress><http_request>GET http://172.16.1.2/~kjohnson/CVE-2014-8439/Exploit.html HTTP/1.1~~Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*~~Accept-Language: en-US~~User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)~~Accept-Encoding: gzip, deflate~~Proxy-Connection: Keep-Alive~~Host: 172.16.1.2~~~~</http_request></network>
<network mode="http_request" timestamp="5342"><processinfo tainted="false"><pid>2232</pid><imagepath>C:\Program Files\Internet Explorer8\iexplore.exe</imagepath><md5sum>2c32e3e596cfe660353753eabefb0540</md5sum></processinfo><protocol_type>tcp</protocol_type><destination_port>8080</destination_port><ipaddress>10.0.0.2</ipaddress><http_request>GET http://172.16.1.2/~kjohnson/CVE-2014-8439/Exploit.swf HTTP/1.1~~Accept: */*~~Accept-Language: en-US~~Referer: http://172.16.1.2/~kjohnson/CVE-2014-8439/Exploit.html~~x-flash-version: 14,0,0,145~~Accept-Encoding: gzip, deflate~~User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)~~Proxy-Connection: Keep-Alive~~Host: 172.16.1.2~~~~</http_request></network>
<Flash type="MethodList" timestamp="5444"><processinfo><pid>2232</pid><tid>2528</tid><imagepath>C:\Program Files\Internet Explorer8\iexplore.exe</imagepath><md5sum>2c32e3e596cfe660353753eabefb0540</md5sum></processinfo><Dll>Flash32_14_0_0_145.ocx</Dll><List><Method><Name>Object$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Class$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>global$init</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Function$/createEmptyFunction</Name><Ptr>0x05687f6b</Ptr></Method><Method><Name>Object$/_dontEnumPrototype</Name><Ptr>0x05687d81</Ptr></Method><Method><Name>Object$/_setPropertyIsEnumerable</Name><Ptr>0x0fdacae0</Ptr></Method><Method><Name>builtin.as$0::MethodClosure$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Boolean$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Number$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Number$/_minValue</Name><Ptr>0x0fdace00</Ptr></Method><Method><Name>int$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>uint$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>String$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Array$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>__AS3__.vec::Vector$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>__AS3__.vec::Vector.<*>$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>__AS3__.vec::Vector.<Number>$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Object$/_init</Name><Ptr>0x056878a2</Ptr></Method><Method><Name>XML$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>XMLList$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>QName$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>Error$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>DefinitionError$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>ReferenceError$cinit</Name><Ptr>0x0fe02990</Ptr></Method><Method><Name>SecurityError$cinit</Name><Ptr>0x0fe02990</Ptr></Method></List></Flash>
<Flash type="MethodList" timestamp="5476"><processinfo><pid>2232</pid><tid>2528</tid><imagepath>C:\Program Files\Internet Explorer8\iexplore.exe</imagepath><md5sum>2c32e3e596cfe660353753eabefb0540</md5sum></processinfo><Dll>Flash32_14_0_0_145.ocx</Dll><List><Method><Name>flash.display::Sprite</Name><Ptr>0x0571eb08</Ptr></Method><Method><Name>flash.display::Sprite/constructChildren</Name><Ptr>0x0f9c5934</Ptr></Method><Method><Name>flash.utils::ByteArray$cinit</Name><Ptr>0x0fe02990</Ptr></Method></List></Flash>
<Flash type="MethodList" timestamp="31869"><processinfo><pid>2076</pid><tid>1848</tid><imagepath>C:\Program Files\Internet Explorer\iexplore.exe</imagepath><md5sum>2859ebc065d2e1ccc94161ce28bac085</md5sum></processinfo><Dll>Flash32_18_0_0_194.ocx</Dll><List><Method><Name>flash.utils::ByteArray</Name><Ptr>0x064d6843</Ptr></Method><Method><Name>flash.utils::ByteArray/set length</Name><Ptr>0x0f796cf0</Ptr></Method><Method><Name>flash.system::ApplicationDomain$cinit</Name><Ptr>0x0f7eb600</Ptr></Method><Method><Name>flash.utils::ByteArray/deflate</Name><Ptr>0x064d67af</Ptr></Method><Method><Name>flash.utils::ByteArray/_compress</Name><Ptr>0x0f795320</Ptr></Method><Method><Name>ArgumentError</Name><Ptr>0x064d663f</Ptr></Method><Method><Name>Error</Name><Ptr>0x064d647c</Ptr></Method><Method><Name>flash.display::LoaderInfo</Name><Ptr>0x06570a76</Ptr></Method></List></Flash>
<malicious-alert classtype="PUP-Dynamic"><display-msg>Riskware Flash Method Name</display-msg></malicious-alert>
<end-of-report/></os-changes></explanation>
<src vlan="0">
<ip>xx.xxx.xxx.xxx</ip>
<port>50748</port>
<mac>00:50:56:b4:67:9b</mac>
</src>
<dst>
<ip>xx.xx.xx.xx</ip>
<port>80</port>
<mac>a0:d3:c1:f1:4a:7d</mac>
</dst>
<occurred>2020-07-07T10:02:31Z</occurred>
<alert-url>https://abc.mrl.trellix.com/detection/objects?uuid=edcc316f-280e-4f64-9ee6-445ea32fefe0</alert-url>
<action>notified</action>
</alert>
</alerts>
riskware-object (Network Security on Central Management)
<?xml version="1.0" encoding="UTF-8"?>
<alerts appliance="abc.mrl.trellix.com" appliance-id="0C:C4:7A:90:D3:B6" msg="normal" product="CMS" version="9.0.0.916210" xmlns="http://www.trellix.com/alert/2014/AlertSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert appliance-id="00:0B:AB:DC:86:AD" id="37348" root-infection="242" uuid="feeac03d-bf0c-4a7f-a835-ad9a981b7f2b" name="riskware-object" severity="minr" class="RISKWARE" ack="no" product="Web MPS" version="9.0.0.916248" sensor="Honeybee">
<explanation analysis="binary" protocol="">
<malware-detected>
<malware name="fe_ml_heuristic" malicious="no" type="exe">
<url>xxx.xx.xx.xxx/my_dir/1c3d210a0943dc06212ab00f394660ff</url>
<original>1c3d210a0943dc06212ab00f394660ff</original>
<submitted-at>2020-07-07T09:53:56Z</submitted-at>
<md5sum>1c3d210a0943dc06212ab00f394660ff</md5sum>
<sha256>222782ba0198801958d23ef944efba1ce4fd9b3b89a89595a13e074a757ebc41</sha256>
<profile>win7x64-sp1m</profile>
<http-header>GET /my_dir/1c3d210a0943dc06212ab00f394660ff HTTP/1.1::~~Host: xxx.xx.xx.xxx::~~Connection: keep-alive::~~Upgrade-Insecure-Requests: 1::~~User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.119 Safari/537.36::~~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8::~~DNT: 1::~~Accept-Encoding: gzip, deflate::~~Accept-Language: en-US,en;q=0.9,ur;q=0.8,ht;q=0.7::~~HTTP/1.1 200 OK::~~Date: Fri, 30 Mar 2018 07:32:16 GMT::~~Server: Apache/2.4.7 (Ubuntu)::~~Last-Modified: Fri, 30 Mar 2018 07:29:11 GMT::~~ETag: "2913b8-5689c32483c8c"::~~Accept-Ranges: bytes::~~Content-Length: 2692024::~~Keep-Alive: timeout=5, max=100::~~Connection: Keep-Alive::~~</http-header>
<executed-at>2020-07-07T09:53:56Z</executed-at>
</malware>
</malware-detected>
</explanation>
<src vlan="0">
<ip>xxx.xx.xx.x</ip>
<port>36310</port>
<mac>00:50:56:c0:00:08</mac>
</src>
<dst>
<ip>xxx.xx.xx.xxx</ip>
<port>80</port>
<mac>00:0c:29:b8:8e:a1</mac>
</dst>
<occurred>2020-07-07T09:53:56Z</occurred>
<alert-url>https://abc.mrl.trellix.com/detection/objects?uuid=feeac03d-bf0c-4a7f-a835-ad9a981b7f2b</alert-url>
<action>notified</action>
</alert>
</alerts>
riskware-callback (Network Security)
<?xml version="1.0" encoding="UTF-8"?>
-<alerts xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.trellix.com/alert/2014/AlertSchema" version="9.0.2.924861" product="Web MPS" msg="normal" appliance-id="002590847FB8" appliance="abc.mrl.trellix.com">
-<alert ack="no" class="RISKWARE" severity="minr" name="riskware-callback" uuid="1a7b87a8-4bcb-4baf-b37a-8c1deccd731f" root-infection="58" id="58">
-<explanation protocol="tcp" analysis="content">
-<malware-detected>
-<malware name="Adware.Crossrider" type="" malicious="no">
<url>http://stats.statsmyapp.com/apps.gif?action=uninstall&browser=ie&browserver=10&ver=1_34_2_13&bic=&app=52258&appver=0&verifier=&srcid=0&subid=0&zdata=0&xpiver=0&crxver=0&default=ie&chver=25&ffver=13&iever=10&installtime=1444697300&curtime=1444697300&lifetime=0&procstarttime=1444697299&rnd=1444697315</url>
<executed-at>2020-10-16T13:30:50Z</executed-at>
</malware>
</malware-detected>
-<cnc-services>
-<cnc-service protocol="tcp" port="80">
<address>stats.statsmyapp.com</address>
<location>CN/Guangzhou</location>
<channel>GET /apps.gif?action=uninstall&browser=ie&browserver=10&ver=1_34_2_13&bic=&app=52258&appver=0&verifier=&srcid=0&subid=0&zdata=0&xpiver=0&crxver=0&default=ie&chver=25&ffver=13&iever=10&installtime=1444697300&curtime=1444697300&lifetime=0&procstarttime=1444697299&rnd=1444697315
HTTP/1.1::~~Host: stats.statsmyapp.com::~~Connection: Keep-Alive::~~Cache-Control: no-cache::~~X-Forwarded-For: 213.59.14.20::~~::~~</channel>
</cnc-service>
</cnc-services>
</explanation-<src vlan="89">
<ip>xxx.xx.xx.xx</ip>
<port>49198</port>
<mac>00:20:18:11:01:65</mac>
</src>
-<dst>
<ip>xx.xxx.xxx.xx</ip>
<port>80</port>
<mac>00:01:6c:a9:2f:27</mac>
</dst>
<occurred>2020-10-16T13:30:50Z</occurred>
<attack-time>2020-10-16T13:30:50Z</attack-time>
<alert-url>https://abc.mrl.trellix.com/detection/objects?uuid=1a7b87a8-4bcb-4baf-b37a-8c1deccd731f</alert-url>
<action>notified</action>
</alert>
</alerts>
riskware-infection (Network Security)
<?xml version="1.0" encoding="UTF-8"?>
-<alerts xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.trellix.com/alert/2014/AlertSchema" version="9.0.2.924861" product="Web MPS" msg="normal" appliance-id="002590847FB8" appliance="abc.mrl.trellix.com">
-<alert ack="no" class="RISKWARE" severity="minr" name="riskware-infection" uuid="071b62f3-d9f3-43fa-a4b8-3726850ff6c0" root-infection="3918" id="3918">
-<explanation protocol="" analysis="content">
-<malware-detected>
-<malware name="PUP.Generic.MVX" type="" malicious="no">
<url>www.hulu.com/</url>
<executed-at>2020-10-16T13:37:52Z</executed-at>
</malware>
</malware-detected>
</explanation>
-<src vlan="0">
<ip>xx.x.x.xx</ip>
<port>49205</port>
<mac>00:20:18:11:01:65</mac>
</src>
-<dst>
<ip>xx.x.x.x</ip>
<port>8080</port>
<mac>00:01:6c:a9:2f:27</mac>
</dst>
<occurred>2020-10-16T13:37:52Z</occurred>
<attack-time>2020-10-16T13:31:35Z</attack-time>
<alert-url>https://abc.mrl.trellix.com/detection/objects?uuid=071b62f3-d9f3-43fa-a4b8-3726850ff6c0</alert-url>
<action>notified</action>
</alert>
</alerts>
riskware-object (Network Security)
<?xml version="1.0" encoding="UTF-8"?>
-<alerts xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.trellix.com/alert/2014/AlertSchema" version="9.0.2.924861" product="Web MPS" msg="normal" appliance-id="002590847FB8" appliance="abc.mrl.trellix.com">
-<alert ack="no" class="RISKWARE" severity="minr" name="riskware-object" uuid="073fb208-51d2-429d-930a-27aff4829af7" root-infection="18" id="18">
-<explanation protocol="" analysis="binary">
-<malware-detected>
-<malware name="FE_Adware_Searchbar" type="dll" malicious="no">
<url>xxx.xx.xx.xxx/my_dir/dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0</url>
<original>dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0</original>
<submitted-at>2020-10-16T13:32:28Z</submitted-at>
<md5sum>30dbe64027e570ada595c1e7b89664db</md5sum>
<sha1>80b2d887a9566879e28888864056204fddbc08b9</sha1>
<sha256>4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0</sha256>
<sha512>3d1f257bd7916dd755765241bfa6897654d1259f66bf0206d8f707e40900ba094b9949c
118657dd9f34b06e0cb9bc45b0af24c3f5dd592b3ab0f8b26da6b933f</sha512>
<profile>win7x64-sp1</profile>
<http-header>GET /my_dir/dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0 HTTP/1.1::~~Host: xxx.xx.xx.xxx::~~Connection: keep-alive::~~Upgrade-Insecure-Requests: 1::~~User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36::~~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8::~~DNT: 1::~~Referer: http://172.16.82.146/my_dir/::~~Accept-Encoding: gzip, deflate::~~Accept-Language: en-US,en;q=0.8,ur;q=0.6,ht;q=0.4::~~HTTP/1.1 200 OK::~~Date: Tue, 16 Jan 2018 10:24:58 GMT::~~Server: Apache/2.4.7 (Ubuntu)::~~Last-Modified: Tue, 16 Jan 2018 10:13:27 GMT::~~ETag: "21400-562e1fb50822b"::~~Accept-Ranges: bytes::~~Content-Length: 136192::~~Keep-Alive: timeout=5, max=99::~~Connection: Keep-Alive::~~</http-header>
<executed-at>2020-10-16T13:35:31Z</executed-at>
</malware>
</malware-detected>
</explanation>
-<src vlan="0">
<ip>xxx.xx.xx.x</ip>
<port>37420</port>
<mac>00:50:56:c0:00:08</mac>
</src>
-<dst>
<ip>xxx.xx.xx.xxx</ip>
<port>80</port>
<mac>00:0c:29:b8:8e:a1</mac>
</dst>
<occurred>2020-10-16T13:35:31Z</occurred>
<attack-time>2020-10-16T13:31:06Z</attack-time>
<alert-url>https://abc.mrl.trellix.com/detection/objects?uuid=073fb208-51d2-429d-930a-27aff4829af7</alert-url>
<action>notified</action>
</alert>
</alerts>
riskware-object (Email Security)
<?xml version="1.0" encoding="UTF-8"?>
<alerts appliance="abc-123.mrl.trellix.com" appliance-id="AC1F6B72041C" msg="normal" product="Email MPS" version="9.0.2.924983" xmlns="http://www.trellix.com/alert/2014/AlertSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.trellix.com/alert/2014/AlertSchema TrellixAlert.xsd">
<alert id="2" root-infection="2" uuid="d7ada227-2acb-4afa-9ef0-3046c3a4274a" name="riskware-object" severity="minr" class="RISKWARE" ack="no">
<explanation analysis="binary" protocol="">
<malware-detected>
<malware name="fe_ml_heuristic" malicious="no" type="exe">
<url>f215dba2f3b6ad9d870ad2e9e7f1894b</url>
<original>f215dba2f3b6ad9d870ad2e9e7f1894b</original>
<submitted-at>2020-10-17T10:06:09Z</submitted-at>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<sha1>1d7b082a4dba27f9fa66050149616f3f17abdd1f</sha1>
<sha256>4260bd012e1adab856a19d9e79774cab7b0df01b04aaf489b78ab54ce369713a</sha256>
<sha512>7347ea20984a45f4be7e7a0f8418b436743477ae69c699300a9f4446db50bb28904d0a43be83122bd592045431803cab8f81e125883baef7ce1882e9150284aa</sha512>
<profile>win7x64-sp1m</profile>
<executed-at>2020-10-17T10:07:49Z</executed-at>
</malware>
</malware-detected>
<cnc-services>
<cnc-service port="80" protocol="tcp">
<address>f215dba2f3b6ad9d870ad2e9e7f1894b</address>
<channel>GET / HTTP/1.1::~~Host: www.yklbtrnklnbkjrnbjyrbnjka.com::~~Cache-Control: no-cache::~~::~~GET / HTTP/1.1::~~Host: www.yklbtrnklnbkjrnbjyrbnjka.com::~~Cache-Control: no-cache::~~::~~</channel>
</cnc-service>
</cnc-services>
<os-changes><analysis mode="malware" ftype="exe" version="1.5485" product="eMPS"/>
<application app-name="Windows Explorer"/>
<malicious-alert classtype="static_log"><display-msg>Static Analysis fe_ml_heuristic</display-msg></malicious-alert>
<malicious-alert classtype="Possible unsigned Binary"><display-msg>Possibly Unsigned Binary</display-msg></malicious-alert>
<malicious-alert classtype="AnalysisType SANDBOX_MODE"><display-msg>Track Sandbox Mode Submissions Objects</display-msg></malicious-alert>
<malicious-alert classtype="FEBETA"><display-msg>Static Analysis</display-msg></malicious-alert>
<malicious-alert classtype="FEBETA_SA_ONLY"><display-msg>Static Analysis FEBETA</display-msg></malicious-alert>
<os name="windows" version="6.1.7601" sp="1" arch="x64"/>
<os_monitor version="17R1.14" build="924248" date="Oct 6 2020" time="11:21:10"/>
<PEData type="Summary" eventId="0" timestamp="3918"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1
\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo></PEData>
<malicious-alert classtype="PEDataFlags"><display-msg>PEData High Entropy</display-msg></malicious-alert>
<PEData type="ParseWarnings" eventId="0" timestamp="3974"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1
\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="Anomaly">__none__</pefield></PEData>
<PEData type="DOS_HEADER" eventId="0" timestamp="3977"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1
\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="e_magic">0x5a4d</pefield>
<pefield name="e_cblp">0x0090</pefield><pefield name="e_cp">0x0003</pefield><pefield name="e_crlc">0x0000</pefield>
<pefield name="e_cparhdr">0x0004</pefield><pefield name="e_minalloc">0x0000</pefield><pefield name="e_maxalloc">0xffff</pefield>
<pefield name="e_ss">0x0000</pefield><pefield name="e_sp">0x00b8</pefield><pefield name="e_csum">0x0000</pefield>
<pefield name="e_ip">0x0000</pefield></PEData>
<PEData type="NT_HEADER" eventId="0" timestamp="3982"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1
\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="Signature">0x00004550</pefield>
<pefield name="Machine">0x014c</pefield><pefield name="NumberOfSections">0x0005</pefield>
<pefield name="TimeDateStamp">0x5c922d37</pefield><pefield name="TimeDateStampString">Wed Mar 20 12:08:23 2019</pefield><pefield name="PointerToSymbolTable">0x00000000</pefield><pefield name="NumberOfSymbols">0x00000000</pefield><pefield name="SizeOfOptionalHeader">0x00e0</pefield><pefield name="Characteristics">0x0103</pefield></PEData>
<PEData type="Section" idx="0" eventId="0" timestamp="4114"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1
\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="Name">.text</pefield>
<pefield name="RawName">2E74657874000000</pefield><pefield name="VirtualSize">0x00108ca3</pefield>
<pefield name="VirtualAddress">0x00001000</pefield><pefield name="SizeOfRawData">0x00108e00</pefield>
<pefield name="PointerToRawData">0x00000400</pefield><pefield name="PointerToRelocations">0x00000000</pefield>
<pefield name="PointerToLinenumbers">0x00000000</pefield><pefield name="NumberOfRelocations">0x0000</pefield>
<pefield name="NumberOfLinenumbers">0x0000</pefield><pefield name="Characteristics">0x60000020</pefield>
<pefield name="Flags">IMAGE_SCN_MEM_EXECUTE</pefield><pefield name="Flags">IMAGE_SCN_MEM_READ</pefield>
<pefield name="Flags">IMAGE_SCN_CNT_CODE</pefield><pefield name="Entropy">6.806348603251031</pefield>
<pefield name="Md5">b4e48e72a7cfa45ef16386a74de5fc18</pefield></PEData>
<PEData type="Section" idx="1" eventId="0" timestamp="4132"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1\
AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="Name">.rdata</pefield>
<pefield name="RawName">2E72646174610000</pefield><pefield name="VirtualSize">0x00022256</pefield>
<pefield name="VirtualAddress">0x0010a000</pefield><pefield name="SizeOfRawData">0x00022400</pefield>
<pefield name="PointerToRawData">0x00109200</pefield><pefield name="PointerToRelocations">0x00000000</pefield>
<pefield name="PointerToLinenumbers">0x00000000</pefield><pefield name="NumberOfRelocations">0x0000</pefield>
<pefield name="NumberOfLinenumbers">0x0000</pefield><pefield name="Characteristics">0x40000040</pefield>
<pefield name="Flags">IMAGE_SCN_MEM_READ</pefield><pefield name="Entropy">5.335492656023659</pefield>
<pefield name="Md5">5af38dc32b867f0a6550eb0d8d51f01e</pefield></PEData>
<PEData type="Section" idx="2" eventId="0" timestamp="4139"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1\
AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="Name">.data</pefield>
<pefield name="RawName">2E64617461000000</pefield><pefield name="VirtualSize">0x0000e29c</pefield>
<pefield name="VirtualAddress">0x0012d000</pefield><pefield name="SizeOfRawData">0x00002e00</pefield>
<pefield name="PointerToRawData">0x0012b600</pefield><pefield name="PointerToRelocations">0x00000000</pefield>
<pefield name="PointerToLinenumbers">0x00000000</pefield><pefield name="NumberOfRelocations">0x0000</pefield>
<pefield name="NumberOfLinenumbers">0x0000</pefield><pefield name="Characteristics">0xc0000040</pefield>
<pefield name="Flags">IMAGE_SCN_MEM_READ</pefield><pefield name="Flags">IMAGE_SCN_MEM_WRITE</pefield>
<pefield name="Entropy">4.648002101617918</pefield><pefield name="Md5">2eb25f41096404d6bd9e83e5a20ea3d1</pefield>
</PEData>
<PEData type="Section" idx="3" eventId="0" timestamp="4146"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1\
AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="Name">.relocz</pefield>
<pefield name="RawName">2E72656C6F637A00</pefield><pefield name="VirtualSize">0x0000df23</pefield>
<pefield name="VirtualAddress">0x0013c000</pefield><pefield name="SizeOfRawData">0x0000e000</pefield>
<pefield name="PointerToRawData">0x0012e400</pefield><pefield name="PointerToRelocations">0x00000000</pefield>
<pefield name="PointerToLinenumbers">0x00000000</pefield><pefield name="NumberOfRelocations">0x0000</pefield>
<pefield name="NumberOfLinenumbers">0x0000</pefield><pefield name="Characteristics">0xc0000040</pefield>
<pefield name="Flags">IMAGE_SCN_MEM_READ</pefield><pefield name="Flags">IMAGE_SCN_MEM_WRITE</pefield>
<pefield name="Entropy">4.541036712919163</pefield><pefield name="Md5">46a520eca3ca1cd509fa477092d225e4</pefield>
</PEData>
<PEData type="Section" idx="4" eventId="0" timestamp="4233"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1\
AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize></fileinfo><pefield name="Name">.rsrc</pefield>
<pefield name="RawName">2E72737263000000</pefield><pefield name="VirtualSize">0x000aa260</pefield>
<pefield name="VirtualAddress">0x0014a000</pefield><pefield name="SizeOfRawData">0x000aa400</pefield>
<pefield name="PointerToRawData">0x0013c400</pefield><pefield name="PointerToRelocations">0x00000000</pefield>
<pefield name="PointerToLinenumbers">0x00000000</pefield><pefield name="NumberOfRelocations">0x0000</pefield>
<pefield name="NumberOfLinenumbers">0x0000</pefield><pefield name="Characteristics">0x40000040</pefield>
<pefield name="Flags">IMAGE_SCN_MEM_READ</pefield><pefield name="Entropy">7.850086781328695</pefield>
<pefield name="Md5">8461e1fda92140af1eb5f1b7afce6ac9</pefield></PEData>
<PEData type="KnownSignatures" eventId="0" timestamp="4238"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1\
AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<entropy>7.481725397181441</entropy><filesize>1992704</filesize>
</fileinfo><pefield name="Signature">__none__</pefield></PEData>
<PEData type="PE-Signature" eventId="0" timestamp="6053"><fileinfo origin="submitted"><value>C:\Users\ADMINI~1\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum><entropy>7.481725397181441</entropy><filesize>1992704</filesize>
</fileinfo><pefield name="Verified">Unsigned</pefield><pefield name="Link date">1:08 PM 3/20/2019</pefield>
<pefield name="Publisher">n/a</pefield><pefield name="Company">therefore</pefield><pefield name="Description">Windows Doctor</pefield><pefield name="Product">n/a</pefield><pefield name="Prod version">2.0.0.269</pefield><pefield name="File version">8.3.0.342</pefield><pefield name="MachineType">32-bit</pefield></PEData>
<process mode="started" timestamp="6169"><value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><UserAccount><SessionId>1</SessionId><AuthenticationId>USER_LUID (e5bc, 0)</AuthenticationId><UserSid>S-1-5-21-2529703413-2662079939-3113469119-500</UserSid><UserAccountName>TESTER\Administrator</UserAccountName><SuperPrivilegesPresent>0</SuperPrivilegesPresent></UserAccount><ParentUserAccount><SessionId>1</SessionId><AuthenticationId>USER_LUID (e5bc, 0)</AuthenticationId><UserSid>S-1-5-21-2529703413-2662079939-3113469119-500</UserSid><UserAccountName>TESTER\Administrator</UserAccountName><SuperPrivilegesPresent>0</SuperPrivilegesPresent></ParentUserAccount><pid>1732</pid><ppid>2468</ppid><parentname>C:\Windows\explorer.exe</parentname><cmdline>"C:\Users\ADMINI~1\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe" </cmdline>
<filesize>1992704</filesize><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
<sha1sum>1d7b082a4dba27f9fa66050149616f3f17abdd1f</sha1sum><sha256sum>4260bd012e1adab856a19d9e79774cab7b0df01b04aaf489b78ab54ce369713a</sha256sum><fid ads="">1407374883554514</fid></process>
<malicious-alert classtype="Process-Launch-Activity"><display-msg>Process Root for Executable Binaries</display-msg>
</malicious-alert>
<file mode="failed" timestamp="6304"><value>C:\Windows\System32\WOW64LOG.DLL</value><fid ads="">0</fid>
<processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<regkey mode="queryvalue" suppressed="false" randomized="true" timestamp="6379">
<value>\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"</value>
<processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<file mode="failed" timestamp="6405"><value>C:\Users\ADMINI~1\AppData\Local\Temp\SECUR32.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6461"><value>C:\Users\ADMINI~1\AppData\Local\Temp\PROFAPI.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6477"><value>C:\Users\ADMINI~1\AppData\Local\Temp\API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL</value><fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="open" timestamp="6497"><value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat</value><fid ads="">6473924464426163</fid><filesize>128</filesize><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x60</CreateOptions></file>
<file mode="failed" timestamp="6552"><value>C:\Users\ADMINI~1\AppData\Local\Temp\IPHLPAPI.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6572"><value>C:\Users\ADMINI~1\AppData\Local\Temp\WINNSI.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6600"><value>C:\Users\ADMINI~1
\AppData\Local\Temp\API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL</value><fid ads="">0</fid>
<processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6607">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyEnable" = 0x00000000</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6607">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyServer" = 10.0.0.2:8080</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<regkey mode="failed" suppressed="false" timestamp="6607">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyOverride"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6607">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"AutoConfigURL"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6607">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"AutoDetect"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="setval" suppressed="false" timestamp="6607">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\"SavedLegacySettings" = 46 00 00 00 60 00 00 00 09 00 00 00 0d 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 0a 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</value><processinfo><pid>1732</pid><imagepath>
C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<file mode="failed" timestamp="6633"><value>
C:\Users\ADMINI~1\AppData\Local\Temp\DNSAPI.DLL</value><fid ads="">0</fid><processinfo tainted="true">
<pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<mutex timestamp="6636">
<value>\Sessions\1\BaseNamedObjects\ZonesCacheCounterMutex</value>
<processinfo><pid>1732</pid><imagepath>
C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></mutex>
<regkey mode="failed" suppressed="false" timestamp="6636">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"ProxyBypass"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6637">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"ProxyBypass"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"IntranetName"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6637">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"IntranetName"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"UNCAsIntranet" = 0x00000000</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"AutoDetect" = 0x00000001</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<mutex timestamp="6639"><value>\Sessions\1\BaseNamedObjects\ZonesLockedCacheCounterMutex</value>
<processinfo><pid>1732</pid><imagepath>
C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></mutex>
<regkey mode="failed" suppressed="false" timestamp="6639">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"ProxyBypass"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6639">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"ProxyBypass"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6639">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"IntranetName"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="failed" suppressed="false" timestamp="6639">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"IntranetName"</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6639">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"UNCAsIntranet" = 0x00000000</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6639">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"AutoDetect" = 0x00000001</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6643">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\"CachePrefix" = </value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<file mode="failed" timestamp="6697"><value>C:\Users\Administrator</value>
<fid ads="">0</fid><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="6700"><value>C:\Users\Administrator\AppData\Local</value>
<fid ads="">0</fid><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="6703">
<value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files</value>
<fid ads="">0</fid><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6645">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\"CachePrefix" = Cookie:</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<file mode="failed" timestamp="6712"><value>C:\Windows\SysWOW64\RPCSS.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6715"><value>C:\Windows\SysWOW64\RPCSS.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6717"><value>C:\Users\Administrator</value>
<fid ads="">0</fid><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="6720"><value>C:\Users\Administrator\AppData\Roaming</value>
<fid ads="">0</fid><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="6723">
<value>C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies</value>
<fid ads="">0</fid><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure>
<ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<folder mode="open" timestamp="6726">
<value>C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies</value>
<processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x200000</CreateOptions></folder>
<folder mode="open" timestamp="6728">
<value>C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies</value>
<processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x200000</CreateOptions></folder>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="6652">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\"CachePrefix" = Visited:</value><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus></regkey>
<file mode="failed" timestamp="6734"><value>C:\Users\Administrator</value><fid ads="">0</fid>
<processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="6738"><value>C:\Users\Administrator\AppData\Local</value>
<fid ads="">0</fid>
<processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="6740"><value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\History</value>
<fid ads="">0</fid><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="6744"><value>C:\Users\ADMINI~1\AppData\Local\Temp\DHCPCSVC6.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6751"><value>C:\Users\ADMINI~1\AppData\Local\Temp\CRYPTSP.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6759"><value>C:\Users\ADMINI~1\AppData\Local\Temp\RPCRTREMOTE.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<file mode="failed" timestamp="6765"><value>C:\Users\ADMINI~1\AppData\Local\Temp\DHCPCSVC.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<apicall timestamp="6795"><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>kernel32.dll</dllname><apiname>Sleep</apiname><address>0x7687d98d</address><params><param id="1">60000</param></params></apicall>
<file mode="failed" timestamp="6805"><value>C:\Users\ADMINI~1\AppData\Local\Temp\RASADHLP.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure>
<ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<network mode="dns_query" timestamp="6844"><processinfo tainted="true"><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><protocol_type>udp</protocol_type>
<qtype>Host Address</qtype><hostname>www.yklbtrnklnbkjrnbjyrbnjka.com</hostname></network>
<malicious-alert classtype="Network-Activity"><display-msg>Network DNS Query Activity</display-msg>
</malicious-alert>
<malicious-alert classtype="Flags"><display-msg>Network Activity</display-msg></malicious-alert>
<malicious-alert classtype="FEBETA"><display-msg>Suspicious Regkey Behaviour</display-msg></malicious-alert>
<malicious-alert classtype="Flags"><display-msg>Network First Stage Downloader</display-msg></malicious-alert>
<network mode="dns_query_answer" timestamp="6855"><processinfo tainted="true"><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><protocol_type>udp</protocol_type>
<dns_response_code>0</dns_response_code><hostname>www.yklbtrnklnbkjrnbjyrbnjka.com</hostname><answer_number>1</answer_number><ipaddress>199.16.199.2</ipaddress></network>
<apicall timestamp="6858"><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>kernel32.dll</dllname><apiname>GetSystemDirectoryA</apiname><address>0x76b29c36</address><params><param id="1">0x18e910</param><param id="2">260</param></params></apicall>
<network mode="http_request" timestamp="6932"><processinfo tainted="true"><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><protocol_type>tcp</protocol_type>
<destination_port>80</destination_port><ipaddress>199.16.199.2</ipaddress><http_request>GET / HTTP/1.1~~Host: www.yklbtrnklnbkjrnbjyrbnjka.com~~Cache-Control: no-cache~~~~</http_request></network>
<malicious-alert classtype="FEBETA"><display-msg> Suspicious Network Activities</display-msg></malicious-alert>
<apicall timestamp="7399"><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>kernel32.dll</dllname><apiname>Sleep</apiname><address>0x7687d98d</address><params><param id="1">60000</param></params></apicall>
<apicall timestamp="7401"><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>kernel32.dll</dllname><apiname>Sleep</apiname><address>0x7687d98d</address><params><param id="1">60000</param></params></apicall>
<apicall timestamp="7434"><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>kernel32.dll</dllname><apiname>Sleep</apiname><address>0x7687d98d</address><params><param id="1">60000</param></params></apicall>
<apicall timestamp="7914"><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>kernel32.dll</dllname><apiname>Sleep</apiname><address>0x00409fa7</address><params><param id="1">1</param></params></apicall>
<apicall timestamp="7925"><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>kernel32.dll</dllname><apiname>Sleep</apiname><address>0x00409fa7</address><params><param id="1">1</param></params></apicall>
<file mode="failed" timestamp="7942"><value>C:\Users\ADMINI~1\AppData\Local\Temp\WTSAPI32.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure>
<ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/></file>
<apicall timestamp="7955"><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><dllname>ntdll.dll</dllname>
<apiname>NtAdjustPrivilegesToken</apiname><address>0x7649ca4f</address><params><param id="1">SeDebugPrivilege</param><param id="2">Enabled</param></params></apicall>
<file mode="created" timestamp="7959"><value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe:128</value><fid ads="128">1407374883554514</fid><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x60</CreateOptions></file>
<malicious-alert classtype="Flags"><display-msg>File Created</display-msg></malicious-alert>
<file mode="failed" timestamp="7961"><value>C:\Users\Administrator</value><fid ads="">0</fid>
<processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<file mode="failed" timestamp="7964"><value>C:\Users\Administrator\AppData\Roaming</value><fid ads="">0</fid>
<processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions></file>
<process mode="opened" timestamp="7967"><desiredaccess>0x00000410</desiredaccess><ntstatus>0xc000000b</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>0</pid><tid>0</tid><imagepath>N/A</imagepath></processinfo></target></process>
<process mode="opened" timestamp="7970"><desiredaccess>0x00000410</desiredaccess><ntstatus>0xc0000022</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>4</pid><tid>0</tid><imagepath>N/A</imagepath></processinfo></target></process>
<process mode="opened" timestamp="7973"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>268</pid><imagepath>C:\Windows\System32\smss.exe</imagepath><md5sum>1911a3356fa3f77ccc825ccbac038c2a</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="7977"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>268</pid>
<imagepath>C:\Windows\System32\smss.exe</imagepath>
<md5sum>1911a3356fa3f77ccc825ccbac038c2a</md5sum></processinfo></target><Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="7981"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>352</pid><imagepath>C:\Windows\System32\csrss.exe</imagepath><md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="7985"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>352</pid><imagepath>C:\Windows\System32\csrss.exe</imagepath><md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="7988"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>380</pid><imagepath>C:\Windows\System32\wininit.exe</imagepath><md5sum>94355c28c1970635a31b3fe52eb7ceba</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="7992"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>380</pid><imagepath>C:\Windows\System32\wininit.exe</imagepath><md5sum>94355c28c1970635a31b3fe52eb7ceba</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="7996"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>400</pid><imagepath>C:\Windows\System32\csrss.exe</imagepath><md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="7999"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>400</pid>
<imagepath>C:\Windows\System32\csrss.exe</imagepath><md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8003"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>436</pid><imagepath>C:\Windows\System32\winlogon.exe</imagepath><md5sum>1151b1baa6f350b1db6598e0fea7c457</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8007"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>436</pid>
<imagepath>C:\Windows\System32\winlogon.exe</imagepath><md5sum>1151b1baa6f350b1db6598e0fea7c457</md5sum></processinfo></target><Address>0x000007fffffdcfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8010"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>480</pid><imagepath>C:\Windows\System32\services.exe</imagepath><md5sum>24acb7e5be595468e3b9aa488b9b4fcb</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8014"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>480</pid>
<imagepath>C:\Windows\System32\services.exe</imagepath><md5sum>24acb7e5be595468e3b9aa488b9b4fcb</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8017"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>496</pid><imagepath>C:\Windows\System32\lsass.exe</imagepath><md5sum>0793f40b9b8a1bdd266296409dbd91ea</md5sum></processinfo></target></process>
<malicious-alert classtype="FEBETA"><display-msg>Password Hash Dump Tool</display-msg></malicious-alert>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8021"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>496</pid><imagepath>C:\Windows\System32\lsass.exe</imagepath><md5sum>0793f40b9b8a1bdd266296409dbd91ea</md5sum></processinfo></target><Address>0x000007fffffdcfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<malicious-alert classtype="FEBETA"><display-msg>Suspicious Lateral Movement</display-msg></malicious-alert>
<process mode="opened" timestamp="8024"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>504</pid><imagepath>C:\Windows\System32\lsm.exe</imagepath><md5sum>9662ee182644511439f1c53745dc1c88</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8028"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>504</pid><imagepath>C:\Windows\System32\lsm.exe</imagepath><md5sum>9662ee182644511439f1c53745dc1c88</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8032"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>616</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8035"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>616</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8038"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>688</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8042"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>688</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffd5fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8045"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>776</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8049"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>776</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffddfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8053"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>840</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8056"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>840</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdbfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8060"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>884</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8063"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>884</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdefa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8067"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>908</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8070"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>908</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8073"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1056</pid><imagepath>C:\Windows\System32\spoolsv.exe</imagepath><md5sum>b96c17b5dc1424d56eea3a99e97428cd</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8077"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1056</pid><imagepath>C:\Windows\System32\spoolsv.exe</imagepath><md5sum>b96c17b5dc1424d56eea3a99e97428cd</md5sum></processinfo></target><Address>0x000007fffffdafa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8080"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1124</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8084"><source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1124</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8088"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1144</pid><imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8095"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1144</pid><imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8099"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1232</pid><imagepath>C:\Windows\System32\dwm.exe</imagepath><md5sum>f162d5f5e845b9dc352dd1bad8cef1bc</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8103"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1232</pid><imagepath>C:\Windows\System32\dwm.exe</imagepath><md5sum>f162d5f5e845b9dc352dd1bad8cef1bc</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8107"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1348</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8111"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1348</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8116"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1412</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8120"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1412</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8124"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1552</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8128"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1552</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8132"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>500</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8136"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>500</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8140"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1104</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8144"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1104</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd4fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8148"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>604</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8151"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>604</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffdcfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8156"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>624</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8159"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>624</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8163"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>792</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8167"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>792</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffddfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8171"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1156</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8175"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1156</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8178"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1912</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8182"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1912</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8185"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>488</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8189"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>488</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8192"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1980</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8196"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1980</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8200"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>956</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8204"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>956</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8207"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1196</pid><imagepath>C:\Windows\System32\mspaint.exe</imagepath><md5sum>458f4590f80563eb2a0a72709bfc2bd9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8211"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1196</pid><imagepath>C:\Windows\System32\mspaint.exe</imagepath><md5sum>458f4590f80563eb2a0a72709bfc2bd9</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8215"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1688</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8219"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1688</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffd5fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8222"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1728</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8226"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1728</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8230"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>236</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8234"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>236</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8238"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>768</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8242"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>768</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8246"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>220</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8250"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>220</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffd7fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8253"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>592</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8257"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>592</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdafa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8261"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1900</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8265"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1900</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8270"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1068</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8274"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1068</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8278"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1984</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8282"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1984</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdafa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8285"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1964</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8289"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1964</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdcfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8293"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1444</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8297"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1444</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd7fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8302"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2468</pid><imagepath>C:\Windows\explorer.exe</imagepath><md5sum>ac4c51eb24aa95b77f705ab159189e24</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8306"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo>
<pid>2468</pid><imagepath>C:\Windows\explorer.exe</imagepath><md5sum>ac4c51eb24aa95b77f705ab159189e24</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8310"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2652</pid><imagepath>C:\Program Files\Internet Explorer\iexplore.exe</imagepath><md5sum>0685765c0cbe095ba0c6c8790bae21ef</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8314"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2652</pid>
<imagepath>C:\Program Files\Internet Explorer\iexplore.exe</imagepath><md5sum>0685765c0cbe095ba0c6c8790bae21ef</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8319"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2712</pid><imagepath>C:\Program Files (x86)\Internet Explorer\iexplore.exe</imagepath><md5sum>c8a8321292a459b0a17fb39a782a5c74</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8323"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2712</pid>
<imagepath>C:\Program Files (x86)\Internet Explorer\iexplore.exe</imagepath>
<md5sum>c8a8321292a459b0a17fb39a782a5c74</md5sum></processinfo></target><Address>0x000000007efde008</Address><Size>0x0000000000000004</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8327"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2936</pid>
<imagepath>C:\Program Files (x86)\Internet Explorer\iexplore.exe</imagepath>
<md5sum>c8a8321292a459b0a17fb39a782a5c74</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8331"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2936</pid><imagepath>C:\Program Files (x86)\Internet Explorer\iexplore.exe</imagepath><md5sum>c8a8321292a459b0a17fb39a782a5c74</md5sum></processinfo></target><Address>0x000000007efde008</Address><Size>0x0000000000000004</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8336"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3036</pid><imagepath>C:\Program Files (x86)\Internet Explorer9\iexplore.exe</imagepath><md5sum>904e13ba41af2e353a32cf351ca53639</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8340"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3036</pid>
<imagepath>C:\Program Files (x86)\Internet Explorer9\iexplore.exe</imagepath>
<md5sum>904e13ba41af2e353a32cf351ca53639</md5sum></processinfo></target><Address>0x000000007efde008</Address><Size>0x0000000000000004</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8344"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2172</pid><imagepath>C:\Program Files (x86)\Internet Explorer9\iexplore.exe</imagepath><md5sum>904e13ba41af2e353a32cf351ca53639</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8348"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2172</pid>
<imagepath>C:\Program Files (x86)\Internet Explorer9\iexplore.exe</imagepath>
<md5sum>904e13ba41af2e353a32cf351ca53639</md5sum></processinfo></target><Address>0x000000007efde008</Address><Size>0x0000000000000004</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8353"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3112</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8357"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3112</pid>
<imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdefa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8361"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
</processinfo></source><target><processinfo><pid>3512</pid><imagepath>C:\Windows\System32\wbem\WmiPrvSE.exe</imagepath><md5sum>d683c112190f4b4c6d477d693ee88e35</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8365"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3512</pid>
<imagepath>C:\Windows\System32\wbem\WmiPrvSE.exe</imagepath><md5sum>d683c112190f4b4c6d477d693ee88e35</md5sum></processinfo></target><Address>0x000007fffffd6fa8</Address>
<Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8369"><desiredaccess>0x00000410</desiredaccess><ntstatus>0xc000000d</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>4088</pid><tid>0</tid><imagepath>N/A</imagepath></processinfo></target></process>
<process mode="opened" timestamp="8373"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3108</pid><imagepath>C:\Windows\System32\conhost.exe</imagepath>
<md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8376"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3108</pid>
<imagepath>C:\Windows\System32\conhost.exe</imagepath><md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum>
</processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8380"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3628</pid><imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8384"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3628</pid>
<imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address>
<Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8388"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2552</pid><imagepath>C:\Windows\System32\powercfg.exe</imagepath>
<md5sum>f779ee89cd1f679c91ab8848c978f086</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8392"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2552</pid>
<imagepath>C:\Windows\System32\powercfg.exe</imagepath><md5sum>f779ee89cd1f679c91ab8848c978f086</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address>
<Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8396"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3688</pid><imagepath>C:\Windows\System32\conhost.exe</imagepath>
<md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8400"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3688</pid><imagepath>C:\Windows\System32\conhost.exe</imagepath>
<md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum></processinfo></target><Address>0x000007fffffd7fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8404"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3664</pid><imagepath>C:\Windows\System32\Defrag.exe</imagepath>
<md5sum>8fd0ec6eb52f9efe15b7a605c827932c</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8408"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3664</pid>
<imagepath>C:\Windows\System32\Defrag.exe</imagepath><md5sum>8fd0ec6eb52f9efe15b7a605c827932c</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address>
<Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8413"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3676</pid><imagepath>C:\Windows\System32\wsqmcons.exe</imagepath>
<md5sum>8fafca21fe9b20c420ce9d4dc50a7169</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8417"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3676</pid>
<imagepath>C:\Windows\System32\wsqmcons.exe</imagepath><md5sum>8fafca21fe9b20c420ce9d4dc50a7169</md5sum></processinfo></target>
<Address>0x000007fffffd4fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8421"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3700</pid><imagepath>C:\Windows\System32\conhost.exe</imagepath><md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8425"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3700</pid>
<imagepath>C:\Windows\System32\conhost.exe</imagepath><md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum></processinfo></target>
<Address>0x000007fffffd4fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8429"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2308</pid><imagepath>C:\Windows\System32\taskhost.exe
</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8432"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>2308</pid>
<imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target>
<Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8436"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>820</pid><imagepath>C:\Windows\System32\sdclt.exe</imagepath>
<md5sum>cdebd55ffbda3889aa2a8ce52b9dc097</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8439"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>820</pid>
<imagepath>C:\Windows\System32\sdclt.exe</imagepath><md5sum>cdebd55ffbda3889aa2a8ce52b9dc097</md5sum></processinfo></target><Address>0x000007fffffd7fa8</Address>
<Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<process mode="opened" timestamp="8443"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3772</pid><imagepath>C:\Windows\SysWOW64\notepad.exe</imagepath>
<md5sum>d378bffb70923139d6a4f546864aa61c</md5sum></processinfo></target></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="8446"><source><processinfo><pid>1732</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>3772</pid>
<imagepath>C:\Windows\SysWOW64\notepad.exe</imagepath><md5sum>d378bffb70923139d6a4f546864aa61c</md5sum></processinfo></target><Address>0x000000007efde008</Address>
<Size>0x0000000000000004</Size><IsMinApplAddress>no</IsMinApplAddress></FirstRpidMemOp>
<file mode="open" timestamp="8450"><value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe:Zone.Identifier</value>
<fid ads="Zone.Identifier">1407374883554514</fid><filesize>26</filesize><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x200040</CreateOptions></file>
<file mode="delete" timestamp="8453"><value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe:Zone.Identifier</value>
<fid ads="Zone.Identifier">1407374883554514</fid><filesize>26</filesize><processinfo><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x0</CreateOptions></file>
<malicious-alert classtype="Flags"><display-msg>File Deleted</display-msg></malicious-alert>
<process mode="terminated" timestamp="8152"><value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value><pid>1732</pid><ppid>2468</ppid>
<parentname>C:\Windows\explorer.exe</parentname><cmdline>N/A</cmdline><fid ads="">1407374883554514</fid><telemetry_data><child_process_count>0</child_process_count><local_thread_count>9</local_thread_count><remote_thread_count>0</remote_thread_count><mutex_create_count>2</mutex_create_count><file_failed_count>27</file_failed_count><file_open_count>4</file_open_count><file_create_count>1</file_create_count><file_modify_count>0</file_modify_count><http_req_count>1</http_req_count></telemetry_data><memory_data/></process>
<file mode="close" timestamp="8463"><value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat</value><fid ads="">6473924464426163</fid><filesize>128</filesize>
<md5sum>e2a2ee100decf56c47f4f2f7d96a0392</md5sum><sha1sum>6acfa17118fbd35f97bea8b80f39a40f32e7dd8c</sha1sum><sha256sum>574f2829bc697db6b53fe33cf4c9fc6cdebeab0b4ef9f3531c3f06cd26c8704b</sha256sum><processinfo tainted="true"><pid>1732</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x0</CreateOptions><obj_info engine_id="magic" src="file_reporting_engine"><prop chunk="1" pname="extension">DDB</prop><prop chunk="1" pname="percentage">96</prop><prop chunk="1" pname="description">Windows Device Dependent Bitmap</prop>
<prop chunk="1" pname="type">Binary</prop><prop chunk="2" pname="extension">SMT</prop>
<prop chunk="2" pname="percentage">2</prop><prop chunk="2" pname="description">Memo File Apollo Database Engine</prop><prop chunk="2" pname="type">Binary</prop></obj_info></file>
<process mode="started" timestamp="18526">
<value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value>
<UserAccount><SessionId>1</SessionId><AuthenticationId>USER_LUID (e5bc, 0)</AuthenticationId>
<UserSid>S-1-5-21-2529703413-2662079939-3113469119-500</UserSid><UserAccountName>TESTER\Administrator</UserAccountName><SuperPrivilegesPresent>0</SuperPrivilegesPresent>
</UserAccount><ParentUserAccount><SessionId>1</SessionId><AuthenticationId>USER_LUID (e5bc, 0)</AuthenticationId><UserSid>S-1-5-21-2529703413-2662079939-3113469119-500</UserSid><UserAccountName>TESTER\Administrator</UserAccountName><SuperPrivilegesPresent>0</SuperPrivilegesPresent></ParentUserAccount><pid>3980</pid><ppid>2468</ppid><parentname>C:\Windows\explorer.exe</parentname><cmdline>"C:\Users\ADMINI~1\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe"
</cmdline><filesize>1992704</filesize><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum><sha1sum>1d7b082a4dba27f9fa66050149616f3f17abdd1f</sha1sum>
<sha256sum>4260bd012e1adab856a19d9e79774cab7b0df01b04aaf489b78ab54ce369713a</sha256sum><fid ads="">1407374883554514</fid><spanalysis>true</spanalysis></process>
<file mode="failed" timestamp="18617"><value>C:\Windows\System32\WOW64LOG.DLL</value><fid ads="">0</fid>
<processinfo tainted="true"><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo>
<failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18623"><value>C:\Users\ADMINI~1\AppData\Local\Temp\SECUR32.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions>
<PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18626"><value>C:\Users\ADMINI~1\AppData\Local\Temp\PROFAPI.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions>
<PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18632"><value>C:\Users\ADMINI~1\AppData\Local\Temp\API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL</value><fid ads="">0</fid>
<processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="open" timestamp="18636"><value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat</value><fid ads="">6473924464426163</fid>
<filesize>128</filesize><md5sum>e2a2ee100decf56c47f4f2f7d96a0392</md5sum><sha1sum>6acfa17118fbd35f97bea8b80f39a40f32e7dd8c</sha1sum><sha256sum>574f2829bc697db6b53fe33cf4c9fc6cdebeab0b4ef9f3531c3f06cd26c8704b</sha256sum><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x60</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18640"><value>C:\Users\ADMINI~1\AppData\Local\Temp\IPHLPAPI.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18644"><value>C:\Users\ADMINI~1\AppData\Local\Temp\WINNSI.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18647"><value>C:\Users\ADMINI~1\AppData\Local\Temp\API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL</value><fid ads="">0</fid>
<processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18634">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyEnable" = 0x00000000</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18634">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyServer" = 10.0.0.2:8080</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18634">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"ProxyOverride"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18634">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"AutoConfigURL"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18635">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"AutoDetect"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="setval" suppressed="false" timestamp="18635">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\"SavedLegacySettings" = 46 00 00 00 61 00 00 00 09 00 00 00 0d 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 0a 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</value><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<file mode="failed" timestamp="18675"><value>C:\Users\ADMINI~1\AppData\Local\Temp\DNSAPI.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<mutex timestamp="18637"><value>\Sessions\1\BaseNamedObjects\ZonesCacheCounterMutex</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><spanalysis>true</spanalysis></mutex>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"ProxyBypass"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"ProxyBypass"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"IntranetName"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"IntranetName"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"UNCAsIntranet" = 0x00000000</value><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"AutoDetect" = 0x00000001</value><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<mutex timestamp="18637"><value>\Sessions\1\BaseNamedObjects\ZonesLockedCacheCounterMutex</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><spanalysis>true</spanalysis></mutex>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"ProxyBypass"</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"ProxyBypass"</value><processinfo><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"IntranetName"</value><processinfo><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="failed" suppressed="false" timestamp="18637">
<value>\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\"IntranetName"</value><processinfo><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo>
<ntstatus>0xc0000034</ntstatus><failure>deleteval</failure><spanalysis>true</spanalysis></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"UNCAsIntranet" = 0x00000000</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18637">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"AutoDetect" = 0x00000001</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18647">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\"CachePrefix" = </value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<file mode="failed" timestamp="18728"><value>C:\Users\Administrator</value><fid ads="">0</fid>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18731"><value>C:\Users\Administrator\AppData\Local</value>
<fid ads="">0</fid><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18734"><value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files</value><fid ads="">0</fid>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18649">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\"CachePrefix" = Cookie:</value><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<file mode="failed" timestamp="18741"><value>C:\Users\Administrator</value><fid ads="">0</fid>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18744"><value>C:\Users\Administrator\AppData\Roaming</value>
<fid ads="">0</fid><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18747"><value>C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies</value><fid ads="">0</fid>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<folder mode="open" timestamp="18750"><value>C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x200000</CreateOptions><spanalysis>true</spanalysis></folder>
<folder mode="open" timestamp="18753"><value>C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies</value>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x200000</CreateOptions><spanalysis>true</spanalysis></folder>
<regkey mode="setval" suppressed="false" set_value_nochange="true" timestamp="18652">
<value>\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\"CachePrefix" = Visited:</value><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x00000000</ntstatus><spanalysis>true</spanalysis></regkey>
<file mode="failed" timestamp="18759"><value>C:\Users\Administrator</value><fid ads="">0</fid>
<processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18762"><value>C:\Users\Administrator\AppData\Local</value>
<fid ads="">0</fid><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18765"><value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\History</value>
<fid ads="">0</fid><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18768"><value>C:\Windows\SysWOW64\RPCSS.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18771"><value>C:\Windows\SysWOW64\RPCSS.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18774"><value>C:\Users\ADMINI~1\AppData\Local\Temp\DHCPCSVC6.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18777"><value>C:\Users\ADMINI~1\AppData\Local\Temp\DHCPCSVC.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18780"><value>C:\Users\ADMINI~1\AppData\Local\Temp\CRYPTSP.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18784"><value>C:\Users\ADMINI~1\AppData\Local\Temp\RPCRTREMOTE.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="18787"><value>C:\Users\ADMINI~1\AppData\Local\Temp\RASADHLP.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus><CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<network mode="dns_query" timestamp="18790"><processinfo tainted="true"><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><protocol_type>udp</protocol_type><qtype>Host Address</qtype>
<hostname>www.yklbtrnklnbkjrnbjyrbnjka.com</hostname><spanalysis>true</spanalysis></network>
<network mode="dns_query_answer" timestamp="18793"><processinfo tainted="true"><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><protocol_type>udp</protocol_type><dns_response_code>0</dns_response_code><hostname>www.yklbtrnklnbkjrnbjyrbnjka.com</hostname><answer_number>1</answer_number><ipaddress>199.16.199.2</ipaddress><spanalysis>true</spanalysis></network>
<network mode="http_request" timestamp="18796"><processinfo tainted="true"><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><protocol_type>tcp</protocol_type><destination_port>80</destination_port><ipaddress>199.16.199.2</ipaddress><http_request>GET / HTTP/1.1~~Host: www.yklbtrnklnbkjrnbjyrbnjka.com~~Cache-Control: no-cache~~~~</http_request><spanalysis>true</spanalysis></network>
<file mode="failed" timestamp="19721"><value>C:\Users\ADMINI~1\AppData\Local\Temp\WTSAPI32.DLL</value>
<fid ads="">0</fid><processinfo tainted="true"><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>open</failure><ntstatus>0xc0000034</ntstatus>
<CreateOptions>0x200000</CreateOptions><PE InspectionType="Ext"/><spanalysis>true</spanalysis></file>
<file mode="overwritten" timestamp="19745"><value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe:128</value>
<fid ads="128">1407374883554514</fid><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x60</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="19748"><value>C:\Users\Administrator</value>
<fid ads="">0</fid><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<file mode="failed" timestamp="19750"><value>C:\Users\Administrator\AppData\Roaming</value>
<fid ads="">0</fid><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><failure>created</failure><ntstatus>0xc0000035</ntstatus><CreateOptions>0x200021</CreateOptions><spanalysis>true</spanalysis></file>
<process mode="opened" timestamp="19754"><desiredaccess>0x00000410</desiredaccess><ntstatus>0xc000000b</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>0</pid><tid>0</tid><imagepath>N/A</imagepath></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="19757"><desiredaccess>0x00000410</desiredaccess><ntstatus>0xc0000022</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>4</pid><tid>0</tid><imagepath>N/A</imagepath></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="19760"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>268</pid><imagepath>C:\Windows\System32\smss.exe</imagepath>
<md5sum>1911a3356fa3f77ccc825ccbac038c2a</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19764"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>268</pid><imagepath>C:\Windows\System32\smss.exe</imagepath><md5sum>1911a3356fa3f77ccc825ccbac038c2a</md5sum></processinfo></target><Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19767"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>352</pid><imagepath>C:\Windows\System32\csrss.exe</imagepath>
<md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19771"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>352</pid><imagepath>C:\Windows\System32\csrss.exe</imagepath><md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19775"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>380</pid><imagepath>C:\Windows\System32\wininit.exe</imagepath>
<md5sum>94355c28c1970635a31b3fe52eb7ceba</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19778"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>380</pid><imagepath>C:\Windows\System32\wininit.exe</imagepath><md5sum>94355c28c1970635a31b3fe52eb7ceba</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19782"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>400</pid><imagepath>C:\Windows\System32\csrss.exe</imagepath>
<md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19786"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>400</pid><imagepath>C:\Windows\System32\csrss.exe</imagepath><md5sum>60c2862b4bf0fd9f582ef344c2b1ec72</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19789"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>436</pid><imagepath>C:\Windows\System32\winlogon.exe</imagepath>
<md5sum>1151b1baa6f350b1db6598e0fea7c457</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19793"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>436</pid><imagepath>C:\Windows\System32\winlogon.exe</imagepath><md5sum>1151b1baa6f350b1db6598e0fea7c457</md5sum></processinfo></target><Address>0x000007fffffdcfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19797"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>480</pid><imagepath>C:\Windows\System32\services.exe</imagepath><md5sum>24acb7e5be595468e3b9aa488b9b4fcb</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19800"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>480</pid><imagepath>C:\Windows\System32\services.exe</imagepath><md5sum>24acb7e5be595468e3b9aa488b9b4fcb</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19804"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>496</pid><imagepath>C:\Windows\System32\lsass.exe</imagepath>
<md5sum>0793f40b9b8a1bdd266296409dbd91ea</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19807"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>496</pid><imagepath>C:\Windows\System32\lsass.exe</imagepath><md5sum>0793f40b9b8a1bdd266296409dbd91ea</md5sum></processinfo></target><Address>0x000007fffffdcfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19811"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>504</pid><imagepath>C:\Windows\System32\lsm.exe</imagepath>
<md5sum>9662ee182644511439f1c53745dc1c88</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19815"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>504</pid><imagepath>C:\Windows\System32\lsm.exe</imagepath><md5sum>9662ee182644511439f1c53745dc1c88</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19818"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>616</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath>
<md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19822"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>616</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19826"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>688</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath>
<md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19829"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>688</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffd5fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19833"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>776</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath>
<md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19836"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>776</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffddfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19840"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>840</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath>
<md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19844"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>840</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdbfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19847"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>884</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath>
<md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19851"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>884</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdefa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19855"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>908</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath>
<md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19858"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>908</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19862"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1056</pid><imagepath>C:\Windows\System32\spoolsv.exe</imagepath>
<md5sum>b96c17b5dc1424d56eea3a99e97428cd</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19866"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1056</pid>
<imagepath>C:\Windows\System32\spoolsv.exe</imagepath><md5sum>b96c17b5dc1424d56eea3a99e97428cd</md5sum></processinfo></target>
<Address>0x000007fffffdafa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19869"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1124</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19873"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1124</pid>
<imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target>
<Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19877"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1144</pid><imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19880"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1144</pid>
<imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum></processinfo></target>
<Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19884"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1232</pid><imagepath>C:\Windows\System32\dwm.exe</imagepath><md5sum>f162d5f5e845b9dc352dd1bad8cef1bc</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19888"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1232</pid>
<imagepath>C:\Windows\System32\dwm.exe</imagepath><md5sum>f162d5f5e845b9dc352dd1bad8cef1bc</md5sum></processinfo></target>
<Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19891"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1348</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19895"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1348</pid>
<imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target>
<Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19899"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1412</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19902"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1412</pid>
<imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target>
<Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19906"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1552</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19910"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1552</pid>
<imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target>
<Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19913"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>500</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath>
<md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19917"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>500</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath>
<md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19920"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1104</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath>
<md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19924"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1104</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target>
<Address>0x000007fffffd4fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19928"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>604</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19931"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>604</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target>
<Address>0x000007fffffdcfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19935"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>624</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19939"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>624</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target>
<Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19943"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>792</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19946"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>792</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffddfa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19950"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1156</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19953"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1156</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19957"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo><pid>3980</pid>
<imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1912</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19961"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1912</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd9fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19964"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>488</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19968"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>488</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19972"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1980</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19975"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1980</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19979"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>956</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19982"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>956</pid>
<imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19986"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1196</pid><imagepath>C:\Windows\System32\mspaint.exe</imagepath><md5sum>458f4590f80563eb2a0a72709bfc2bd9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19990"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1196</pid>
<imagepath>C:\Windows\System32\mspaint.exe</imagepath><md5sum>458f4590f80563eb2a0a72709bfc2bd9</md5sum></processinfo></target><Address>0x000007fffffd8fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="19993"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1688</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="19997"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1688</pid>
<imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffd5fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20001"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1728</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="20004"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1728</pid><imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20008"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>236</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="20012"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>236</pid><imagepath>C:\Windows\System32\svchost.exe</imagepath><md5sum>c78655bc80301d76ed4fef1c1ea40a7d</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20015"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target>
<processinfo><pid>768</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="20019"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>768</pid><imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20023"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target>
<processinfo><pid>220</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo>
</target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="20026"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>220</pid><imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffd7fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20030"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>592</pid><imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="20034"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>592</pid><imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdafa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20037"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1900</pid><imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="20041"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1900</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffdffa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20045"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1068</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<FirstRpidMemOp mode="ReadVirtualMemory" timestamp="20048"><source><processinfo><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source><target><processinfo><pid>1068</pid><imagepath>C:\Windows\System32\calc.exe</imagepath>
<md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><Address>0x000007fffffd3fa8</Address><Size>0x0000000000000058</Size><IsMinApplAddress>no</IsMinApplAddress><spanalysis>true</spanalysis></FirstRpidMemOp>
<process mode="opened" timestamp="20052"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1984</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20055"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1964</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20059"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>1444</pid><imagepath>C:\Windows\System32\notepad.exe</imagepath><md5sum>f2c7bb8acc97f92e987a2d4087d021b1</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20062"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>2468</pid><imagepath>C:\Windows\explorer.exe</imagepath><md5sum>ac4c51eb24aa95b77f705ab159189e24</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20066"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>2652</pid><imagepath>C:\Program Files\Internet Explorer\iexplore.exe</imagepath><md5sum>0685765c0cbe095ba0c6c8790bae21ef</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20069"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>2712</pid><imagepath>C:\Program Files (x86)\Internet Explorer\iexplore.exe</imagepath>
<md5sum>c8a8321292a459b0a17fb39a782a5c74</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20073"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus>
<source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>2936</pid><imagepath>C:\Program Files (x86)\Internet Explorer\iexplore.exe</imagepath>
<md5sum>c8a8321292a459b0a17fb39a782a5c74</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20076"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>3036</pid><imagepath>C:\Program Files (x86)\Internet Explorer9\iexplore.exe</imagepath>
<md5sum>904e13ba41af2e353a32cf351ca53639</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20080"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>2172</pid><imagepath>C:\Program Files (x86)\Internet Explorer9\iexplore.exe</imagepath>
<md5sum>904e13ba41af2e353a32cf351ca53639</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20084"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>3112</pid><imagepath>C:\Windows\System32\calc.exe</imagepath><md5sum>10e4a1d2132ccb5c6759f038cdb6f3c9</md5sum></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20087"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>3512</pid><imagepath>C:\Windows\System32\wbem\WmiPrvSE.exe</imagepath><md5sum>d683c112190f4b4c6d477d693ee88e35</md5sum></processinfo></target>
<spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20090"><desiredaccess>0x00000410</desiredaccess><ntstatus>0xc000000d</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo></source>
<target><processinfo><pid>4088</pid><tid>0</tid><imagepath>N/A</imagepath></processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20094"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
</processinfo></source><target><processinfo><pid>3108</pid><imagepath>C:\Windows\System32\conhost.exe</imagepath><md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum></processinfo>
</target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20097"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
</processinfo></source><target><processinfo><pid>2552</pid><imagepath>C:\Windows\System32\powercfg.exe</imagepath><md5sum>f779ee89cd1f679c91ab8848c978f086</md5sum></processinfo>
</target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20100"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
</processinfo></source><target><processinfo><pid>3688</pid><imagepath>C:\Windows\System32\conhost.exe</imagepath><md5sum>402b44b31c7183fcf2c4e1083af317fa</md5sum>
</processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20104"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
</processinfo></source><target><processinfo><pid>2308</pid><imagepath>C:\Windows\System32\taskhost.exe</imagepath><md5sum>639774c9acd063f028f6084abf5593ad</md5sum>
</processinfo></target><spanalysis>true</spanalysis></process>
<process mode="opened" timestamp="20107"><desiredaccess>0x00000410</desiredaccess><ntstatus>0x00000000</ntstatus><source><processinfo>
<pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath><md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum>
</processinfo></source><target><processinfo><pid>3772</pid><imagepath>C:\Windows\SysWOW64\notepad.exe</imagepath><md5sum>d378bffb70923139d6a4f546864aa61c</md5sum>
</processinfo></target><spanalysis>true</spanalysis></process>
<process mode="terminated" timestamp="19752"><value>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</value>
<pid>3980</pid><ppid>2468</ppid>
<parentname>C:\Windows\explorer.exe</parentname><cmdline>N/A</cmdline><fid ads="">1407374883554514</fid><telemetry_data>
<child_process_count>0</child_process_count><local_thread_count>9</local_thread_count><remote_thread_count>0</remote_thread_count>
<mutex_create_count>2</mutex_create_count><file_failed_count>27</file_failed_count><file_open_count>3</file_open_count><file_create_count>0</file_create_count><file_modify_count>1</file_modify_count><http_req_count>1</http_req_count></telemetry_data><memory_data/><spanalysis>true</spanalysis></process>
<file mode="close" timestamp="20117"><value>C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat</value><fid ads="">6473924464426163</fid>
<filesize>128</filesize><md5sum>e2a2ee100decf56c47f4f2f7d96a0392</md5sum><sha1sum>6acfa17118fbd35f97bea8b80f39a40f32e7dd8c</sha1sum>
<sha256sum>574f2829bc697db6b53fe33cf4c9fc6cdebeab0b4ef9f3531c3f06cd26c8704b</sha256sum>
<processinfo tainted="true"><pid>3980</pid><imagepath>C:\Users\Administrator\AppData\Local\Temp\f215dba2f3b6ad9d870ad2e9e7f1894b.exe</imagepath>
<md5sum>f215dba2f3b6ad9d870ad2e9e7f1894b</md5sum></processinfo><ntstatus>0x0</ntstatus><CreateOptions>0x0</CreateOptions><obj_info engine_id="magic" src="file_reporting_engine">
<prop chunk="1" pname="extension">DDB</prop><prop chunk="1" pname="percentage">96</prop>
<prop chunk="1" pname="description">Windows Device Dependent Bitmap</prop><prop chunk="1" pname="type">Binary</prop><prop chunk="2" pname="extension">SMT</prop>
<prop chunk="2" pname="percentage">2</prop><prop chunk="2" pname="description">Memo File Apollo
Database Engine</prop><prop chunk="2" pname="type">Binary</prop></obj_info><spanalysis>true</spanalysis></file>
<malicious-alert classtype="Custom-Policy"><display-msg>Executable Delivered via Email Attachment or Link within Email Body</display-msg></malicious-alert>
<malicious-alert classtype="Flags"><display-msg>File/Folder/Apicall Unknown Installer</display-msg></malicious-alert>
<malicious-alert classtype="PUP-Dynamic"><display-msg>Riskware File Activity</display-msg></malicious-alert>
<end-of-report/></os-changes></explanation>
<smtp-message id="e7213430-6667-2f02-6e00-8a908bd606ea@tesoro.com" queue-id="4CCzDM4DpRz1spXD">
<last-malware>fe_ml_heuristic</last-malware>
<protocol>attachment</protocol>
<smtp-header>Received: from [10.10.105.71] (unknown [10.10.105.71])
by abc-123.mrl.trellix.com (Postfix) with ESMTP id 4CCzDM4DpRz1spXD
for <samples@tesoro.com>; Sat, 17 Oct 2020 10:05:39 +0000 (UTC)
To: samples@tesoro.com
From: sample <sample@tesoro.com>
Subject: riskware
Message-ID: <e7213430-6667-2f02-6e00-8a908bd606ea@tesoro.com>
Date: Sat, 17 Oct 2020 15:05:38 +0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Thunderbird/xx.xx.x
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="------------7136209E6542A12570EA0632"
Content-Language: en-US
</smtp-header>
<date>Sat, 17 Oct 2020 15:05:38 +0500</date>
<subject>riskware</subject>
</smtp-message>
<src>
<domain>tesoro.com</domain>
<smtp-mail-from>sample@tesoro.com</smtp-mail-from>
</src>
<dst>
<smtp-to>samples@tesoro.com</smtp-to>
</dst>
<interface mode="block-email">pether3</interface>
<occurred>2020-10-17T10:07:49Z</occurred>
<attack-time>2020-10-17T10:06:09Z</attack-time>
<alert-url>https://panadol-115.mrl.trellix.com/detection/objects?uuid=d7ada227-2acb-4afa-9ef0-3046c3a4274a</alert-url>
<action>blocked</action>
</alert>
</alerts>