24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 2a89325f2ee4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2a89325f2ee4…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f"],"about":{"@type":"SoftwareApplication","name":"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe","applicationCategory":["peexe","executable"],"identifier":"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1273,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006624.00000000.240883.034F0000.00000004.mdmp, 00000000-00006624.00000001.241575.034F0000.00000004.mdmp, 00000000-00006624.00000001.241575.07C67000.00000004.mdmp, 00000000-00006624.00000001.241575.09760000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006624.00000000.240883.034F0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00006624.00000000.240883.034F0000.00000004.mdmp, 00000000-00006624.00000001.241575.034F0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006624.00000000.240883.034F0000.00000004.mdmp, 00000000-00006624.00000000.240883.05340000.00000004.mdmp, 00000000-00006624.00000001.241575.034F0000.00000004.mdmp") Found string "/System.Management.Automation.resources/System.Management.Automation.resources" (Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found string "gement.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp, 00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp, 00000000-00006624.00000001.241575.07998000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp")26:T6cb,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp")27:Tbad,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER32") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER32") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER32") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER32") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS")28:Td59,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2743662044 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2743670159 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2743858173 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2743866244 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2744559891 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2744568892 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2745018764 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2745028094 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2745219297 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2745228502 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2745439665 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2745447819 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2746128422 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2746135477 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2747828287 [PID: 5948] "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queried SystemProcessInformation at 00000000-00005948-00000C15-2747835839 [PID: 5948] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2748615334 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2748622204 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2748795255 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2748802055 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2749377384 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2749385533 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2749781124 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2749788489 [PID: 2564] "msdtc.exe" queried SystemProcessInformation at 00000000-00002564-00000C15-2749898214 [PID: 2564]29:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2a:T4ef,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains CRYPTO related strings Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2b:T8684,Found XOR loop in file "msdtc.exe" at offset 13617; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 172117; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 303944; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 420655; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 424778; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 551279; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 580968; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 583778; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 697547; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 700418; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 853109; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 874361; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1005281; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1074912; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1088137; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1133555; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1196243; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1219171; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1298682; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1318366; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1405616; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1502315; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1508980; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1606359; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1628330; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1651026; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1685259; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1696062; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1715041; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1725674; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1888406; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1951262; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 1960254; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2020557; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2035304; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2078882; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2171480; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2213211; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2230023; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2248533; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2380167; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2521586; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2573574; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2654856; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2731922; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2742759; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2762267; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2828512; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2862326; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2955103; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2987460; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 2996732; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 3015676; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 3023492; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 3114417; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 3230832; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 3298426; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 3404768; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 3424921; code bytes = 30d0 Found XOR loop in file "msdtc.exe" at offset 117637; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 132391; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 273098; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 309881; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 434945; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 595399; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 651090; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 670221; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 672281; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1013952; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1084576; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1133715; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1253830; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1371064; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1396192; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1530631; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1606880; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1614148; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1674131; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1781843; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1837489; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 1952153; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2011637; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2013951; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2078841; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2093696; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2104709; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2279879; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2302945; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2310525; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2422258; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2431404; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2435323; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2531807; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2597938; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2674822; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2688111; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2836077; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2842625; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2895600; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2957687; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 2990355; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3038955; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3065111; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3127964; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3201498; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3228976; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3239902; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3331277; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3553601; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 3558375; code bytes = 33c1 Found XOR loop in file "msdtc.exe" at offset 236691; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 298189; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 493794; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 502442; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 524772; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 692803; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 711446; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 733773; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 734538; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 753743; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 829980; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 886748; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1044972; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1177160; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1196201; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1227524; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1255889; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1400189; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1412606; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1452666; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1535031; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1574175; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1602204; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1663304; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1698678; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1781677; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1787669; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1795857; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 1982389; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2105710; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2221116; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2273808; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2378027; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2438341; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2455806; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2458228; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2467149; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2584965; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2650915; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2670104; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2788483; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 2857303; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 3088735; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 3248111; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 3271881; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 3281584; code bytes = 8030 Found XOR loop in file "msdtc.exe" at offset 3372354; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 13617; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 172117; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 303944; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 420655; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 424778; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 551279; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 580968; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 583778; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 697547; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 700418; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 853109; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 874361; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1005281; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1074912; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1088137; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1133555; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1196243; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1219171; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1298682; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1318366; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1405616; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1502315; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1508980; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1606359; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1628330; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1651026; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1685259; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1696062; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1715041; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1725674; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1888406; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1951262; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1960254; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2020557; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2035304; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2078882; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2171480; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2213211; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2230023; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2248533; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2380167; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2521586; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2573574; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2654856; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2731922; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2742759; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2762267; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2828512; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2862326; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2955103; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2987460; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 2996732; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3015676; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3023492; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3114417; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3230832; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3298426; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3404768; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 3424921; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 117637; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 132391; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 273098; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 309881; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 434945; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 595399; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 651090; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 670221; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 672281; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1013952; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1084576; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1133715; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1253830; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1371064; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1396192; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1530631; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1606880; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1614148; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1674131; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1781843; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1837489; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1952153; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2011637; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2013951; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2078841; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2093696; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2104709; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2279879; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2302945; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2310525; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2422258; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2431404; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2435323; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2531807; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2597938; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2674822; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2688111; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2836077; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2842625; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2895600; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2957687; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 2990355; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3038955; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3065111; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3127964; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3201498; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3228976; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3239902; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3331277; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3553601; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 3558375; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 236691; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 298189; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 493794; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 502442; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 524772; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 692803; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 711446; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 733773; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 734538; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 753743; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 829980; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 886748; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1044972; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1177160; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1196201; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1227524; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1255889; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1400189; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1412606; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1452666; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1535031; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1574175; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1602204; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1663304; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1698678; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1781677; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1787669; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1795857; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1982389; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2105710; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2221116; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2273808; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2378027; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2438341; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2455806; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2458228; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2467149; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2584965; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2650915; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2670104; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2788483; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 2857303; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3088735; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3248111; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3271881; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3281584; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 3372354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 13617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 172117; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 303944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 420655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 424778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 580968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 583778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 697547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 700418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 853109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 874361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1005281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1074912; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1088137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1133555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1196243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1219171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1298682; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1318366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1405616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1502315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1508980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1606359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1628330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1651026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1685259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1696062; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1715041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1725674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1888406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1951262; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1960254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2020557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2035304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2078882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2171480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2213211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2230023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2248533; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2380167; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2521586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2573574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2654856; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2731922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2742759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2762267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2828512; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2862326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2955103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2987460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2996732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3015676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3023492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3114417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3230832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3298426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3404768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3424921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 117637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 132391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 273098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 309881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 434945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 595399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 651090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 670221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 672281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1013952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1084576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1133715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1253830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1371064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1396192; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1530631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1606880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1614148; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1674131; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1781843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1952153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2011637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2013951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2078841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2093696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2104709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2279879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2302945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2310525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2422258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2431404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2435323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2531807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2597938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2674822; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2688111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2836077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2842625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2895600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2957687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2990355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3038955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3065111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3127964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3201498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3228976; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3239902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3331277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3553601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3558375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 236691; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 298189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 493794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 502442; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 524772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 692803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 711446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 734538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 753743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 829980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 886748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1044972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1177160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1196201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1227524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1255889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1400189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1412606; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1452666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1535031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1574175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1602204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1663304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1698678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1781677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1787669; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1795857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1982389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2105710; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2221116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2273808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2378027; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2438341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2455806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2458228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2467149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2584965; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2650915; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2670104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2788483; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2857303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3088735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3248111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3271881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3281584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3372354; code bytes = 80302c:T45e,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005948-00000C2B-2744862346") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005948-00000C2B-2744862376") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005948-00000C2B-2744862438") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00006624-00000C2B-2757333272") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp")2d:T2e10,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000009644c5364e0277628eb2f01687dd67328f32f01401e7472ed6f1620feffffff44f22f01f77e7272e8f12f0100004f74e0f22f01107f7272e0df277608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000070f22f01000000000800000000000000000000000000000000000000000000000000000011644c5300000000b0f22f0169924174ffffffff3400000070f22f01080000000000000000004f74e0f22f012794417478f22f010b00000000000000c8f22f01 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb76f0e893265cbceb76086b5903000000003dbceb76c9d1576574abf376fddbf27649d057650000000060dbf2765261eb7610a65903488603770000000095df576504ea9326c796ec760000000010a65903488603770118000004ea9326d296ec76d82fe576501eec76f996ec7600000000d82fe57654ed560374ea932610a65903f8e893260000000050f0932600a8f37671f5c634fefffffffddbf276b702ec7624830377086b5903e05af3766dfaeb763cec9326086b5903ccfaeb7673496400086b590350ee9326000000005037e576000000000000000000000100000000006061590300000000000000040000000100000000 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb7668eb93265cbceb76806b5903000000003dbceb7651d2576574abf376fddbf276d1d257650000000060dbf2765261eb7628385a0348860377000000001dd057657cec9326c796ec760000000028385a0348860377011800007cec9326d296ec76d82fe576501eec76f996ec7600000000d82fe5768cbb5903ecec932628385a0370eb932600000000c8f2932600a8f37671f5c634fefffffffddbf276b702ec7624830377806b5903e05af3766dfaeb76b4ee9326806b5903ccfaeb76d069f500806b5903c8f09326000000005037e57600000000300000000000000026000000a09c5903000000008d5600000000000000000000 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb76a8e793265cbceb7620675903000000003dbceb7691de576574abf376fddbf27611d157650000000060dbf2765261eb7620b4590348860377000000005ddc5765bce89326c796ec760000000020b459034886037701180000bce89326d296ec76d82fe576501eec76f996ec7600000000d82fe576ccbb59032ce9932620b45903b0e793260000000008ef932600a8f37671f5c634fefffffffddbf276b702ec762483037720675903e05af3766dfaeb76f4ea932620675903ccfaeb76d069f5002067590308ed9326000000005037e5760000000030000000000000005700000038df590300000000591200000000000000000000 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb7690e593265cbceb76e8675903000000003dbceb76a9dc576574abf376fddbf27629df57650000000060dbf2765261eb76e0e45c03488603770000000075da5765a4e69326c796ec7600000000e0e45c034886037701180000a4e69326d296ec76d82fe576501eec76f996ec7600000000d82fe576ccbb590314e79326e0e45c0398e5932600000000f0ec932600a8f37671f5c634fefffffffddbf276b702ec7624830377e8675903e05af3766dfaeb76dce89326e8675903ccfaeb76d069f500e8675903f0ea9326000000005037e5760000000030000000000000000c000000d8b459030000000008c100000000000000000000 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "msdtc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000003fc07fcd64e02776c0e82000687dd673c0f02000401e747243d52abffeffffffdcef2000f77e727280ef200000004f7478f02000107f7272e0df277608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000008f020000000000008000000000000000000000000000000000000000000000000004f7417c07fcd0000000048f0200069924174ffffffff3400000008f02000080000000000000000004f7478f020002794417410f020000b0000000000000060f02000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb7628e552265cbceb76d82f3903000000003dbceb76f7dc807074abf376fddbf27677dc80700000000060dbf2765261eb76d00e390348860377000000003bdb80703ce65226c796ec7600000000d00e390348860377011800003ce65226d296ec76d82fe576501eec76f996ec7600000000d82fe5766cf53603ace65226d00e390330e552260000000088ec522600a8f37697f5d021fefffffffddbf276b702ec7624830377d82f3903e05af3766dfaeb7674e85226d82f3903ccfaeb7673496400d82f390388ea5226000000005037e576000000000000000000000100000000008892390300000000000000040000000100000000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb7668e852265cbceb76102a3903000000003dbceb76b7d1807074abf376fddbf27637d180700000000060dbf2765261eb76389e39034886037700000000fbdf80707ce95226c796ec7600000000389e390348860377011800007ce95226d296ec76d82fe576501eec76f996ec7600000000d82fe576c4cf3903ece95226389e390370e8522600000000c8ef522600a8f37697f5d021fefffffffddbf276b702ec7624830377102a3903e05af3766dfaeb76b4eb5226102a3903ccfaeb76d069f500102a3903c8ed5226000000005037e5760000000030000000000000005b00000090ab39030000000021eb00000000000000000000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb7628e652265cbceb76382f3903000000003dbceb76f7df807074abf376fddbf27677df80700000000060dbf2765261eb7690463c0348860377000000003bda80703ce75226c796ec760000000090463c0348860377011800003ce75226d296ec76d82fe576501eec76f996ec7600000000d82fe57604cf3903ace7522690463c0330e652260000000088ed522600a8f37697f5d021fefffffffddbf276b702ec7624830377382f3903e05af3766dfaeb7674e95226382f3903ccfaeb76d069f500382f390388eb5226000000005037e5760000000030000000000000007900000060e8390300000000520600000000000000000000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef7600000000d0b1eb76e8e952265cbceb76782b3903000000003dbceb7637d0807074abf376fddbf276b7d380700000000060dbf2765261eb7608ef380348860377000000007bde8070fcea5226c796ec760000000008ef38034886037701180000fcea5226d296ec76d82fe576501eec76f996ec7600000000d82fe57684d339036ceb522608ef3803f0e952260000000048f1522600a8f37697f5d021fefffffffddbf276b702ec7624830377782b3903e05af3766dfaeb7634ed5226782b3903ccfaeb76d069f500782b390348ef5226000000005037e57600000000300000000000000010000000c826390300000000c07400000000000000000000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000b8e520005ce52000226e0b7600006d03000000002d6e0b763186f9022d000000ecb76a74e0e5200000002300888e360300b235030a0000008000000020e5200000002300a4e5200070c80c769512c874feffffff2d000000d0cc79742700000074e52000856a0d761c231276b4e52000f85f0d7608000000bb690c76b2690c76d986f9022d000000ecb76a7427000000d0cc797488e520002d000000d0cc797427000000b8e52000856a0d761c23127600e620007e8a7874ee8c7874738a7874014805912d000000ecb76a7427000000d0cc79747c6f6d03106f6d0301480591c8e52000fc52b674b4e62000e0847874395f91e5feffffff738a7874 (UID: 00000000-00002564) "msdtc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000088de200038cf0c7754383503f4de200001000000083835035438350308383503040000000400000000e04b7400100000f4de20000100000008383503cd970c779c970c779c87de90b50f42740838350300000c770000000004042b740000000080ee48740100000000000000f8e24b74000000000400000080a9a17348404a74f8e24b74f8de200080e8497638de380380e84976f4de20000000000080e8497654ace8fcfeffffff00000000000000000000000013000000443338030200000002000000180000001833380344333803000000009772e9f678e12000ddf33f746cdf2000000000001833380318000000f8f33f7418333803 (UID: 00000000-00002564)2e:T4d6,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "msdtc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "msdtc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2f:Tfd7,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")30:Tf3c,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00005948-00000C17-2747869420 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00005948-00000C17-2747871958 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages" at 00000000-00002564-00000C17-2752958041 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00002564-00000C17-2753085620 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data" at 00000000-00002564-00000C17-2753103793 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" at 00000000-00002564-00000C17-2753144184 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" at 00000000-00002564-00000C17-2754056653 "msdtc.exe" queries volume information of "C:\Program Files (x86)\Windows Multimedia Platform\msdtc.exe" at 00000000-00002564-00000C17-2754057455 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ActorSafetyLists" at 00000000-00002564-00000C17-2760488771 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AmountExtractionHeuristicRegexes" at 00000000-00002564-00000C17-2760489709 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates" at 00000000-00002564-00000C17-2760490619 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics" at 00000000-00002564-00000C17-2760491427 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation" at 00000000-00002564-00000C17-2760508209 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CommerceHeuristics" at 00000000-00002564-00000C17-2760509319 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CookieReadinessList" at 00000000-00002564-00000C17-2760510184 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad" at 00000000-00002564-00000C17-2760511074 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny" at 00000000-00002564-00000C17-2760512356 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default" at 00000000-00002564-00000C17-2760513168 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" at 00000000-00002564-00000C17-2760829561 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" at 00000000-00002564-00000C17-2762679580 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" at 00000000-00002564-00000C17-2762807390 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies" at 00000000-00002564-00000C17-2763851422 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded" at 00000000-00002564-00000C17-2763852330 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache" at 00000000-00002564-00000C17-2763853015 "msdtc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache" at 00000000-00002564-00000C17-276385370931:T50c8,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005948) "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005948) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002564) "msdtc.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00002564) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006624) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006624) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004816) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007748) "msdtc.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007748)32:T169a,"Select Name from Win32_VideoController" (Source: 00000000-00005948-00002714-2746522718, Indicator: "select name from win32_videocontroller") "select Name from Win32_Processor" (Source: 00000000-00005948-00002714-2746904791, Indicator: "select name from win32_processor") "select * from Win32_OperatingSystem" (Source: 00000000-00005948-00002714-2747239429, Indicator: "select * from win32_operatingsystem") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00005948-00002714-2747515446, Indicator: "select totalphysicalmemory from win32_computersystem") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp, Indicator: "select totalphysicalmemory from win32_computersystem") "Select Name from Win32_VideoController" (Source: 00000000-00002564.00000000.240617.03391000.00000004.mdmp, Indicator: "select name from win32_videocontroller") "select * from Win32_OperatingSystem" (Source: 00000000-00002564.00000000.240617.03391000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "select Name from Win32_Processor" (Source: 00000000-00002564.00000000.240617.03391000.00000004.mdmp, Indicator: "select name from win32_processor") "CREATE TABLE x" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "create table x") "CREATE TABLE %Q.'%q_%q'(%s)%s" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "create table %q.'%q_%q'(%s)%s"), "SELECT word rank NULL langid id FROM "%w"."%w_vocab"%s" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "select word rank null langid id from "%w"."%w_vocab"%s"), "SELECT rowid rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "select rowid rank from %q.%q order by %s("%w"%s%s) %s"), "INSERT INTO"%w"."%w_rowid"(rowid,nodeno)VALUES(?1,?2)ON CONFLICT(rowid)DO UPDATE SET nodeno=excluded.nodeno" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "insert into"%w"."%w_rowid"(rowid,nodeno)values(?1,?2)on conflict(rowid)do update set nodeno=excluded.nodeno"), "CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY,nodeno" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "create table "%w"."%w_rowid"(rowid integer primary key,nodeno") "SELECT iLang, cFrom, cTo, iCost FROM "%w" WHERE iLang>=0 ORDER BY iLang" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "select ilang, cfrom, cto, icost from "%w" where ilang>=0 order by ilang") "SELECT idx,count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "select idx,count(*) from %q.sqlite_stat4 group by idx collate nocase"), "CREATE TABLE x(_shape" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "create table x(_shape") "UPDATE OR %s "%w"."%w_vocab" SET id=%lld, rank=%d, langid=%d, word=%Q, k1=nullif(%Q,%Q), k2=%Q WHERE id=%lld" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "update or %s "%w"."%w_vocab" set id=%lld, rank=%d, langid=%d, word=%q, k1=nullif(%q,%q) k2=%q where id=%lld"), "DELETE FROM "%w"."%w_vocab" WHERE id=%lld" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "delete from "%w"."%w_vocab" where id=%lld"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE x(%.*s INT" (Source: 00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp, Indicator: "create table x(%.*s int")33:T3bc6,Found reference to API (Indicator: "ExitProcess"; File: "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe") Found reference to API (Indicator: "VirtualProtect"; File: "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe") Found reference to API (Indicator: "GetProcAddress"; File: "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006624.00000000.240883.00821000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp, 00000000-00006624.00000001.241575.00811000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp, 00000000-00006624.00000001.241575.00811000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp, 00000000-00006624.00000001.241575.00811000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp, 00000000-00006624.00000001.241575.6EBE5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp")34:T1c9f,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 31678-159-0081D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 31678-194-00818190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 31678-194-00818190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 31678-194-00818190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 31678-196-0081BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 31678-207-00818AF0 "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002564.00000000.240617.03350000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E175B6D-F52A-11D8-B9A" in Source: 00000000-00002564.00000000.240617.03350000.00000004.mdmp 00000000-00002564.00000001.242536.03350000.00000004.mdmp 00000000-00002564.00000002.244456.03350000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002564.00000000.240617.03391000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002564.00000000.240617.03391000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002564.00000001.242536.03350000.00000004.mdmp 00000000-00002564.00000002.244456.03350000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Directory\BrowseInPlace" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00002564.00000001.242536.08180000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004816.00000000.241015.06100000.00000004.mdmp 00000000-00004816.00000001.241070.06100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004816.00000001.241070.00D90000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00004816.00000001.241070.00D90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006624.00000000.240883.034F0000.00000004.mdmp 00000000-00006624.00000001.241575.034F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006624.00000000.240883.034F0000.00000004.mdmp 00000000-00006624.00000001.241575.034F0000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00006624.00000000.240883.034F0000.00000004.mdmp 00000000-00006624.00000001.241575.034F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp35:T9f5,Process 2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5948:168:WilStaging_02" Process 2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe created mutex with name "SM0:5948:168:WilStaging_02" Process 2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe created mutex with name "\BaseNamedObjects\WEBR_2A4P1VTTYXCA" Process msdtc.exe created mutex with name "\BaseNamedObjects\WEBR_2A4P1VTTYXCA" Process msdtc.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msdtc.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msdtc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2564:168:WilStaging_02" Process msdtc.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2564:64:WilError_01" Process msdtc.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2564:64:WilError_01" Process msdtc.exe created mutex with name "Local\SM0:2564:168:WilStaging_02" Process msdtc.exe created mutex with name "Local\SM0:2564:64:WilError_01" Process msdtc.exe created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msdtc.exe created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msdtc.exe created mutex with name "SM0:2564:168:WilStaging_02" Process msdtc.exe created mutex with name "SM0:2564:64:WilError_01" Process msdtc.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2564:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6624:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6624:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6624:64:WilError_01" Process powershell.exe created mutex with name "Local\SM0:6624:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "SM0:6624:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex"36:T1280,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]37:T23b3,"??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00002564.00000000.240617.03350000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E175B6D-F52A-11D8-B9A" in Source: 00000000-00002564.00000000.240617.03350000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002564.00000000.240617.03391000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002564.00000000.240617.03391000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002564.00000001.242536.03350000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E175B6D-F52A-11D8-B9A" in Source: 00000000-00002564.00000001.242536.03350000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Directory\BrowseInPlace" in Source: 00000000-00002564.00000001.242536.033B5000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00002564.00000001.242536.08180000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002564.00000002.244456.03350000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E175B6D-F52A-11D8-B9A" in Source: 00000000-00002564.00000002.244456.03350000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "Registry\Machine\Software\Classes\Directory\BrowseInPlace" in Source: 00000000-00002564.00000002.244456.033B5000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004816.00000000.241015.06100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004816.00000001.241070.00D90000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00004816.00000001.241070.00D90000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004816.00000001.241070.06100000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006624.00000000.240883.034F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006624.00000000.240883.034F0000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00006624.00000000.240883.034F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006624.00000000.240883.05340000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006624.00000001.241575.00811000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006624.00000001.241575.034F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006624.00000001.241575.034F0000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00006624.00000001.241575.034F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00006624.00000001.241575.09760000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00006624.00000001.241575.09760000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00006624.00000001.241575.09760000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00006624.00000001.241575.09760000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007748.00000000.241650.03B70000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00007748.00000000.241650.06000000.00000004.mdmp38:T3d05,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "KERNEL32" at base 745b0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74580000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72650000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "KERNEL32.DLL" at base 745b0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76140000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "NTDLL.DLL" at base 77080000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "WINMM.DLL" at base 725f0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "POWRPROF.DLL" at base 76200000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "WS2_32.DLL" at base 75b50000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "USER32.DLL" at base 76b10000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "ADVAPI32.DLL" at base 75ef0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 727a0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "IPHLPAPI.DLL" at base 739c0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "RPCRT4.DLL" at base 76a50000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 725b0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72560000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "USERENV.DLL" at base 72530000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "SECUR32.DLL" at base 72520000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "SSPICLI.DLL" at base 73aa0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "OLE32.DLL" at base 75ca0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73550000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 724e0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ef0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72460000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 73cc0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "OLEAUT32.DLL" at base 73cc0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 723b0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 723a0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 722e0000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74310000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 72f30000 "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 739f0000 "msdtc.exe" loaded module "KERNEL32" at base 745b0000 "msdtc.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74310000 "msdtc.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74310000 "msdtc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74310000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74580000 "msdtc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74310000 "msdtc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74310000 "msdtc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74310000 "msdtc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72650000 "msdtc.exe" loaded module "KERNEL32.DLL" at base 745b0000 "msdtc.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76140000 "msdtc.exe" loaded module "NTDLL.DLL" at base 77080000 "msdtc.exe" loaded module "WINMM.DLL" at base 725f0000 "msdtc.exe" loaded module "POWRPROF.DLL" at base 76200000 "msdtc.exe" loaded module "WS2_32.DLL" at base 75b50000 "msdtc.exe" loaded module "USER32.DLL" at base 76b10000 "msdtc.exe" loaded module "ADVAPI32.DLL" at base 75ef0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 727a0000 "msdtc.exe" loaded module "IPHLPAPI.DLL" at base 739c0000 "msdtc.exe" loaded module "RPCRT4.DLL" at base 76a50000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 725b0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72560000 "msdtc.exe" loaded module "USERENV.DLL" at base 72530000 "msdtc.exe" loaded module "SECUR32.DLL" at base 72520000 "msdtc.exe" loaded module "SSPICLI.DLL" at base 73aa0000 "msdtc.exe" loaded module "OLE32.DLL" at base 75ca0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73550000 "msdtc.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74310000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 724e0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ef0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72460000 "msdtc.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 73cc0000 "msdtc.exe" loaded module "OLEAUT32.DLL" at base 73cc0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 723b0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 723a0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 722e0000 "msdtc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74310000 "msdtc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74310000 "msdtc.exe" loaded module "WTSAPI32.DLL" at base 73710000 "msdtc.exe" loaded module "GDI32.DLL" at base 744f0000 "msdtc.exe" loaded module "CRYPT32.DLL" at base 759c0000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 739f0000 "msdtc.exe" loaded module "RSTRTMGR.DLL" at base 6e510000 "msdtc.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76140000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74310000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74310000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74310000 "powershell.exe" loaded module "KERNEL32" at base 745b0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72650000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75ef0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72340000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75f80000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76e20000 "powershell.exe" loaded module "VERSION.DLL" at base 737c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71b90000 "powershell.exe" loaded module "USER32.DLL" at base 76b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74310000 "powershell.exe" loaded module "MSCOREE.DLL" at base 724a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76e30000 "powershell.exe" loaded module "PSAPI.DLL" at base 76060000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76a50000 "powershell.exe" loaded module "KERNEL32.DLL" at base 745b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 706d0000 "powershell.exe" loaded module "OLE32.DLL" at base 75ca0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76e30000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 73cc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 706a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76140000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fbb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f390000 "powershell.exe" loaded module "COMBASE.DLL" at base 76e30000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76e30000 "powershell.exe" loaded module "NTDLL.DLL" at base 77080000 "powershell.exe" loaded module "SHELL32.DLL" at base 74680000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75c50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 759c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6ec10000 "powershell.exe" loaded module "AMSI.DLL" at base 72460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 737c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ebd0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 759c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\E5T1670B.DLL" at base 6eb90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6eb10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e7b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76e30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6e760000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6e650000 "powershell.exe" loaded module "SECUR32.DLL" at base 72520000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73aa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73550000 "powershell.exe" loaded module "WLDP.DLL" at base 6e630000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e590000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 745b0000 "powershell.exe" loaded module "USERENV.DLL" at base 72530000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ef0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6e4b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6e490000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 745b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6e460000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e2d0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e2d0000 "powershell.exe" loaded module "URLMON.DLL" at base 73360000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74310000 "powershell.exe" loaded module "MSISO.DLL" at base 6e260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e1b0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 72870000 "powershell.exe" loaded module "OLEAUT32" at base 73cc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 74310000 "powershell.exe" loaded module "MSVCRT.DLL" at base 76070000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6de70000 "powershell.exe" loaded module "MI.DLL" at base 6de50000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 74310000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6ddc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ddb0000 "powershell.exe" loaded module "GDI32.DLL" at base 744f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6dd30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6dc70000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74310000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74310000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 745b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 74310000 "msdtc.exe" loaded module "OLEAUT32" at base 73cc000039:T4e9,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "WbemScripting.SWbemLocator.1.CreateObject" ... "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "WbemScripting.SWbemLocator.1.ConnectServer" with result: "IDispatch" ... "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "WbemScripting.SWbemLocator.1("ConnectServer").ExecQuery" with result: "IDispatch" ... "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery").Count" with result: "1" ... "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery")._NewEnum" with result: "IDispatch" ... "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery").Count" with result: "2" ... "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "Schedule.Service.1.CreateObject" ... "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" called "Schedule.Service.1.Connect" ... "msdtc.exe" called "WbemScripting.SWbemLocator.1.CreateObject" ... 3a:Tf55,Found string "if (Test-Path $ProgramFilesX86) {" (Indicator: "Test-Path"; Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp, 00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp")3b:Td6f,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "msdtc.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "msdtc.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "msdtc.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "msdtc.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")3c:T4a3,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce8015,lea edi, [esi - 0x8e7015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x1054918,inc esi,inc esi,push ebx,push 0xc5238e,push edi,add ebx, 4,push ebx,push 0x36c8e3,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2]," "msdtc.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xce8015,lea edi, [esi - 0x8e7015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x1054918,inc esi,inc esi,push ebx,push 0xc5238e,push edi,add ebx, 4,push ebx,push 0x36c8e3,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2],"3d:T70a,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "msdtc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "msdtc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msdtc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "msdtc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "msdtc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3e:Tfc4,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006624-00000C2D-964615426] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006624-00000C2A-2753693679] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006624-00000C2A-2753798148] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006624-00000C2A-2753867831] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006624-00000C2A-2754198637] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006624-00000C2A-2754229697] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006624-00000C2A-2754291456] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006624-00000C2A-2754345235] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006624-00000C2A-2754574368] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006624-00000C2A-2754601950] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006624-00000C2A-2754893694] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006624-00000C2A-2754927800] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006624-00000C2A-2755280050] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006624-00000C2A-2755567373] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006624-00000C2A-2755889474] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006624-00000C2A-2755907421] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006624-00000C2A-2756320755] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006624-00000C2A-2756343228] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006624-00000C2A-2756515242] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006624-00000C2A-2756606637] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00006624-00000C2A-2756701521] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006624-00000C2A-2756768830] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00006624-00000C2A-2756793237] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006624-00000C2A-2756895180] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006624-00000C2A-2757209814]3f:T85a,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp")40:T449,"msdtc.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msdtc.exe]- [targetUID: 00000000-00005948] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006624] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00006624] "msdtc.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Windows Multimedia Platform\msdtc.exe]- [targetUID: 00000000-00005948] "msdtc.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\msdtc.exe]- [targetUID: 00000000-00005948] "lsass.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- [targetUID: 00000000-00005948]41:Tab6,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMLOCATOR\CLSID"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PROGIDINDEX"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "")42:Tef7,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "PROFILEIMAGEPATH"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMLOCATOR\CLSID"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "EVERYONEINCLUDESANONYMOUS"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00000134-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: "NDROLEEXTDLL"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "GIPACTIVITYBYPASS"; Value: "") "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\PROGID"; Key: ""; Value: "")43:T41d,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"44:T719,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\BCRYPT.DLL" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\bcrypt.dll" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "msdtc.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "msdtc.exe" trying to access non-existent file "C:\Program Files (x86)\Windows Multimedia Platform\FLTLIB.DLL" "msdtc.exe" trying to access non-existent file "C:\Program Files (x86)\Windows Multimedia Platform\CRYPTSP.DLL" "msdtc.exe" trying to access non-existent file "C:\Program Files (x86)\Windows Multimedia Platform\BCRYPT.DLL" "msdtc.exe" trying to access non-existent file "C:\Program Files (x86)\Windows Multimedia Platform\bcrypt.dll" "msdtc.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL"45:T6d5,"2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\9A3B875D-786E-1FA4-2FEA-6B5ECA295D78" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "\Device\RasAcd" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\PROGRAM FILES (X86)(X86)" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\Program Files (x86)\Windows Sidebar\9A3B875D-786E-1FA4-2FEA-6B5ECA295D78" "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f.exe" trying to access non-existent file "C:\Program Files (x86)\Windows Multimedia Platform\9A3B875D-786E-1FA4-2FEA-6B5ECA295D78" "msdtc.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "msdtc.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "msdtc.exe" trying to access non-existent file "\Device\RasAcd" "msdtc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\9A3B875D-786E-1FA4-2FEA-6B5ECA295D78" "msdtc.exe" trying to access non-existent file "C:\powershell.exe.com" "msdtc.exe" trying to access non-existent file "C:\powershell.exe.bat" "msdtc.exe" trying to access non-existent file "C:\powershell.exe.cmd"46:T5a4,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "64.124.12.162" found in string "IP: 64.124.12.162" "192.168.0.1" "192.168.0.1:53" Potential IPs "8.8.4.4" "8.8.8.8" found in string "{"Status":0,"TC":false,"RD":true,"RA":true,"AD":true,"CD":false,"Question":[{"name":"dns.google.","type":1}],"Answer":[{"name":"dns.google.","type":1,"TTL":807,"data":"8.8.4.4"},{"name":"dns.google.","type":1,"TTL":807,"data":"8.8.8.8"}]}" Potential IP "64.124.12.162" found in string "api-81556a20.duosecurity.com TRUE / TRUE 253402300799 hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O |64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62" "2.5.29.15" "2.5.29.19" "2.5.29.14" "2.5.29.31" "2.5.29.16" "2.5.29.32" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.3" "2.5.29.1" "2.5.29.17" Potential IP "2.5.29.37" found in string "%2.5.29.37" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.10" "1.1.0.1" "3.0.0.0" "2.5.4.5" "2.5.4.11" Potential IP "1.0.0.0" found in string "ft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35"47:T2a72,Heuristic match: "lgp.gs" Heuristic match: "xs[.nl" Heuristic match: "/%.ps" Pattern match: "9b.qjt/.k" Heuristic match: "4r.km" Heuristic match: "\[.mp" Heuristic match: "q|.bm" Heuristic match: "m$:c.ci" Heuristic match: "a.nr" Heuristic match: "wi.sn" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "??\c:\powershell.exe.com" Pattern match: "https://dns.google/resolve?name=google.com" Pattern match: "https://dns.google/resolve?name=dns.google" Heuristic match: "putin@kremlin.ru" Pattern match: "http://o.pki.goog/wr20%" Pattern match: "http://i.pki.goog/wr2.crt0" Heuristic match: "dns.google.com" Heuristic match: "*.dns.google.com" Pattern match: "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0" Heuristic match: "ma.aw" Pattern match: "http://i.pki.goog/r1.crt0+" Pattern match: "http://c.pki.goog/r/r1.crl0" Pattern match: "http://ocsp.pki.goog/gsr10" Pattern match: "http://pki.goog/gsr1/gsr1.crt02" Pattern match: "http://crl.pki.goog/gsr1/gsr1.crl0" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=s1afy8kybenji%2ffsq2hfsvoeuk%2fiitq2w%2fu6dygtmz2ijf4onshq3y5ni9mhur%2flm5hy7sap4isw4bz1b109riln1yysi1qvbrmnoxqjydzdcecic0b7hnsz8gy8" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=x54ik94tydybvcmwdvth5pubvoqbkoutv5ugm4b%2bvw92qljjckrphoeqtjy4uypkums9%2fow5jlyo%2fayw4vsnxlv5j8washgnf6mquue9%2fgybpu8qi1mqiwh%2bri0w" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=oid255tozx5kukchauwkyqcm0rjciimeehezt4lw41juiaiunf%2f4js7gilfnv4ae7j90vvvdyqzpojbmime5rka677zqxy9bhgpkbp12mqhy0qgqeik0afilt%2fdw" Heuristic match: "?q.ye" Pattern match: "www.google.com" Pattern match: "https://{report_to:cf-nel,success_fraction:0.0,max_age:604800" Pattern match: "github.com/ncruces/go-sqlite3.pointer" Heuristic match: "secom trust.net" Heuristic match: "entrust.net" Pattern match: "www.digicert.com" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "www.xrampsecurity.com" Pattern match: "http://www.usertrust.comutn-userfirst-object" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.entrust.net/cps_2048" Pattern match: "www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Pattern match: "http://crl.comodoca.com/aaacertificateservices.crl" Pattern match: "http://crl.usertrust.com/utn-userfirst-object.crl" Pattern match: "www.camerfirma.com/address" Pattern match: "www.entrust.net/legal-terms" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "www.entrust.net/cps" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "http://www.usertrust.com1" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Heuristic match: "m .ph" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://crl.xrampsecurity.com/xgca.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://www.quovadisglobal.com/cps0" Pattern match: "http://www.chambersign.org10" Pattern match: "http://crl.chambersign.org/chambersroot.crl0" Pattern match: "cps.chambersign.org/cps/chambersroot.html0" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://policy.camerfirma.com0" Pattern match: "http://crl.globalsign.net/root-r2.crl" Pattern match: "http://crl.comodo.net/aaacertificateservices.crl" Pattern match: "http://crl.chambersign.org/chambersroot.crl" Pattern match: "https://ocsp.quovadisoffshore.com" Pattern match: "https://ocsp.quovadisoffshore.com0" Pattern match: "http://www.quovadis.bm0" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "em.ma" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "ntrust.net" Heuristic match: "d364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft.management.in" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "https://go.microsoft.com/fwlink/?linkid=517145" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "rl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microocerao" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0"48:T7d93,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comhttps://dns.google/resolve?name=dns.googlee9=ia%" - Source: "00000000-00002564.00000000.240617.05890000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0)k:h[oh>_)3\p" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0)k:h[" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=s1afy8kybenji%2ffsq2hfsvoeuk%2fiitq2w%2fu6dygtmz2ijf4onshq3y5ni9mhur%2flm5hy7sap4isw4bz1b109riln1yysi1qvbrmnoxqjydzdcecic0b7hnsz8gy8" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=x54ik94tydybvcmwdvth5pubvoqbkoutv5ugm4b%2bvw92qljjckrphoeqtjy4uypkums9%2fow5jlyo%2fayw4vsnxlv5j8washgnf6mquue9%2fgybpu8qi1mqiwh%2bri0w" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=oid255tozx5kukchauwkyqcm0rjciimeehezt4lw41juiaiunf%2f4js7gilfnv4ae7j90vvvdyqzpojbmime5rka677zqxy9bhgpkbp12mqhy0qgqeik0afilt%2fdw" - Source: "00000000-00002564.00000000.240617.058BA000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002564.00000001.242536.03350000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?digicert" - Source: "00000000-00004816.00000000.241015.06100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?digicert" - Source: "00000000-00004816.00000001.241070.06100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.5[[x" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006624.00000000.240883.036F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006624.00000000.240883.036F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006624.00000000.240883.036F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microocerao06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006624.00000000.240883.07BB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00006624.00000000.240883.6EBD1000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!&x" - Source: "00000000-00006624.00000001.241575.034F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.5[[x" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006624.00000001.241575.035CE000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zqmanimicrosoft.powershell.security.dllqmanimicrosoft.management.infrastructure.dllmicrosoft" - Source: "00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0h" - Source: "00000000-00006624.00000001.241575.07C67000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" (Indicator: "GetDC"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002564.00000000.240617.03350000.00000004.mdmp, 00000000-00002564.00000001.242536.03350000.00000004.mdmp, 00000000-00002564.00000002.244456.03350000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004816.00000000.241015.00D90000.00000004.mdmp, 00000000-00004816.00000001.241070.00D90000.00000004.mdmp")4b:T1267,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00006624.00000001.241575.00811000.00000020.mdmp") Found string "AAOCAQ8AMIIBCgKCAQEAtITMMxcua5Rsa2FSoOujz3mUTOWUgJnLVWREZY9nZOIG41w3SfYvm4SE" (Indicator: "rsa2"; Source: "00000000-00002564.00000000.240617.05880000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00002564.00000001.242536.08180000.00000004.mdmp") Found string "base64 accepts only blob or text" (Indicator: "base64"; Source: "00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp") Found string "blob from base64 may be too big" (Indicator: "base64"; Source: "00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp") Found string "blob expanded to base64 too big" (Indicator: "base64"; Source: "00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp") Found string "base64 OOM" (Indicator: "base64"; Source: "00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002564.00000001.242536.26FE0000.00000004.mdmp, 00000000-00002564.00000001.242536.29010000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp, 00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.035CE000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006624.00000000.240883.035CE000.00000004.mdmp, 00000000-00006624.00000000.240883.07BB0000.00000004.mdmp, 00000000-00006624.00000001.241575.035CE000.00000004.mdmp, 00000000-00006624.00000001.241575.07BB0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00006624.00000000.240883.05340000.00000004.mdmp") Found string "[-WindowStyle