API tools faq
paste
paladin316

Exes_c572a7b4985eaec0a8b536fbec9a90ee_exe_2019-07-09_16_30.txt

paladin316
Jul 9th, 2019
2,254
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 84.71 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_c572a7b4985eaec0a8b536fbec9a90ee.exe"
  7. * File Size: 331776
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "42591fc5f2b32c05e1235722c2effbb4e106b6cbc67176b4132efe965db5a8eb"
  10. * MD5: "c572a7b4985eaec0a8b536fbec9a90ee"
  11. * SHA1: "5980adb9fd473431915bff71bc148aa99804306f"
  12. * SHA512: "8625e2bccd2d0524099642a66448d4e88e16912f189a15aaf0dffef02a8a6563fa2793512c80aa2bc775c1d0fe7e71451e94311a7179d9b88ff3ea346437db92"
  13. * CRC32: "A06A4A06"
  14. * SSDEEP: "6144:yMhAtPzZTN1BqNPIqgnoE7FtGPRQQW7DwGGydLM5po7W:7hAtPzZTNPqNPdEh8yzfwGhcpp"
  15.  
  16. * Process Execution:
  17. "Exes_c572a7b4985eaec0a8b536fbec9a90ee.exe",
  18. "services.exe",
  19. "svchost.exe",
  20. "svchost.exe",
  21. "WmiPrvSE.exe",
  22. "iexplore.exe",
  23. "iexplore.exe",
  24. "iexplore.exe",
  25. "iexplore.exe",
  26. "iexplore.exe",
  27. "iexplore.exe",
  28. "iexplore.exe",
  29. "iexplore.exe",
  30. "iexplore.exe",
  31. "iexplore.exe",
  32. "iexplore.exe",
  33. "iexplore.exe",
  34. "iexplore.exe",
  35. "iexplore.exe",
  36. "iexplore.exe",
  37. "iexplore.exe",
  38. "iexplore.exe",
  39. "iexplore.exe",
  40. "iexplore.exe",
  41. "iexplore.exe",
  42. "iexplore.exe",
  43. "iexplore.exe",
  44. "iexplore.exe",
  45. "iexplore.exe",
  46. "iexplore.exe",
  47. "iexplore.exe",
  48. "iexplore.exe",
  49. "iexplore.exe",
  50. "WmiPrvSE.exe",
  51. "iexplore.exe",
  52. "iexplore.exe",
  53. "iexplore.exe",
  54. "iexplore.exe",
  55. "sc.exe",
  56. "svchost.exe",
  57. "WMIADAP.exe"
  58.  
  59.  
  60. * Executed Commands:
  61. "C:\\Windows\\System32\\svchost.exe -k NetworkService",
  62. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  63. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  64. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  65. "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding",
  66. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -Embedding",
  67. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  68. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1600 CREDAT:79873",
  69. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1140 CREDAT:79873",
  70. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2692 CREDAT:79873",
  71. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2416 CREDAT:79873",
  72. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1300 CREDAT:79873",
  73. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2992 CREDAT:79873",
  74. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:560 CREDAT:79873",
  75. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2384 CREDAT:79873",
  76. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2432 CREDAT:79873",
  77. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1532 CREDAT:79873",
  78. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2392 CREDAT:79873",
  79. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1736 CREDAT:79873",
  80. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2124 CREDAT:79873",
  81. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2428 CREDAT:79873",
  82. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2932 CREDAT:79873",
  83. "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2756 CREDAT:79873"
  84.  
  85.  
  86. * Signatures Detected:
  87.  
  88. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  89. "Details":
  90.  
  91. "IP": "204.79.197.200:80"
  92.  
  93.  
  94. "IP": "161.117.80.233:80"
  95.  
  96.  
  97.  
  98.  
  99. "Description": "Creates RWX memory",
  100. "Details":
  101.  
  102.  
  103. "Description": "A process attempted to delay the analysis task.",
  104. "Details":
  105.  
  106. "Process": "Exes_c572a7b4985eaec0a8b536fbec9a90ee.exe tried to sleep 1785 seconds, actually delayed analysis time by 0 seconds"
  107.  
  108.  
  109. "Process": "WmiPrvSE.exe tried to sleep 540 seconds, actually delayed analysis time by 0 seconds"
  110.  
  111.  
  112.  
  113.  
  114. "Description": "File has been identified by 8 Antiviruses on VirusTotal as malicious",
  115. "Details":
  116.  
  117. "ESET-NOD32": "a variant of Win32/GenKryptik.DMUN"
  118.  
  119.  
  120. "Endgame": "malicious (high confidence)"
  121.  
  122.  
  123. "Invincea": "heuristic"
  124.  
  125.  
  126. "Ikarus": "Trojan-Ransom.GandCrab"
  127.  
  128.  
  129. "Acronis": "suspicious"
  130.  
  131.  
  132. "Panda": "Generic Suspicious"
  133.  
  134.  
  135. "CrowdStrike": "win/malicious_confidence_100% (W)"
  136.  
  137.  
  138. "Qihoo-360": "HEUR/QVM20.1.6927.Malware.Gen"
  139.  
  140.  
  141.  
  142.  
  143. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  144. "Details":
  145.  
  146. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  147.  
  148.  
  149. "suspicious_request": "http://api.fiho.at/index.htm"
  150.  
  151.  
  152. "suspicious_request": "http://t2.fiho.at/index.htm"
  153.  
  154.  
  155.  
  156.  
  157. "Description": "Performs some HTTP requests",
  158. "Details":
  159.  
  160. "url": "http://www.bing.com/favicon.ico"
  161.  
  162.  
  163. "url": "http://api.fiho.at/index.htm"
  164.  
  165.  
  166. "url": "http://t2.fiho.at/index.htm"
  167.  
  168.  
  169.  
  170.  
  171. "Description": "Crashed cuckoomon during analysis. Report this error to the Github repo.",
  172. "Details":
  173.  
  174. "pid": 2236
  175.  
  176.  
  177. "message": "Exception reported at offset 0x1967e in cuckoomon itself while accessing 0x6de5f8 from hook RtlDispatchException"
  178.  
  179.  
  180. "pid": 2236
  181.  
  182.  
  183. "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  184.  
  185.  
  186. "pid": 2236
  187.  
  188.  
  189. "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x6de5fc from hook RtlDispatchException"
  190.  
  191.  
  192. "pid": 2236
  193.  
  194.  
  195. "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  196.  
  197.  
  198. "pid": 2236
  199.  
  200.  
  201. "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x6de5f4 from hook RtlDispatchException"
  202.  
  203.  
  204. "pid": 2236
  205.  
  206.  
  207. "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  208.  
  209.  
  210. "pid": 2236
  211.  
  212.  
  213. "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x6de5f0 from hook RtlDispatchException"
  214.  
  215.  
  216. "pid": 2236
  217.  
  218.  
  219. "message": "Exception reported at offset 0x19689 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  220.  
  221.  
  222. "pid": 2236
  223.  
  224.  
  225. "message": "Exception reported at offset 0x19699 in cuckoomon itself while accessing 0x6de600 from hook RtlDispatchException"
  226.  
  227.  
  228. "pid": 2236
  229.  
  230.  
  231. "message": "Exception reported at offset 0x1969b in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  232.  
  233.  
  234. "pid": 2236
  235.  
  236.  
  237. "message": "Exception reported at offset 0x1969f in cuckoomon itself while accessing 0x6de604 from hook RtlDispatchException"
  238.  
  239.  
  240. "pid": 2236
  241.  
  242.  
  243. "message": "Exception reported at offset 0x196a2 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  244.  
  245.  
  246. "pid": 2236
  247.  
  248.  
  249. "message": "Exception reported at offset 0x196aa in cuckoomon itself while accessing 0x6de608 from hook RtlDispatchException"
  250.  
  251.  
  252. "pid": 2236
  253.  
  254.  
  255. "message": "Exception reported at offset 0x196ad in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  256.  
  257.  
  258. "pid": 2236
  259.  
  260.  
  261. "message": "Exception reported at offset 0x196bd in cuckoomon itself while accessing 0x6de60c from hook RtlDispatchException"
  262.  
  263.  
  264. "pid": 2236
  265.  
  266.  
  267. "message": "Exception reported at offset 0x196c0 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  268.  
  269.  
  270. "pid": 2236
  271.  
  272.  
  273. "message": "Exception reported at offset 0x19bfc in cuckoomon itself while accessing 0x6de5f0 from hook RtlDispatchException"
  274.  
  275.  
  276. "pid": 2236
  277.  
  278.  
  279. "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  280.  
  281.  
  282. "pid": 2236
  283.  
  284.  
  285. "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x6de5f4 from hook RtlDispatchException"
  286.  
  287.  
  288. "pid": 2236
  289.  
  290.  
  291. "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  292.  
  293.  
  294. "pid": 2236
  295.  
  296.  
  297. "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x6de5f8 from hook RtlDispatchException"
  298.  
  299.  
  300. "pid": 2236
  301.  
  302.  
  303. "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  304.  
  305.  
  306. "pid": 2236
  307.  
  308.  
  309. "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x6de5fc from hook RtlDispatchException"
  310.  
  311.  
  312. "pid": 2236
  313.  
  314.  
  315. "message": "Exception reported at offset 0x19c07 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
  316.  
  317.  
  318. "pid": 2236
  319.  
  320.  
  321. "message": "Exception reported at offset 0x1967e in cuckoomon itself while accessing 0x6de678 from hook RtlDispatchException"
  322.  
  323.  
  324. "pid": 2236
  325.  
  326.  
  327. "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x6de67c from hook RtlDispatchException"
  328.  
  329.  
  330. "pid": 2236
  331.  
  332.  
  333. "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x6de674 from hook RtlDispatchException"
  334.  
  335.  
  336. "pid": 2236
  337.  
  338.  
  339. "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x6de670 from hook RtlDispatchException"
  340.  
  341.  
  342. "pid": 2236
  343.  
  344.  
  345. "message": "Exception reported at offset 0x19699 in cuckoomon itself while accessing 0x6de630 from hook RtlDispatchException"
  346.  
  347.  
  348. "pid": 2236
  349.  
  350.  
  351. "message": "Exception reported at offset 0x1969f in cuckoomon itself while accessing 0x6de634 from hook RtlDispatchException"
  352.  
  353.  
  354. "pid": 2236
  355.  
  356.  
  357. "message": "Exception reported at offset 0x196aa in cuckoomon itself while accessing 0x6de638 from hook RtlDispatchException"
  358.  
  359.  
  360. "pid": 2236
  361.  
  362.  
  363. "message": "Exception reported at offset 0x196bd in cuckoomon itself while accessing 0x6de63c from hook RtlDispatchException"
  364.  
  365.  
  366. "pid": 2236
  367.  
  368.  
  369. "message": "Exception reported at offset 0x19bfc in cuckoomon itself while accessing 0x6de670 from hook RtlDispatchException"
  370.  
  371.  
  372. "pid": 2236
  373.  
  374.  
  375. "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x6de674 from hook RtlDispatchException"
  376.  
  377.  
  378. "pid": 2236
  379.  
  380.  
  381. "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x6de678 from hook RtlDispatchException"
  382.  
  383.  
  384. "pid": 2236
  385.  
  386.  
  387. "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x6de67c from hook RtlDispatchException"
  388.  
  389.  
  390.  
  391.  
  392. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  393. "Details":
  394.  
  395. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 9361271 times"
  396.  
  397.  
  398.  
  399.  
  400. "Description": "Creates a hidden or system file",
  401. "Details":
  402.  
  403. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low"
  404.  
  405.  
  406. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF405193.TMP"
  407.  
  408.  
  409. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF40b762.TMP"
  410.  
  411.  
  412. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF40e43e.TMP"
  413.  
  414.  
  415. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF420ea5.TMP"
  416.  
  417.  
  418. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF417a92.TMP"
  419.  
  420.  
  421. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF41be42.TMP"
  422.  
  423.  
  424. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF41e4d5.TMP"
  425.  
  426.  
  427. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF422bc2.TMP"
  428.  
  429.  
  430. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF426a80.TMP"
  431.  
  432.  
  433. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF51166c.TMP"
  434.  
  435.  
  436. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF43e931.TMP"
  437.  
  438.  
  439. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF435acc.TMP"
  440.  
  441.  
  442. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF447498.TMP"
  443.  
  444.  
  445. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF44dfe5.TMP"
  446.  
  447.  
  448. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF453b92.TMP"
  449.  
  450.  
  451.  
  452.  
  453. "Description": "Attempts to modify proxy settings",
  454. "Details":
  455.  
  456.  
  457.  
  458. * Started Service:
  459. "TapiSrv",
  460. "W32Time"
  461.  
  462.  
  463. * Mutexes:
  464. "Local\\9510B8B7-82F5-2171-7207-FC794AD1C6EA",
  465. "Local\\_!MSFTHISTORY!_",
  466. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  467. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  468. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  469. "Local\\WininetStartupMutex",
  470. "Local\\WininetConnectionMutex",
  471. "Local\\WininetProxyRegistryMutex",
  472. "Local\\!IETld!Mutex",
  473. "Local\\!BrowserEmulation!SharedMemory!Mutex",
  474. "Local\\ZoneAttributeCacheCounterMutex",
  475. "Local\\ZonesCacheCounterMutex",
  476. "Local\\ZonesLockedCacheCounterMutex",
  477. "ConnHashTable<1600>_HashTable_Mutex",
  478. "Local\\ZonesCounterMutex",
  479. "Local\\RSS Eventing Connection Database Mutex 00000640",
  480. "Local\\Feed Eventing Shared Memory Mutex S-1-5-21-0000000000-0000000000-0000000000-1000",
  481. "Local\\c:!users!user!appdata!local!microsoft!feeds cache!",
  482. "ConnHashTable<1140>_HashTable_Mutex",
  483. "Local\\RSS Eventing Connection Database Mutex 00000474",
  484. "ConnHashTable<2692>_HashTable_Mutex",
  485. "Local\\RSS Eventing Connection Database Mutex 00000a84",
  486. "ConnHashTable<2416>_HashTable_Mutex",
  487. "Local\\RSS Eventing Connection Database Mutex 00000970",
  488. "Local\\Feed Arbitration Shared Memory Mutex User : S-1-5-21-0000000000-0000000000-0000000000-1000 ",
  489. "Local\\Feeds Store Mutex S-1-5-21-0000000000-0000000000-0000000000-1000",
  490. "ConnHashTable<1300>_HashTable_Mutex",
  491. "Local\\RSS Eventing Connection Database Mutex 00000514",
  492. "ConnHashTable<2992>_HashTable_Mutex",
  493. "Local\\RSS Eventing Connection Database Mutex 00000bb0",
  494. "ConnHashTable<560>_HashTable_Mutex",
  495. "Local\\RSS Eventing Connection Database Mutex 00000230",
  496. "ConnHashTable<2384>_HashTable_Mutex",
  497. "Local\\RSS Eventing Connection Database Mutex 00000950",
  498. "ConnHashTable<2432>_HashTable_Mutex",
  499. "Local\\RSS Eventing Connection Database Mutex 00000980",
  500. "ConnHashTable<1532>_HashTable_Mutex",
  501. "Local\\RSS Eventing Connection Database Mutex 000005fc",
  502. "ConnHashTable<2392>_HashTable_Mutex",
  503. "Local\\RSS Eventing Connection Database Mutex 00000958",
  504. "ConnHashTable<1736>_HashTable_Mutex",
  505. "Local\\RSS Eventing Connection Database Mutex 000006c8",
  506. "ConnHashTable<2124>_HashTable_Mutex",
  507. "Local\\RSS Eventing Connection Database Mutex 0000084c",
  508. "ConnHashTable<2428>_HashTable_Mutex",
  509. "Local\\RSS Eventing Connection Database Mutex 0000097c",
  510. "Global\\ADAP_WMI_ENTRY",
  511. "Global\\RefreshRA_Mutex",
  512. "Global\\RefreshRA_Mutex_Lib",
  513. "Global\\RefreshRA_Mutex_Flag",
  514. "ConnHashTable<2932>_HashTable_Mutex",
  515. "Local\\RSS Eventing Connection Database Mutex 00000b74",
  516. "ConnHashTable<2756>_HashTable_Mutex",
  517. "Local\\RSS Eventing Connection Database Mutex 00000ac4"
  518.  
  519.  
  520. * Modified Files:
  521. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  522. "C:\\Windows\\sysnative\\LogFiles\\Scm\\28820aaf-3005-4fef-bf6a-ee7f1926b66a",
  523. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  524. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  525. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  526. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  527. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.B8BA3813-A261-11E9-B470-18C086CD4732.dat",
  528. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF48F48DD5449C5633.TMP",
  529. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\B8BA3814-A261-11E9-B470-18C086CD4732.dat",
  530. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF47CB487DB4F06AAD.TMP",
  531. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon1.ico",
  532. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon2.ico",
  533. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon3.ico",
  534. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon4.ico",
  535. "\\??\\pipe\\MsFteWds",
  536. "\\??\\PIPE\\samr",
  537. "\\??\\PIPE\\srvsvc",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\OMJ5L8XIYZRRIX5YJCNB.temp",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF405193.TMP",
  540. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat",
  541. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.C6C32FE1-A261-11E9-B470-18C086CD4732.dat",
  542. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBE34656D21737A7D.TMP",
  543. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\C6C32FE2-A261-11E9-B470-18C086CD4732.dat",
  544. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF02F4944DE5630014.TMP",
  545. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon1.ico",
  546. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon2.ico",
  547. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon3.ico",
  548. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon4.ico",
  549. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\LPAD04ELGJ8Y2SFTQK4K.temp",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF40b762.TMP",
  551. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.CCF70E05-A261-11E9-B470-18C086CD4732.dat",
  552. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF25FB79531540F56A.TMP",
  553. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\CCF70E06-A261-11E9-B470-18C086CD4732.dat",
  554. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF16B8ED8F4ACFBE61.TMP",
  555. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\favicon1.ico",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\SVZ9E3WO49ZIEJLHFBWC.temp",
  557. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF40e43e.TMP",
  558. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.D8F8452F-A261-11E9-B470-18C086CD4732.dat",
  559. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF85E756B1D6514D52.TMP",
  560. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\D8F84530-A261-11E9-B470-18C086CD4732.dat",
  561. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2B3CBD18908F7DC6.TMP",
  562. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favicon1.ico",
  563. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favicon2.ico",
  564. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Feeds\\5588ACFD-6436-411B-A5CE-666AE6A92D3D~\\WebSlices~\\Suggested Sites~.feed-ms",
  565. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA19CC1838DDD875C.TMP",
  566. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4712F0B2B0CA6C11.TMP",
  567. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1ADCB30E6AA9E5F1.TMP",
  568. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF62F088CA1572EFC5.TMP",
  569. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Feeds\\5588ACFD-6436-411B-A5CE-666AE6A92D3D~\\WebSlices~\\Web Slice Gallery~.feed-ms",
  570. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFCC0078F211EA8F03.TMP",
  571. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF87DA41F7C3F20EB3.TMP",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Y86U26OZLIMAWG6A0MGO.temp",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF420ea5.TMP",
  574. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.E38F16E9-A261-11E9-B470-18C086CD4732.dat",
  575. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE50470CBD476E176.TMP",
  576. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\E38F16EA-A261-11E9-B470-18C086CD4732.dat",
  577. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD5D05D77A8D73BB8.TMP",
  578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DLR75IAMWHLUJS1M3DZ6.temp",
  579. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF417a92.TMP",
  580. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.EDE0C471-A261-11E9-B470-18C086CD4732.dat",
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5D448F9E24A547E7.TMP",
  582. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\EDE0C472-A261-11E9-B470-18C086CD4732.dat",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1839378C76FD6470.TMP",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\E51BJI6MPVNSZ9KC61Q7.temp",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF41be42.TMP",
  586. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.F5816A5F-A261-11E9-B470-18C086CD4732.dat",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2A4FBDA4FB4544E1.TMP",
  588. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\F5816A60-A261-11E9-B470-18C086CD4732.dat",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6D47E38C55305EDD.TMP",
  590. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZJWCDFNVE3Y3B4SYXPMN.temp",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF41e4d5.TMP",
  592. "\\??\\PIPE\\lsarpc",
  593. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.005AFDF1-A262-11E9-B470-18C086CD4732.dat",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF24A00BC57ACF0359.TMP",
  595. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\005AFDF2-A262-11E9-B470-18C086CD4732.dat",
  596. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAC78310E1BBFAE8F.TMP",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\QTIP47U41LXUJ1NCGJY3.temp",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF422bc2.TMP",
  599. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.07C26B6F-A262-11E9-B470-18C086CD4732.dat",
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBB5C25521ED2182F.TMP",
  601. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\07C26B70-A262-11E9-B470-18C086CD4732.dat",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF12635779028B3DB9.TMP",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5FGHSEIYAFF2A2WQM7TD.temp",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF426a80.TMP",
  605. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.104F1A2B-A262-11E9-B470-18C086CD4732.dat",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF29C993A90FEF0E05.TMP",
  607. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\104F1A2C-A262-11E9-B470-18C086CD4732.dat",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF0BE58010CC35552.TMP",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF134746A50C74D39F.TMP",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4FA179740A62F05C.TMP",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD15433A5E80B0570.TMP",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF81D2D3A804339111.TMP",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF4F464BEBB14C956.TMP",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC9A8BED5FFDD0568.TMP",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Z02XJNBE4H458H4V5NUA.temp",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF51166c.TMP",
  617. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.2009FDF5-A262-11E9-B470-18C086CD4732.dat",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAD326C32ECCCA57C.TMP",
  619. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\2009FDF6-A262-11E9-B470-18C086CD4732.dat",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE7036080DBEC93AF.TMP",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF7A379D32004D0DAD.TMP",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF18AC68EB3C968191.TMP",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5852FE78FBA7444F.TMP",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC962CFBD8489F948.TMP",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC0B0C130A1E67B47.TMP",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF02B6B3D24050F3EF.TMP",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\N3AZN9QAPZG8Z4ILF2RQ.temp",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF43e931.TMP",
  629. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.2DF194D7-A262-11E9-B470-18C086CD4732.dat",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1EEB5319A4DEB306.TMP",
  631. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\2DF194D8-A262-11E9-B470-18C086CD4732.dat",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFBC27AF9829664BE.TMP",
  633. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\AQDX145Z6GH4BOSDVDB2.temp",
  634. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF435acc.TMP",
  635. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.37E646A9-A262-11E9-B470-18C086CD4732.dat",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF25786D53D938FC0A.TMP",
  637. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\37E646AA-A262-11E9-B470-18C086CD4732.dat",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF04B0B764760E9FED.TMP",
  639. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\72Z3I5BEBJPHRHYQYTCG.temp",
  640. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF447498.TMP",
  641. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.42A33E03-A262-11E9-B470-18C086CD4732.dat",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF864DF59534052FEF.TMP",
  643. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\42A33E04-A262-11E9-B470-18C086CD4732.dat",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF61B941C46FA4C787.TMP",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF72168B103FE4ADA7.TMP",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFCD577FF96F9E7C10.TMP",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF1C0F0FB9DC5E97F.TMP",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5489F40A0BB4E1B7.TMP",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC101F4F9121199D1.TMP",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD335C8D7ADA433FD.TMP",
  651. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\AA6AKK7K3PF3SOE5PZHU.temp",
  652. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF44dfe5.TMP",
  653. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  654. "\\??\\WMIDataDevice",
  655. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.52228703-A262-11E9-B470-18C086CD4732.dat",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA841786E7ECD3A91.TMP",
  657. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\52228704-A262-11E9-B470-18C086CD4732.dat",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF709D7FD872316272.TMP",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFCA7D8BC79EABDC89.TMP",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC1E091600BD3F96D.TMP",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD71F98563C8DBC8B.TMP",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB84A367FDDF3A4F2.TMP",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF51DAFB8831C7040.TMP",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5AB46F2431557D5D.TMP",
  665. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\W7DCY10V6064FBYPMLAS.temp",
  666. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF453b92.TMP",
  667. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.60992AFD-A262-11E9-B470-18C086CD4732.dat",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD6BE926F1B2C5817.TMP",
  669. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\60992AFE-A262-11E9-B470-18C086CD4732.dat",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF617EE81A4AE99DEC.TMP"
  671.  
  672.  
  673. * Deleted Files:
  674. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_0633EE93-D776-472f-A0FF-E1416B8B2E3A.ico",
  675. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF405193.TMP",
  676. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\B8BA3814-A261-11E9-B470-18C086CD4732.dat",
  677. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.B8BA3813-A261-11E9-B470-18C086CD4732.dat",
  678. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF40b762.TMP",
  679. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\C6C32FE2-A261-11E9-B470-18C086CD4732.dat",
  680. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.C6C32FE1-A261-11E9-B470-18C086CD4732.dat",
  681. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF40e43e.TMP",
  682. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\CCF70E06-A261-11E9-B470-18C086CD4732.dat",
  683. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.CCF70E05-A261-11E9-B470-18C086CD4732.dat",
  684. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favicon3.png",
  685. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF420ea5.TMP",
  686. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\D8F84530-A261-11E9-B470-18C086CD4732.dat",
  687. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.D8F8452F-A261-11E9-B470-18C086CD4732.dat",
  688. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF417a92.TMP",
  689. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\E38F16EA-A261-11E9-B470-18C086CD4732.dat",
  690. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.E38F16E9-A261-11E9-B470-18C086CD4732.dat",
  691. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF41be42.TMP",
  692. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\EDE0C472-A261-11E9-B470-18C086CD4732.dat",
  693. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.EDE0C471-A261-11E9-B470-18C086CD4732.dat",
  694. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon4.png",
  695. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF41e4d5.TMP",
  696. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\F5816A60-A261-11E9-B470-18C086CD4732.dat",
  697. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.F5816A5F-A261-11E9-B470-18C086CD4732.dat",
  698. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF422bc2.TMP",
  699. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\005AFDF2-A262-11E9-B470-18C086CD4732.dat",
  700. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.005AFDF1-A262-11E9-B470-18C086CD4732.dat",
  701. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF426a80.TMP",
  702. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\07C26B70-A262-11E9-B470-18C086CD4732.dat",
  703. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.07C26B6F-A262-11E9-B470-18C086CD4732.dat",
  704. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF51166c.TMP",
  705. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\104F1A2C-A262-11E9-B470-18C086CD4732.dat",
  706. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.104F1A2B-A262-11E9-B470-18C086CD4732.dat",
  707. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF43e931.TMP",
  708. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\2009FDF6-A262-11E9-B470-18C086CD4732.dat",
  709. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.2009FDF5-A262-11E9-B470-18C086CD4732.dat",
  710. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF435acc.TMP",
  711. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\2DF194D8-A262-11E9-B470-18C086CD4732.dat",
  712. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.2DF194D7-A262-11E9-B470-18C086CD4732.dat",
  713. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF447498.TMP",
  714. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\37E646AA-A262-11E9-B470-18C086CD4732.dat",
  715. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.37E646A9-A262-11E9-B470-18C086CD4732.dat",
  716. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF44dfe5.TMP",
  717. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\42A33E04-A262-11E9-B470-18C086CD4732.dat",
  718. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.42A33E03-A262-11E9-B470-18C086CD4732.dat",
  719. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favicon5.png",
  720. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF453b92.TMP",
  721. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\52228704-A262-11E9-B470-18C086CD4732.dat",
  722. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.52228703-A262-11E9-B470-18C086CD4732.dat"
  723.  
  724.  
  725. * Modified Registry Keys:
  726. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\Exes_c572a7b4985eaec0a8b536fbec9a90ee_RASAPI32",
  727. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c572a7b4985eaec0a8b536fbec9a90ee_RASAPI32\\EnableFileTracing",
  728. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c572a7b4985eaec0a8b536fbec9a90ee_RASAPI32\\EnableConsoleTracing",
  729. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c572a7b4985eaec0a8b536fbec9a90ee_RASAPI32\\FileTracingMask",
  730. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c572a7b4985eaec0a8b536fbec9a90ee_RASAPI32\\ConsoleTracingMask",
  731. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c572a7b4985eaec0a8b536fbec9a90ee_RASAPI32\\MaxFileSize",
  732. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c572a7b4985eaec0a8b536fbec9a90ee_RASAPI32\\FileDirectory",
  733. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
  734. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  735. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\tapisrv",
  736. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapisrv\\EnableFileTracing",
  737. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapisrv\\EnableConsoleTracing",
  738. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapisrv\\FileTracingMask",
  739. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapisrv\\ConsoleTracingMask",
  740. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapisrv\\MaxFileSize",
  741. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapisrv\\FileDirectory",
  742. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Telephony\\DomainName",
  743. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Telephony\\HandoffPriorities\\MediaModes",
  744. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE10RunOnceLastShown",
  745. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE10RunOnceLastShown_TIMESTAMP",
  746. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE8RunOnceLastShown",
  747. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE8RunOnceLastShown_TIMESTAMP",
  748. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\Check_Associations",
  749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\31D09BA0-12F5-4CCE-BE8A-2923E76605DA\\VerCache",
  750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\B4F3A835-0E21-4959-BA22-42B3008E02FF\\VerCache",
  751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF\\VerCache",
  752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\CompatibilityFlags",
  753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\SecuritySafe",
  756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
  759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\B8BA3813-A261-11E9-B470-18C086CD4732",
  760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\2670000A-7350-4F3C-8081-5663EE0C6C49\\iexplore\\Type",
  761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\2670000A-7350-4F3C-8081-5663EE0C6C49\\iexplore\\Count",
  762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\2670000A-7350-4F3C-8081-5663EE0C6C49\\iexplore\\Time",
  763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\31D09BA0-12F5-4CCE-BE8A-2923E76605DA\\iexplore\\Type",
  764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\31D09BA0-12F5-4CCE-BE8A-2923E76605DA\\iexplore\\Count",
  765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\31D09BA0-12F5-4CCE-BE8A-2923E76605DA\\iexplore\\Time",
  766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\789FE86F-6FC4-46A1-9849-EDE0DB0C95CA\\iexplore\\Type",
  767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\789FE86F-6FC4-46A1-9849-EDE0DB0C95CA\\iexplore\\Count",
  768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\789FE86F-6FC4-46A1-9849-EDE0DB0C95CA\\iexplore\\Time",
  769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FullScreen",
  770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links\\Order",
  771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\User Preferences\\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977",
  772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\SearchScopes\\DefaultScope",
  773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\User Preferences\\2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81",
  774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\31D09BA0-12F5-4CCE-BE8A-2923E76605DA\\iexplore\\LoadTime",
  775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\B4F3A835-0E21-4959-BA22-42B3008E02FF\\iexplore\\Type",
  776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\B4F3A835-0E21-4959-BA22-42B3008E02FF\\iexplore\\Count",
  777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\B4F3A835-0E21-4959-BA22-42B3008E02FF\\iexplore\\Time",
  778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\B4F3A835-0E21-4959-BA22-42B3008E02FF\\iexplore\\LoadTime",
  779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF\\iexplore\\Type",
  780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF\\iexplore\\Count",
  781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF\\iexplore\\Time",
  782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF\\iexplore\\LoadTime",
  783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\C6C32FE1-A261-11E9-B470-18C086CD4732",
  784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\CCF70E05-A261-11E9-B470-18C086CD4732",
  785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\D8F8452F-A261-11E9-B470-18C086CD4732",
  786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\Path",
  787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\Handler",
  788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\FeedUrl",
  789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\DisplayName",
  790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\ErrorState",
  791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\DisplayMask",
  792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\Path",
  793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\Handler",
  794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\FeedUrl",
  795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\DisplayName",
  796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\ErrorState",
  797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\DisplayMask",
  798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\Expiration",
  799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\Expiration",
  800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\E38F16E9-A261-11E9-B470-18C086CD4732",
  801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\EDE0C471-A261-11E9-B470-18C086CD4732",
  802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\F5816A5F-A261-11E9-B470-18C086CD4732",
  803. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
  804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\005AFDF1-A262-11E9-B470-18C086CD4732",
  805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\07C26B6F-A262-11E9-B470-18C086CD4732",
  806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\104F1A2B-A262-11E9-B470-18C086CD4732",
  807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\2009FDF5-A262-11E9-B470-18C086CD4732",
  808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\2DF194D7-A262-11E9-B470-18C086CD4732",
  809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\37E646A9-A262-11E9-B470-18C086CD4732",
  810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\42A33E03-A262-11E9-B470-18C086CD4732",
  811. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  812. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  813. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  814. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  815. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  816. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  817. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  818. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  819. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  820. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  821. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  822. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  823. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  824. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  825. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  826. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI",
  827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\52228703-A262-11E9-B470-18C086CD4732",
  828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\60992AFD-A262-11E9-B470-18C086CD4732"
  829.  
  830.  
  831. * Deleted Registry Keys:
  832. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Telephony\\TAPISRVSCPGUID",
  833. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Telephony\\HandoffPriorities\\RequestMediaCall",
  834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  835. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  837. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
  840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\B8BA3813-A261-11E9-B470-18C086CD4732",
  841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFavoritesInitialSelection",
  842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFeedsInitialSelection",
  843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\C6C32FE1-A261-11E9-B470-18C086CD4732",
  844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\CCF70E05-A261-11E9-B470-18C086CD4732",
  845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\0\\Expiration",
  846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LinksBar\\ItemCache\\1\\Expiration",
  847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\D8F8452F-A261-11E9-B470-18C086CD4732",
  848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\E38F16E9-A261-11E9-B470-18C086CD4732",
  849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\EDE0C471-A261-11E9-B470-18C086CD4732",
  850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\F5816A5F-A261-11E9-B470-18C086CD4732",
  851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\005AFDF1-A262-11E9-B470-18C086CD4732",
  852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\07C26B6F-A262-11E9-B470-18C086CD4732",
  853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\104F1A2B-A262-11E9-B470-18C086CD4732",
  854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\2009FDF5-A262-11E9-B470-18C086CD4732",
  855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\2DF194D7-A262-11E9-B470-18C086CD4732",
  856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\37E646A9-A262-11E9-B470-18C086CD4732",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\42A33E03-A262-11E9-B470-18C086CD4732",
  858. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI",
  859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\52228703-A262-11E9-B470-18C086CD4732"
  860.  
  861.  
  862. * DNS Communications:
  863.  
  864. "type": "A",
  865. "request": "api.fiho.at",
  866. "answers":
  867.  
  868. "data": "161.117.80.233",
  869. "type": "A"
  870.  
  871.  
  872.  
  873.  
  874. "type": "A",
  875. "request": "www.bing.com",
  876. "answers":
  877.  
  878. "data": "dual-a-0001.a-msedge.net",
  879. "type": "CNAME"
  880.  
  881.  
  882. "data": "a-0001.a-afdentry.net.trafficmanager.net",
  883. "type": "CNAME"
  884.  
  885.  
  886. "data": "204.79.197.200",
  887. "type": "A"
  888.  
  889.  
  890. "data": "13.107.21.200",
  891. "type": "A"
  892.  
  893.  
  894.  
  895.  
  896. "type": "A",
  897. "request": "t2.fiho.at",
  898. "answers":
  899.  
  900. "data": "161.117.80.233",
  901. "type": "A"
  902.  
  903.  
  904.  
  905.  
  906.  
  907. * Domains:
  908.  
  909. "ip": "161.117.80.233",
  910. "domain": "t2.fiho.at"
  911.  
  912.  
  913. "ip": "161.117.80.233",
  914. "domain": "api.fiho.at"
  915.  
  916.  
  917. "ip": "13.107.21.200",
  918. "domain": "www.bing.com"
  919.  
  920.  
  921.  
  922. * Network Communication - ICMP:
  923.  
  924. * Network Communication - HTTP:
  925.  
  926. "count": 16,
  927. "body": "",
  928. "uri": "http://www.bing.com/favicon.ico",
  929. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  930. "method": "GET",
  931. "host": "www.bing.com",
  932. "version": "1.1",
  933. "path": "/favicon.ico",
  934. "data": "GET /favicon.ico HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.bing.com\r\nConnection: Keep-Alive\r\nCookie: MUID=055643067C21678412144E247D39664A; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=5262DC06BBB54635AC9D8A0AD382875E&dmnchg=1; SRCHUSR=DOB=20190317\r\n\r\n",
  935. "port": 80
  936.  
  937.  
  938. "count": 1,
  939. "body": "--f9b52447fe2ac988\r\nContent-Disposition: form-data; name=\"tchyieh\"\r\n\r\nU4wLL384HPV3SvqKhf/DBmtgGj7zwN9ilI/HmEE_2BTtEO/Lk3jLB3B3/E6qKT3dZxQ9rfFik/GEykzVLD4_2F1aapKHutGL/7oluE51YUsIm7kgNbzYSbU/XVH_2FcTT83ani0dFszJ/svcxcy1olyd/9D9GvNZ5MyvfNTfScmLys/suEAsRN0/o_2BZk46QJXIDqxHMmkj/byeluJl\r\n--f9b52447fe2ac988--\r\n",
  940. "uri": "http://api.fiho.at/index.htm",
  941. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  942. "method": "POST",
  943. "host": "api.fiho.at",
  944. "version": "1.1",
  945. "path": "/index.htm",
  946. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=f9b52447fe2ac988\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 306\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--f9b52447fe2ac988\r\nContent-Disposition: form-data; name=\"tchyieh\"\r\n\r\nU4wLL384HPV3SvqKhf/DBmtgGj7zwN9ilI/HmEE_2BTtEO/Lk3jLB3B3/E6qKT3dZxQ9rfFik/GEykzVLD4_2F1aapKHutGL/7oluE51YUsIm7kgNbzYSbU/XVH_2FcTT83ani0dFszJ/svcxcy1olyd/9D9GvNZ5MyvfNTfScmLys/suEAsRN0/o_2BZk46QJXIDqxHMmkj/byeluJl\r\n--f9b52447fe2ac988--\r\n",
  947. "port": 80
  948.  
  949.  
  950. "count": 1,
  951. "body": "",
  952. "uri": "http://t2.fiho.at/index.htm",
  953. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  954. "method": "POST",
  955. "host": "t2.fiho.at",
  956. "version": "1.1",
  957. "path": "/index.htm",
  958. "data": "POST /index.htm HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: multipart/form-data; boundary=ea822687fe2ac988\r\nHost: t2.fiho.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nContent-Length: 302\r\n\r\n",
  959. "port": 80
  960.  
  961.  
  962. "count": 1,
  963. "body": "",
  964. "uri": "http://api.fiho.at/index.htm",
  965. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  966. "method": "POST",
  967. "host": "api.fiho.at",
  968. "version": "1.1",
  969. "path": "/index.htm",
  970. "data": "POST /index.htm HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: multipart/form-data; boundary=caaf633dfe2ac988\r\nHost: api.fiho.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nContent-Length: 311\r\n\r\n",
  971. "port": 80
  972.  
  973.  
  974. "count": 1,
  975. "body": "",
  976. "uri": "http://t2.fiho.at/index.htm",
  977. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  978. "method": "POST",
  979. "host": "t2.fiho.at",
  980. "version": "1.1",
  981. "path": "/index.htm",
  982. "data": "POST /index.htm HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: multipart/form-data; boundary=c8aa04f3fe2ac988\r\nHost: t2.fiho.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nContent-Length: 311\r\n\r\n",
  983. "port": 80
  984.  
  985.  
  986. "count": 1,
  987. "body": "",
  988. "uri": "http://api.fiho.at/index.htm",
  989. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  990. "method": "POST",
  991. "host": "api.fiho.at",
  992. "version": "1.1",
  993. "path": "/index.htm",
  994. "data": "POST /index.htm HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: multipart/form-data; boundary=c6d1f357fe2ac988\r\nHost: api.fiho.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nContent-Length: 314\r\n\r\n",
  995. "port": 80
  996.  
  997.  
  998. "count": 1,
  999. "body": "--a3d0807bfe2ac988\r\nContent-Disposition: form-data; name=\"qkunmsac\"\r\n\r\nsRsdAvshW9_2BF69Kl/FwkesF4JPmXSuKmny/6_2FkbOvF9zci57VtC8/Fec8oCThGnH8_2BV7fsDVJM/OmH2QyAUFKiLT/_2BFbA9mo/10576IDr793zrh9K0uJIiO/WIdOFhRZcJsOuC_2Blz_2Bk/DMM9rrPLR67_/2BHDrYKIPdBf/6f6bGxocoaFEUxMXQU0SW/got62V6Vd/YyrYmIVb\r\n--a3d0807bfe2ac988--\r\n",
  1000. "uri": "http://t2.fiho.at/index.htm",
  1001. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1002. "method": "POST",
  1003. "host": "t2.fiho.at",
  1004. "version": "1.1",
  1005. "path": "/index.htm",
  1006. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=a3d0807bfe2ac988\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 313\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--a3d0807bfe2ac988\r\nContent-Disposition: form-data; name=\"qkunmsac\"\r\n\r\nsRsdAvshW9_2BF69Kl/FwkesF4JPmXSuKmny/6_2FkbOvF9zci57VtC8/Fec8oCThGnH8_2BV7fsDVJM/OmH2QyAUFKiLT/_2BFbA9mo/10576IDr793zrh9K0uJIiO/WIdOFhRZcJsOuC_2Blz_2Bk/DMM9rrPLR67_/2BHDrYKIPdBf/6f6bGxocoaFEUxMXQU0SW/got62V6Vd/YyrYmIVb\r\n--a3d0807bfe2ac988--\r\n",
  1007. "port": 80
  1008.  
  1009.  
  1010. "count": 1,
  1011. "body": "--7f86db11fe2ac988\r\nContent-Disposition: form-data; name=\"cqrsg\"\r\n\r\nZi0zgOeiigF6H/P3ZR6kZE8/qfDso_2Bh/OZBih4_2FggJ_2/F45jmCR5DbWyq_2F3qGZ_2F/sYDBzx_2BMHY/pcduPb5h73_2FStpX/G08MWwAVFZowiP_2/BMNz_2Fny_2/B_2BDEKJ4PEylPVahD/Gc0u6PdlkjMHz_2Bz/IXfJ61yXqaAadLhX93_2/BR_2FEtXc8/uE9U5cDW7vooe_2BZr/MZWrpE3INCz7_2F/pK\r\n--7f86db11fe2ac988--\r\n",
  1012. "uri": "http://api.fiho.at/index.htm",
  1013. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1014. "method": "POST",
  1015. "host": "api.fiho.at",
  1016. "version": "1.1",
  1017. "path": "/index.htm",
  1018. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=7f86db11fe2ac988\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 331\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--7f86db11fe2ac988\r\nContent-Disposition: form-data; name=\"cqrsg\"\r\n\r\nZi0zgOeiigF6H/P3ZR6kZE8/qfDso_2Bh/OZBih4_2FggJ_2/F45jmCR5DbWyq_2F3qGZ_2F/sYDBzx_2BMHY/pcduPb5h73_2FStpX/G08MWwAVFZowiP_2/BMNz_2Fny_2/B_2BDEKJ4PEylPVahD/Gc0u6PdlkjMHz_2Bz/IXfJ61yXqaAadLhX93_2/BR_2FEtXc8/uE9U5cDW7vooe_2BZr/MZWrpE3INCz7_2F/pK\r\n--7f86db11fe2ac988--\r\n",
  1019. "port": 80
  1020.  
  1021.  
  1022. "count": 1,
  1023. "body": "--37f71d8dfe2ac988\r\nContent-Disposition: form-data; name=\"ubn\"\r\n\r\nlfZ9g_2F_2BbVvJuA/A9lKVJ1t1LUJtMyaJ7/ZKPev2IDuZ8pz3riBGIKpc/HJUcsRUbOxARItyLXjXKHN/BYv5iHBvmBX/7fEPNBl6Ao/D5KVmSwLR9S_2B/TST5dMg7Zxe/ISBunedxsZotpOwxmVcW1/r9JHbmSVsoDkZXuq4M/mwYBIzj6tDBtctMF4_2/FyQ3m_2Bdmd19Bd2/DdN\r\n--37f71d8dfe2ac988--\r\n",
  1024. "uri": "http://t2.fiho.at/index.htm",
  1025. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1026. "method": "POST",
  1027. "host": "t2.fiho.at",
  1028. "version": "1.1",
  1029. "path": "/index.htm",
  1030. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=37f71d8dfe2ac988\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 304\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--37f71d8dfe2ac988\r\nContent-Disposition: form-data; name=\"ubn\"\r\n\r\nlfZ9g_2F_2BbVvJuA/A9lKVJ1t1LUJtMyaJ7/ZKPev2IDuZ8pz3riBGIKpc/HJUcsRUbOxARItyLXjXKHN/BYv5iHBvmBX/7fEPNBl6Ao/D5KVmSwLR9S_2B/TST5dMg7Zxe/ISBunedxsZotpOwxmVcW1/r9JHbmSVsoDkZXuq4M/mwYBIzj6tDBtctMF4_2/FyQ3m_2Bdmd19Bd2/DdN\r\n--37f71d8dfe2ac988--\r\n",
  1031. "port": 80
  1032.  
  1033.  
  1034. "count": 1,
  1035. "body": "--f0cd79bbfe2ac987\r\nContent-Disposition: form-data; name=\"mrkqrbltt\"\r\n\r\nL5YbwhTPeFt/EpTudsyBDx_2FpP_2B/eCAH224vHDXNIkG2qc_2Bf/o_2FByu92dm9KyggQ4/lc_2F6YCs/pAX7y8af8f2/207X9PxU/qJ9JnzaaO/ZHdClTCL4r0Q8sWi7/_2BSF9gIe5SksBrcDSgioUV/NydOl3_2BVHL3gPa/WKasNKtld9sW7khGod_2FO/_2FpRRDTww3tKIVCRRgx5zS/oKE\r\n--f0cd79bbfe2ac987--\r\n",
  1036. "uri": "http://api.fiho.at/index.htm",
  1037. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1038. "method": "POST",
  1039. "host": "api.fiho.at",
  1040. "version": "1.1",
  1041. "path": "/index.htm",
  1042. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=f0cd79bbfe2ac987\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 319\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--f0cd79bbfe2ac987\r\nContent-Disposition: form-data; name=\"mrkqrbltt\"\r\n\r\nL5YbwhTPeFt/EpTudsyBDx_2FpP_2B/eCAH224vHDXNIkG2qc_2Bf/o_2FByu92dm9KyggQ4/lc_2F6YCs/pAX7y8af8f2/207X9PxU/qJ9JnzaaO/ZHdClTCL4r0Q8sWi7/_2BSF9gIe5SksBrcDSgioUV/NydOl3_2BVHL3gPa/WKasNKtld9sW7khGod_2FO/_2FpRRDTww3tKIVCRRgx5zS/oKE\r\n--f0cd79bbfe2ac987--\r\n",
  1043. "port": 80
  1044.  
  1045.  
  1046. "count": 1,
  1047. "body": "--c858c35ffe2ac987\r\nContent-Disposition: form-data; name=\"hfjeo\"\r\n\r\nYl05QOEcFl/yT91AxY9lshe/TK7ENItdk8LrHRcD9xlPLsd/_2BuwBgOYX4R1y3/FaOuCMH4Docq5NTRU4jseJT/eWmzlELS/CamsRo3t/8XtfP9j9U/l2_2FCve_2BKj20mNZr/Sgs_2BWo/NyJhMlFa935cF06Gx/p8EGGOS2TXv/P0PjnMNtXNV2dFb/ccCxYHB0/hCt1J8IjzDdYW/9\r\n--c858c35ffe2ac987--\r\n",
  1048. "uri": "http://t2.fiho.at/index.htm",
  1049. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1050. "method": "POST",
  1051. "host": "t2.fiho.at",
  1052. "version": "1.1",
  1053. "path": "/index.htm",
  1054. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=c858c35ffe2ac987\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 307\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--c858c35ffe2ac987\r\nContent-Disposition: form-data; name=\"hfjeo\"\r\n\r\nYl05QOEcFl/yT91AxY9lshe/TK7ENItdk8LrHRcD9xlPLsd/_2BuwBgOYX4R1y3/FaOuCMH4Docq5NTRU4jseJT/eWmzlELS/CamsRo3t/8XtfP9j9U/l2_2FCve_2BKj20mNZr/Sgs_2BWo/NyJhMlFa935cF06Gx/p8EGGOS2TXv/P0PjnMNtXNV2dFb/ccCxYHB0/hCt1J8IjzDdYW/9\r\n--c858c35ffe2ac987--\r\n",
  1055. "port": 80
  1056.  
  1057.  
  1058. "count": 1,
  1059. "body": "--84e02843fe2ac987\r\nContent-Disposition: form-data; name=\"aiwd\"\r\n\r\n7v4Qx6GwEXWRV/H0VX7YuTpp_2F5afXzv_2F/IbkwNoxAvB/IdljvDOAA4Yrxy/6UEFrrPowRZ/rfwSufX5vzbUXFKD01/dnav33vt/tXms2d_2BZx/Tkv9EO8xNd/XGoq_2FBxHgZa/VduhRyHGmf_/2FQ113c_2B92LpDyI8cwP/akxFCJM0VLScs8ym/k00t2pdauL9g0/MU9VyDZ3a/Sk0B\r\n--84e02843fe2ac987--\r\n",
  1060. "uri": "http://api.fiho.at/index.htm",
  1061. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1062. "method": "POST",
  1063. "host": "api.fiho.at",
  1064. "version": "1.1",
  1065. "path": "/index.htm",
  1066. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=84e02843fe2ac987\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 310\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--84e02843fe2ac987\r\nContent-Disposition: form-data; name=\"aiwd\"\r\n\r\n7v4Qx6GwEXWRV/H0VX7YuTpp_2F5afXzv_2F/IbkwNoxAvB/IdljvDOAA4Yrxy/6UEFrrPowRZ/rfwSufX5vzbUXFKD01/dnav33vt/tXms2d_2BZx/Tkv9EO8xNd/XGoq_2FBxHgZa/VduhRyHGmf_/2FQ113c_2B92LpDyI8cwP/akxFCJM0VLScs8ym/k00t2pdauL9g0/MU9VyDZ3a/Sk0B\r\n--84e02843fe2ac987--\r\n",
  1067. "port": 80
  1068.  
  1069.  
  1070. "count": 1,
  1071. "body": "--3dfa3f4ffe2ac987\r\nContent-Disposition: form-data; name=\"qvhhgexu\"\r\n\r\nxkOzBvaKBGXyKzCx/bniFdkxx/TvUKFd9zz3E/7CwNlcF3mmXoftFz4KhAK2/_2BkaTaZMQzGL4jiUCQ/r8RiOwHcyK/10_2Bqi51mgxMkBIT/CBxaNUdJ4TyUm/Pz0zla1UTV5ui5/NLylieVxAGRAGIe7YSRe/jCGC6TsTxR_2Bhwgju11enG/zUhxBcjSgRWV56L/_2FVP55jo_2B/rP\r\n--3dfa3f4ffe2ac987--\r\n",
  1072. "uri": "http://t2.fiho.at/index.htm",
  1073. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1074. "method": "POST",
  1075. "host": "t2.fiho.at",
  1076. "version": "1.1",
  1077. "path": "/index.htm",
  1078. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=3dfa3f4ffe2ac987\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 310\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--3dfa3f4ffe2ac987\r\nContent-Disposition: form-data; name=\"qvhhgexu\"\r\n\r\nxkOzBvaKBGXyKzCx/bniFdkxx/TvUKFd9zz3E/7CwNlcF3mmXoftFz4KhAK2/_2BkaTaZMQzGL4jiUCQ/r8RiOwHcyK/10_2Bqi51mgxMkBIT/CBxaNUdJ4TyUm/Pz0zla1UTV5ui5/NLylieVxAGRAGIe7YSRe/jCGC6TsTxR_2Bhwgju11enG/zUhxBcjSgRWV56L/_2FVP55jo_2B/rP\r\n--3dfa3f4ffe2ac987--\r\n",
  1079. "port": 80
  1080.  
  1081.  
  1082. "count": 1,
  1083. "body": "--18606e53fe2ac987\r\nContent-Disposition: form-data; name=\"ksx\"\r\n\r\nyH2_2Fmu/ggNw_2Bv1YsZofoYV/hv0xmsR_2/BIG8EBCC1kSvQzHubGZmf2d/vb8dI2VxGamwgvx_2FlMun4/raa_2FAvvN2oek0Df/I8v7Abv_2BtAMWRQ/1TYtgdkMzGIRi9Nj6K/Wr66ilB53DlDnNOe_2Fx4n2/ILhFoA8tc/Q6Ng7EvQWlsIvqE_/2B46wSAA_2F9FIpS1/7u4FaebvQF2/j4D\r\n--18606e53fe2ac987--\r\n",
  1084. "uri": "http://api.fiho.at/index.htm",
  1085. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1086. "method": "POST",
  1087. "host": "api.fiho.at",
  1088. "version": "1.1",
  1089. "path": "/index.htm",
  1090. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=18606e53fe2ac987\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 313\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--18606e53fe2ac987\r\nContent-Disposition: form-data; name=\"ksx\"\r\n\r\nyH2_2Fmu/ggNw_2Bv1YsZofoYV/hv0xmsR_2/BIG8EBCC1kSvQzHubGZmf2d/vb8dI2VxGamwgvx_2FlMun4/raa_2FAvvN2oek0Df/I8v7Abv_2BtAMWRQ/1TYtgdkMzGIRi9Nj6K/Wr66ilB53DlDnNOe_2Fx4n2/ILhFoA8tc/Q6Ng7EvQWlsIvqE_/2B46wSAA_2F9FIpS1/7u4FaebvQF2/j4D\r\n--18606e53fe2ac987--\r\n",
  1091. "port": 80
  1092.  
  1093.  
  1094. "count": 1,
  1095. "body": "--f21062f3fe2ac986\r\nContent-Disposition: form-data; name=\"xullmuh\"\r\n\r\nI5DLhTUyhjiHtEZ7sDgKU/43yC2imkmv3_2BVF1adHdDQ/O8nq559rs3/8ORYC7HvDpzgeLRjV/dVzkG5oMATrY5/pZuOG7MjDfJUSSdQFIQHVWg/D57vJMi_2FGNFN2pD8K9Gf8/v55_2FCn7EAh/2Gu7vjakGBNl0b_2/BwhVu3_2Fr6v9xjepVh2ag/_2F_2BOkGTd/9jMHw8oK/iK5ezDw\r\n--f21062f3fe2ac986--\r\n",
  1096. "uri": "http://t2.fiho.at/index.htm",
  1097. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1098. "method": "POST",
  1099. "host": "t2.fiho.at",
  1100. "version": "1.1",
  1101. "path": "/index.htm",
  1102. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=f21062f3fe2ac986\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 312\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--f21062f3fe2ac986\r\nContent-Disposition: form-data; name=\"xullmuh\"\r\n\r\nI5DLhTUyhjiHtEZ7sDgKU/43yC2imkmv3_2BVF1adHdDQ/O8nq559rs3/8ORYC7HvDpzgeLRjV/dVzkG5oMATrY5/pZuOG7MjDfJUSSdQFIQHVWg/D57vJMi_2FGNFN2pD8K9Gf8/v55_2FCn7EAh/2Gu7vjakGBNl0b_2/BwhVu3_2Fr6v9xjepVh2ag/_2F_2BOkGTd/9jMHw8oK/iK5ezDw\r\n--f21062f3fe2ac986--\r\n",
  1103. "port": 80
  1104.  
  1105.  
  1106. "count": 1,
  1107. "body": "--7c99344bfe2ac986\r\nContent-Disposition: form-data; name=\"vdripdgc\"\r\n\r\nuHyudtn7HOQuG16eG7U/ajb52opuD_2BMm49BDC/VBRfWEWyLLdDqM7X1SO/i_2FGa02MThv8_2F/SPWFxnQab5S_2BNa2p0/ZjUWmP8ZXP5hcv/gJ_2F_2Fff1M3/VuBxicTnGPtH3u1A8/qjeyQCOGiVyHKfE/RiXyBxYO/UrUn5_2F56Xe7bpOu/mCIysasHOK/EE0mrsgD9/tc9RlGgd/8Ko\r\n--7c99344bfe2ac986--\r\n",
  1108. "uri": "http://api.fiho.at/index.htm",
  1109. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1110. "method": "POST",
  1111. "host": "api.fiho.at",
  1112. "version": "1.1",
  1113. "path": "/index.htm",
  1114. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=7c99344bfe2ac986\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 315\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--7c99344bfe2ac986\r\nContent-Disposition: form-data; name=\"vdripdgc\"\r\n\r\nuHyudtn7HOQuG16eG7U/ajb52opuD_2BMm49BDC/VBRfWEWyLLdDqM7X1SO/i_2FGa02MThv8_2F/SPWFxnQab5S_2BNa2p0/ZjUWmP8ZXP5hcv/gJ_2F_2Fff1M3/VuBxicTnGPtH3u1A8/qjeyQCOGiVyHKfE/RiXyBxYO/UrUn5_2F56Xe7bpOu/mCIysasHOK/EE0mrsgD9/tc9RlGgd/8Ko\r\n--7c99344bfe2ac986--\r\n",
  1115. "port": 80
  1116.  
  1117.  
  1118. "count": 1,
  1119. "body": "--2676cdf3fe2ac986\r\nContent-Disposition: form-data; name=\"ownpal\"\r\n\r\nY7A5cGnZcc/t_2FlDQRKvBfuC2_2/B0Lw9uMGZ_2F3Bf6yj/PDNVTWlZHpmfeKN_2Bg8Jyz/OPRqG8QA/G7GUuTFHKOqTQsX9W/JhWQY0JkB5ZbA/3SrI2DhTSLwoILIZCu/BgVCg_2Bqa7O_2FpEFBwl/f94dBggLebO8EyI9Y2/_2BnJ5ATiNLjn/HlZUPUyPf5fiHJg9MjupKWi/VlNORj8\r\n--2676cdf3fe2ac986--\r\n",
  1120. "uri": "http://t2.fiho.at/index.htm",
  1121. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1122. "method": "POST",
  1123. "host": "t2.fiho.at",
  1124. "version": "1.1",
  1125. "path": "/index.htm",
  1126. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=2676cdf3fe2ac986\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 311\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--2676cdf3fe2ac986\r\nContent-Disposition: form-data; name=\"ownpal\"\r\n\r\nY7A5cGnZcc/t_2FlDQRKvBfuC2_2/B0Lw9uMGZ_2F3Bf6yj/PDNVTWlZHpmfeKN_2Bg8Jyz/OPRqG8QA/G7GUuTFHKOqTQsX9W/JhWQY0JkB5ZbA/3SrI2DhTSLwoILIZCu/BgVCg_2Bqa7O_2FpEFBwl/f94dBggLebO8EyI9Y2/_2BnJ5ATiNLjn/HlZUPUyPf5fiHJg9MjupKWi/VlNORj8\r\n--2676cdf3fe2ac986--\r\n",
  1127. "port": 80
  1128.  
  1129.  
  1130. "count": 1,
  1131. "body": "--feec94e3fe2ac985\r\nContent-Disposition: form-data; name=\"qrk\"\r\n\r\nWHA1UwCS8RT4U8Vd/QBguKsOwyWbey6HcYp/_2Fk_2Ftl3jXGZC0NV6lG/hYf_2BO2/q_2BKX8Fu6/zc19m_2Fmgb/W9F5F0p_2Fe7f2mnDV/td_2F2a1YIjpw2jzencvpr/z0Qse6T7/2ecxrHm2onV5Ju1j/gBFMUqKwOTBiykdU/wKEjDiow/obU_2BRSi6ADgRU1W_2Bt/wO_2F_2Bse/Apn6HJi3a/11\r\n--feec94e3fe2ac985--\r\n",
  1132. "uri": "http://api.fiho.at/index.htm",
  1133. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1134. "method": "POST",
  1135. "host": "api.fiho.at",
  1136. "version": "1.1",
  1137. "path": "/index.htm",
  1138. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=feec94e3fe2ac985\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 319\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--feec94e3fe2ac985\r\nContent-Disposition: form-data; name=\"qrk\"\r\n\r\nWHA1UwCS8RT4U8Vd/QBguKsOwyWbey6HcYp/_2Fk_2Ftl3jXGZC0NV6lG/hYf_2BO2/q_2BKX8Fu6/zc19m_2Fmgb/W9F5F0p_2Fe7f2mnDV/td_2F2a1YIjpw2jzencvpr/z0Qse6T7/2ecxrHm2onV5Ju1j/gBFMUqKwOTBiykdU/wKEjDiow/obU_2BRSi6ADgRU1W_2Bt/wO_2F_2Bse/Apn6HJi3a/11\r\n--feec94e3fe2ac985--\r\n",
  1139. "port": 80
  1140.  
  1141.  
  1142. "count": 1,
  1143. "body": "--abe6ce17fe2ac985\r\nContent-Disposition: form-data; name=\"wxhqengj\"\r\n\r\nviio7yveITfu7TcD89FU107/BrQ_2BiYYLxqgAsmRqzcqF/EYc6EF3TO3vPj5MCKs/lNaeK3JwUfpxj/w_2Bn62VVPgRPS8Cn/2qLh451Bb/5Ww1V71ZXKyLhlxBTJCdt/07feDr9lvBS_2FAr6HZ/sGSu96QAuQFMHFf/_2BJ8_2FPILcezRcBXJ/1AkSgceSc58Gij/KSe_2Fj4rB3/fuV\r\n--abe6ce17fe2ac985--\r\n",
  1144. "uri": "http://t2.fiho.at/index.htm",
  1145. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1146. "method": "POST",
  1147. "host": "t2.fiho.at",
  1148. "version": "1.1",
  1149. "path": "/index.htm",
  1150. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=abe6ce17fe2ac985\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 311\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--abe6ce17fe2ac985\r\nContent-Disposition: form-data; name=\"wxhqengj\"\r\n\r\nviio7yveITfu7TcD89FU107/BrQ_2BiYYLxqgAsmRqzcqF/EYc6EF3TO3vPj5MCKs/lNaeK3JwUfpxj/w_2Bn62VVPgRPS8Cn/2qLh451Bb/5Ww1V71ZXKyLhlxBTJCdt/07feDr9lvBS_2FAr6HZ/sGSu96QAuQFMHFf/_2BJ8_2FPILcezRcBXJ/1AkSgceSc58Gij/KSe_2Fj4rB3/fuV\r\n--abe6ce17fe2ac985--\r\n",
  1151. "port": 80
  1152.  
  1153.  
  1154. "count": 1,
  1155. "body": "--41da67dbfe2ac985\r\nContent-Disposition: form-data; name=\"ogdkndpjq\"\r\n\r\nIF8vNbOjPYTEjGoma03CA8E/RnCwpotn9qN6jc/uy_2BJutZzJeKjamN/WDeNueeqYKqht1YLmXe5n/Xqt56LBXWI1jv/Ijtann_2F_2F/CD7mW0d3YYT4FYvUjR_2/BPuXRyql9wWEGe3TP_2Bo32/mtfVTEP24I6_2By/zyin8_2B3T5_2/BE4Sj6OVd1ci12Hja/0mjYoc74zMaF/XkoZOEUp\r\n--41da67dbfe2ac985--\r\n",
  1156. "uri": "http://api.fiho.at/index.htm",
  1157. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1158. "method": "POST",
  1159. "host": "api.fiho.at",
  1160. "version": "1.1",
  1161. "path": "/index.htm",
  1162. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: api.fiho.at\r\nContent-Type: multipart/form-data; boundary=41da67dbfe2ac985\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 316\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--41da67dbfe2ac985\r\nContent-Disposition: form-data; name=\"ogdkndpjq\"\r\n\r\nIF8vNbOjPYTEjGoma03CA8E/RnCwpotn9qN6jc/uy_2BJutZzJeKjamN/WDeNueeqYKqht1YLmXe5n/Xqt56LBXWI1jv/Ijtann_2F_2F/CD7mW0d3YYT4FYvUjR_2/BPuXRyql9wWEGe3TP_2Bo32/mtfVTEP24I6_2By/zyin8_2B3T5_2/BE4Sj6OVd1ci12Hja/0mjYoc74zMaF/XkoZOEUp\r\n--41da67dbfe2ac985--\r\n",
  1163. "port": 80
  1164.  
  1165.  
  1166. "count": 1,
  1167. "body": "--ebb3ddf1fe2ac984\r\nContent-Disposition: form-data; name=\"klc\"\r\n\r\n3d3eXR8IRLo/r4wySJZ2_2F_2/ByCZtQZmaiJaM/vK_2BuN_2BWQ6KsjNvy/r58r8FGoGS02ym/L_2B1wjEMMiE/F1Vx3cg_2Fv/zE5QAtNCb9/4OAnBpvjEbWxiaLyV/UuopHRoemSBu2WXF/UxXCHAUbNj/i0HOWx22Ygq/btaOtGJxLnSREYwj4yOmj/jvii1cQORlb2Y/TcC3GYD31_2Fre/V\r\n--ebb3ddf1fe2ac984--\r\n",
  1168. "uri": "http://t2.fiho.at/index.htm",
  1169. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1170. "method": "POST",
  1171. "host": "t2.fiho.at",
  1172. "version": "1.1",
  1173. "path": "/index.htm",
  1174. "data": "POST /index.htm HTTP/1.1\r\nAccept: */*\r\nHost: t2.fiho.at\r\nContent-Type: multipart/form-data; boundary=ebb3ddf1fe2ac984\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nContent-Length: 311\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--ebb3ddf1fe2ac984\r\nContent-Disposition: form-data; name=\"klc\"\r\n\r\n3d3eXR8IRLo/r4wySJZ2_2F_2/ByCZtQZmaiJaM/vK_2BuN_2BWQ6KsjNvy/r58r8FGoGS02ym/L_2B1wjEMMiE/F1Vx3cg_2Fv/zE5QAtNCb9/4OAnBpvjEbWxiaLyV/UuopHRoemSBu2WXF/UxXCHAUbNj/i0HOWx22Ygq/btaOtGJxLnSREYwj4yOmj/jvii1cQORlb2Y/TcC3GYD31_2Fre/V\r\n--ebb3ddf1fe2ac984--\r\n",
  1175. "port": 80
  1176.  
  1177.  
  1178.  
  1179. * Network Communication - SMTP:
  1180.  
  1181. * Network Communication - Hosts:
  1182.  
  1183. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!