24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T471,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious LXDropper Sample 3f790d1fc0ba… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3f790d1fc0ba…. Malware family: LXDropper. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","keywords":["Malicious","LXDropper","malware analysis","sandbox report","threat intelligence","3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"LXDropper","antivirusDetections":{"malicious":14,"total":24},"behavioralIndicators":{"malicious":12,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1260,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp, 00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "ile:///C:/Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.DLL" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp, 00000000-00007120.00000001.103640.02C50000.00000004.mdmp, 00000000-00007120.00000001.103640.07252000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "ile:///C:/Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.DLL" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "sWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.DLL" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "??\C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "NDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string ":\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.EXE" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "System.Management.Automation.resources.DLL" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "System.Management.Automation.resources.EXE" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "s/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.DLL" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "hell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "hell\v1.0\en-US\System.Management.Automation.resources\System.Management.Automation.resources.EXE" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "OW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "ndows/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp, 00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp, 00000000-00007120.00000001.103640.02C50000.00000004.mdmp")26:T5b2,file/memory contains long string(File: "Magic.exe") Found string "GZipStream" (Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found string "system.io.compression" (Source: "00000000-00004228.00000000.102898.7DB00000.00000004.mdmp, 00000000-00004228.00000000.102898.7DB20000.00000004.mdmp, 00000000-00004228.00000001.103762.7DB20000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00004228.00000000.102898.7DB00000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00004228.00000000.102898.7DB00000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00004228.00000000.102898.7DB00000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00004228.00000000.102898.7DB00000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00004228.00000000.102898.7DB00000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00004228.00000000.102898.7DB20000.00000004.mdmp, 00000000-00004228.00000001.103762.7DB20000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00004228.00000000.102898.7DB20000.00000004.mdmp, 00000000-00004228.00000001.103762.7DB20000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found string "System.IO.Compression.ZipFile" (Source: "00000000-00007120.00000001.103640.009E1000.00000020.mdmp")27:T1173,Found reference string "<#ywu#>Add-MpPreference <#rvn#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#xyl#> -Force <#dwx#>" (Indicator: "add-mppreference"; File: "00000000-00007120") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPU" (Indicator: "add-mppreference"; Source: "00000000-00001676-00000C47-6194565150") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001676-00000C47-66314356851") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\FqLB" (Indicator: "add-mppreference"; Source: "00000000-00001676-00000C47-103362897991") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsNot" (Indicator: "add-mppreference"; Source: "00000000-00001676-00000C47-134162336614") Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\FqLBHJD\AppData\Local\Temp\Magic.exe'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\Magic.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\WindowsNotify.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsNotify.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Local\Temp\Magic.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000000.101919.03100000.00000004.mdmp, 00000000-00001676.00000001.103837.03100000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000000.101919.050A0000.00000004.mdmp, 00000000-00001676.00000001.103837.050A0000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000000.101919.050A0000.00000004.mdmp, 00000000-00001676.00000001.103837.050A0000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Local\Temp\Magic.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000000.101919.050A0000.00000004.mdmp, 00000000-00001676.00000001.103837.050A0000.00000004.mdmp") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000001.103837.03100000.00000004.mdmp") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000001.103837.050A0000.00000004.mdmp") Found reference string "ows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" (Indicator: "add-mppreference"; Source: "00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp"), Found reference string "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; Source: "00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp")28:T60c,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp")29:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp")2a:T563,file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Magic.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "Magic.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "Magic.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "Magic.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "Magic.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001676-00000BC0-581589707") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp")2b:Tae5,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-578428619 [PID: 7356] "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-578437801 [PID: 7356] "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-578634038 [PID: 7356] "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-578642820 [PID: 7356] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-579953539 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-579970037 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-580144759 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-580151926 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-582614417 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-582623653 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-583816851 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-583825903 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-584349481 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-584360912 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-584683732 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-584694606 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-586499740 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-588540337 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-588553614 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-589486755 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-589496326 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-591263084 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-591271923 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-592115760 [PID: 7120] "powershell.exe" queried SystemProcessInformation at 00000000-00007120-00000C15-592124351 [PID: 7120]2c:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2d:T4fa,Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001440.00000000.104419.D5C80000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001676.00000000.101919.03100000.00000004.mdmp, 00000000-00001676.00000001.103837.03100000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002404.00000000.101901.292C0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004432.00000000.105073.D43B0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00006276.00000000.104748.13A60000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00006964.00000000.104097.99E20000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007120.00000000.101839.02C30000.00000004.mdmp, 00000000-00007120.00000001.103640.02C30000.00000004.mdmp")2e:T6ca,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Command line contains long Base64-encoded string Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to perform cryptographic operations Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - PowerShell with Base64 encoding Matched sigs: YARA signature match - AES encryption2f:T1182,Found XOR loop in file "viprecwlnsau.exe" at offset 2188933; code bytes = 30040e Found XOR loop in file "viprecwlnsau.exe" at offset 2254616; code bytes = 30040e Found XOR loop in file "viprecwlnsau.exe" at offset 2967037; code bytes = 30040e Found XOR loop in file "viprecwlnsau.exe" at offset 4162412; code bytes = 30040e Found XOR loop in file "srkzdpdozbne.sys" at offset 10413; code bytes = 8030 Found XOR loop in file "srkzdpdozbne.sys" at offset 13840; code bytes = 8030 Found XOR loop in file "1232.exe" at offset 2188933; code bytes = 30040e Found XOR loop in file "1232.exe" at offset 2254616; code bytes = 30040e Found XOR loop in file "1232.exe" at offset 2967037; code bytes = 30040e Found XOR loop in file "1232.exe" at offset 4162412; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 99164; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 99548; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 107868; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 164700; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 241500; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 255836; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 493660; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 595676; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 634716; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 653660; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 735836; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 846940; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 848988; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 888028; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 900188; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 922076; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1064284; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1170396; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1232220; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1601884; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1686108; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1899484; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1912540; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2001372; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2021468; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2050012; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2192860; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2246108; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2328796; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2493020; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2516060; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2546524; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2640476; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2670300; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2677340; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2726620; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3139292; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3246812; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3376220; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3382108; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3497052; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3531356; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3814748; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 4247132; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 4279132; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 4526172; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 4671068; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 7283580; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 7509306; code bytes = 803030:T433,Found string "QueryServiceConfig2" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "EnumServicesStatusEx" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "EnumServicesStatus" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "QueryServiceStatusEx" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "QueryServiceConfig2 (delayed autostart flag)" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "QueryServiceConfig" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "QueryServiceConfig2W" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "QueryServiceConfigW" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found string "QueryServiceStatus" (Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp")31:T1d8e,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000020c36c0538cf2477cc370f038cc36c050100000080370f03cc370f0380370f03040000000400000000e00e75001000008cc36c050100000080370f03cd9724779c972477565abeddb50f057580370f0300002477000000006c1fa26f0000000080ee0b750100000000000000f8e20e75000000000400000080a9b97348400d75f8e20e7590c36c0580e8a874900b100380e8a8748cc36c050000000080e8a8740000000000000000dc9a25770000000018001a00e453207714000802b0c36c0543003a005c00570049004e0044004f0057005300000000000000000000000000ffffffff0000000000000000000000007e73130394731303 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000020c36c0538cf2477cc370f038cc36c050100000080370f03cc370f0380370f03040000000400000000e00e75001000008cc36c050100000080370f03cd9724779c972477565abeddb50f057580370f0300002477000000006c1fa26f0000000080ee0b750100000000000000f8e20e75000000000400000080a9b97348400d75f8e20e7590c36c0580e8a874900b100380e8a8748cc36c050000000080e8a8740000000000000000dc9a25770000000018001a00e453207714000802b0c36c0543003a005c00570049004e0044004f0057005300000000000000000000000000ffffffff000000000000000000000000c60d1403de0d1403 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000020c36c0538cf2477cc370f038cc36c050100000080370f03cc370f0380370f03040000000400000000e00e75001000008cc36c050100000080370f03cd9724779c972477565abeddb50f057580370f0300002477000000006c1fa26f0000000080ee0b750100000000000000f8e20e75000000000400000080a9b97348400d75f8e20e7590c36c0580e8a874900b100380e8a8748cc36c050000000080e8a8740000000000000000dc9a25770000000018001a00e453207714000802b0c36c0543003a005c00570049004e0044004f0057005300000000000000000000000000ffffffff000000000000000000000000761014038a101403 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000020c36c0538cf2477cc370f038cc36c050100000080370f03cc370f0380370f03040000000400000000e00e75001000008cc36c050100000080370f03cd9724779c972477565abeddb50f057580370f0300002477000000006c1fa26f0000000080ee0b750100000000000000f8e20e75000000000400000080a9b97348400d75f8e20e7590c36c0580e8a874900b100380e8a8748cc36c050000000080e8a8740000000000000000dc9a25770000000018001a00e453207714000802b0c36c0543003a005c00570049004e0044004f0057005300000000000000000000000000ffffffff000000000000000000000000561114036e111403 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000020c36c0538cf2477cc370f038cc36c050100000080370f03cc370f0380370f03040000000400000000e00e75001000008cc36c050100000080370f03cd9724779c972477565abeddb50f057580370f0300002477000000006c1fa26f0000000080ee0b750100000000000000f8e20e75000000000400000080a9b97348400d75f8e20e7590c36c0580e8a874900b100380e8a8748cc36c050000000080e8a8740000000000000000dc9a25770000000018001a00e453207714000802b0c36c0543003a005c00570049004e0044004f0057005300000000000000000000000000ffffffff000000000000000000000000d61b1403ec1b1403 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000020c36c0538cf2477cc370f038cc36c050100000080370f03cc370f0380370f03040000000400000000e00e75001000008cc36c050100000080370f03cd9724779c972477565abeddb50f057580370f0300002477000000006c1fa26f0000000080ee0b750100000000000000f8e20e75000000000400000080a9b97348400d75f8e20e7590c36c0580e8a874900b100380e8a8748cc36c050000000080e8a8740000000000000000dc9a25770000000018001a00e453207714000802b0c36c0543003a005c00570049004e0044004f0057005300000000000000000000000000ffffffff000000000000000000000000e61e1403fe1e1403 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000020c36c0538cf2477cc370f038cc36c050100000080370f03cc370f0380370f03040000000400000000e00e75001000008cc36c050100000080370f03cd9724779c972477565abeddb50f057580370f0300002477000000006c1fa26f0000000080ee0b750100000000000000f8e20e75000000000400000080a9b97348400d75f8e20e7590c36c0580e8a874900b100380e8a8748cc36c050000000080e8a8740000000000000000dc9a25770000000018001a00e453207714000802b0c36c0543003a005c00570049004e0044004f0057005300000000000000000000000000ffffffff000000000000000000000000662214037e221403 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000f030200000002000000e0f20a740c331303e0f20a740c331303e8ea6c05fbf20a7400000f0300000000a8fe100308eb6c05ea28aa74ff28aa74a8fe10030200000064eb6c052938aa74a8fe1003a0779c7402000000000000009037aa748338aa74e033aa7404eb6c058c779c7464eb6c05304ab5740000000048eb6c05e74bab74ec321303f24bab74091b92c764eb6c0564f70375e8321303a0f7aa7443004c005300490044005c007b00460033003200340045003400460039002d0038003400390036002d0034003000420032002d0041003100460046002d003900360031003700430031004300390041004600460045007d005c0049006e007300 (UID: 00000000-00007356) "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007356)32:Ta4f,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000031002c0030002c0040003500300066003200340030002c003100310036002c0034003300300030003300610030003000350063003000300035003700300030003600390030003000360065003000300036003400300030003600660030003000370037003000300037003300300030003500630030003000340064003000 (UID: 00000000-00007120) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000099008000000000000000a1140000a4d29409ee13247780000000ee132477000000000000000080000000f062287300000000c4d294095072a275000099000000000080000000f062287302000000002f2873e0d29409fb6228730100000080042973885fa47500000000610c33de10d39409b8642873f42e2873 (UID: 00000000-00007120) "Magic.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000063007400650064004400610074006100000073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e00630005000005e6d3000090a91003 (UID: 00000000-00001676) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008100) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005d271000060808f4b (UID: 00000000-00004228) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000 (UID: 00000000-00007156) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007880)33:T546,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "1232.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Magic.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Magic.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")34:T4ef,Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002404.00000000.101901.292C0000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp")35:T15d5,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007120-00000C17-582576747 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007120-00000C17-582788848 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007120-00000C17-585110213 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007120-00000C17-585640266 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00007120-00000C17-585722284 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00007120-00000C17-585744952 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007120-00000C17-585839831 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007120-00000C17-585840048 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00007120-00000C17-587035227 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007120-00000C17-587835117 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007120-00000C17-587852919 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007120-00000C17-587853161 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007120-00000C17-588857204 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007120-00000C17-590687581 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007120-00000C17-591406997 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007120-00000C17-591562929 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007120-00000C17-591768190 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007120-00000C17-591849940 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00007120-00000C17-591978114 "powershell.exe" queries volume information of "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00007120-00000C17-592096842 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007120-00000C17-592439228 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007120-00000C17-592455503 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007120-00000C17-592455789 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.16299.15.cat" at 00000000-00007120-00000C17-593185823 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007120-00000C17-59339819336:T452,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1232.EXE") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MAGIC.EXE") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "Magic.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "Magic.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "Magic.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH")37:T52a,Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp")38:T60d,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAdwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlA" - (UID: 00000000-00007356), "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "CreateProcessW" with parameter ""%TEMP%\1232.exe"" - (UID: 00000000-00007356), "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" called "CreateProcessW" with parameter ""%TEMP%\Magic.exe"" - (UID: 00000000-00007356), "Magic.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPU" - (UID: 00000000-00001676), "Magic.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" - (UID: 00000000-00001676), "Magic.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\FqLB" - (UID: 00000000-00001676), "Magic.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsNot" - (UID: 00000000-00001676), "cmd.exe" called "CreateProcessW" with parameter "wusa /uninstall /kb:890830 /quiet /norestart" - (UID: 00000000-00001364)39:Tf0ea,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007120) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007120) "Magic.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001676) "Magic.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001676) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00008100) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004228) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007156) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007880) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004392) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004392)3a:T7ded,Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "IoDeleteSymbolicLink"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "IofCompleteRequest"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "IoCreateSymbolicLink"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "MmMapIoSpace"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "KeBugCheckEx"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "MmUnmapIoSpace"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "IoDeleteDevice"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "IoCreateDevice"; File: "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe") Found reference to API (Indicator: "OpenService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusEx"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatus"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ControlServiceEx"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "EnumDependentServices"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceObjectSecurity"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptor"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "SetServiceObjectSecurity"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "UuidEqual"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00001440.00000000.104419.DB44B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "CreateMutex"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "00000000-00001676.00000000.101919.00BA2000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001676.00000000.101919.050A0000.00000004.mdmp, 00000000-00001676.00000001.103837.050A0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002404.00000000.101901.D478B000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004228.00000001.103762.D228A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007120.00000000.101839.009F1000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007120.00000001.103640.009E1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007120.00000001.103640.009E1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007120.00000001.103640.009E1000.00000020.mdmp")3b:T1b35,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 20333-159-009ED560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 20333-194-009E8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 20333-194-009E8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 20333-194-009E8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 20333-196-009EBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 20333-207-009E8AF0 "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001676.00000000.101919.03100000.00000004.mdmp 00000000-00001676.00000001.103837.03100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001676.00000000.101919.03100000.00000004.mdmp 00000000-00001676.00000001.103837.03100000.00000004.mdmp "e\Software\C" in Source: 00000000-00001676.00000000.101919.03100000.00000004.mdmp 00000000-00001676.00000001.103837.03100000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "Software\" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "Software\A47B639D69EDB7A5A47D" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.03100000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{00" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "\Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp ",4940,6,lpCommandLine,1,1,0,@1e5dd5a0,326,220043003a005c00570069006e0064006f00770073005c00530079007300740065006d00330032005c00570069006e0064006f007700730050006f007700650072005300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500220020002d0045007800650063007500740069006f006e0050006f006c006900630079002000420079\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "\Machine\Software\Classes\Applications\%1.e2" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004228.00000000.102898.4D880000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004228.00000000.102898.4D880000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp3c:Tbea,Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7356:168:WilStaging_02" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7356:64:WilError_01" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "Local\SM0:7356:64:WilError_01" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "Local\SM0:7356:168:WilStaging_02" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "SM0:7356:168:WilStaging_02" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "SM0:7356:64:WilError_01" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "Local\ZonesCacheCounterMutex" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7356:168:WilStaging_02" Process 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7356:64:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7120:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:7120:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "SM0:7120:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7120:64:WilError_01" Process powershell.exe created mutex with name "SM0:7120:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7120:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7120:168:WilStaging_02"3d:T67c,Process "powershell.exe" with commandline "-EncodedCommand "PAAjAHkAdwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAeQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAdwB4ACMAPgA="" (UID: 00000000-00007120) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\\Magic.exe'" (UID: 00000000-00008100) Process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (UID: 00000000-00004228) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" (UID: 00000000-00007156) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\WindowsNotify.exe'" (UID: 00000000-00007880) Process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsNotify.exe'" (UID: 00000000-00004392) Process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (UID: 00000000-00003128) Process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (UID: 00000000-00005892) Process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (UID: 00000000-00001660)3e:T229c,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "Magic.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Magic.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Magic.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "Magic.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Magic.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "Magic.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]3f:T507c,"REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001676.00000000.101919.03100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001676.00000000.101919.03100000.00000004.mdmp "e\Software\C" in Source: 00000000-00001676.00000000.101919.03100000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp "Software\" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp "Software\A47B639D69EDB7A5A47D" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001676.00000000.101919.050A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{00" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "\Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp ",4940,6,lpCommandLine,1,1,0,@1e5dd5a0,326,220043003a005c00570069006e0064006f00770073005c00530079007300740065006d00330032005c00570069006e0064006f007700730050006f007700650072005300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500220020002d0045007800650063007500740069006f006e0050006f006c006900630079002000420079\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000000.101919.1E5C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001676.00000001.103837.03100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001676.00000001.103837.03100000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001676.00000001.103837.03100000.00000004.mdmp "e\Software\C" in Source: 00000000-00001676.00000001.103837.03100000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "Software\" in Source: 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "Software\A47B639D69EDB7A5A47D" in Source: 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001676.00000001.103837.050A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{00" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "\Machine\Software\Classes\Applications\%1.e2" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "\Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001676.00000001.103837.1E5C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004228.00000000.102898.4B8E0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004228.00000000.102898.4D880000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004228.00000000.102898.4D880000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004228.00000001.103762.D228A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007120.00000001.103640.009E1000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007120.00000001.103640.02C50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007120.00000001.103640.02C50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00007120.00000001.103640.02C50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00007120.00000001.103640.02C50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00007120.00000001.103640.02C50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00007120.00000001.103640.02C50000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00007120.00000001.103640.02C50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007120.00000001.103640.07252000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007156.00000000.103706.CD650000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007156.00000000.103706.CD650000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007156.00000000.103706.CD650000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007156.00000000.103706.E77A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007156.00000001.104365.CD650000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007156.00000001.104365.CD650000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007156.00000001.104365.CD650000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007156.00000001.104365.E77A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007156.00000001.104365.E8470000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00007156.00000001.104365.E8470000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007156.00000001.104365.E8470000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007156.00000001.104365.E8470000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00007156.00000001.104365.E8470000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00007156.00000001.104365.E8470000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00007156.00000001.104365.E8470000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007156.00000001.104365.E84E5000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007156.00000001.104365.E84E5000.00000004.mdmp "Software\Classes\PackagedCom" in Source: 00000000-00007156.00000001.104365.E84E5000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00007156.00000001.104365.E84E5000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00007156.00000001.104365.E84E5000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00007156.00000001.104365.E84E5000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00007156.00000001.104365.E8599000.00000004.mdmp "ProgramF\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007156.00000001.104365.E8605000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007156.00000001.104365.E860D000.00000004.mdmp "ripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0C9281F9-6DA1-4006-872" in Source: 00000000-00007356.00000000.101753.030F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007356.00000000.101753.030F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007356.00000000.101753.030F0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007356.00000000.101753.030F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00007356.00000000.101753.030F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007880.00000000.104691.E6F68000.00000002.mdmp "HKLM\" in Source: 00000000-00007880.00000000.104691.E6F68000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007880.00000000.104691.E6F68000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007880.00000000.104691.E6F68000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00007880.00000000.104691.E6F68000.00000002.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007880.00000000.104691.F1FF0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007880.00000000.104691.F1FF0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007880.00000000.104691.F1FF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007880.00000000.104691.F4500000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007880.00000000.104691.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00007880.00000000.104691.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007880.00000000.104691.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007880.00000000.104691.F52C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007880.00000000.104691.F5332000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00007880.00000000.104691.F5332000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007880.00000000.104691.F5332000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007880.00000001.105186.F1FF0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007880.00000001.105186.F1FF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007880.00000001.105186.F4500000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}" in Source: 00000000-00007880.00000001.105186.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007880.00000001.105186.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00007880.00000001.105186.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00007880.00000001.105186.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007880.00000001.105186.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00007880.00000001.105186.F52C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007880.00000001.105186.F52C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007880.00000001.105186.F5332000.00000004.mdmp "gistry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00007880.00000001.105186.F5332000.00000004.mdmp "\Software\C." in Source: 00000000-00007880.00000001.105186.F544F000.00000004.mdmp "istry\Machine\Software\Clas&" in Source: 00000000-00007880.00000001.105186.F544F000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00007880.00000001.105186.F544F000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007880.00000001.105186.F544F000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008100.00000000.102101.727D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008100.00000000.102101.727D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008100.00000000.102101.727D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008100.00000000.102101.74B40000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008100.00000001.103370.727D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008100.00000001.103370.727D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008100.00000001.103370.727D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008100.00000001.103370.74B40000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp "PDATA=C:\Users\FqLBH\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp "ProgramF\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}JD\Documents" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00008100.00000001.103370.75930000.00000004.mdmp40:T5e1f,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739e0000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "KERNEL32.DLL" at base 74880000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73960000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "RPCRT4.DLL" at base 75920000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73500000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74970000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "NTDLL.DLL" at base 77200000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 737e0000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "SHELL32.DLL" at base 75dc0000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74880000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "USER32.DLL" at base 75170000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72fd0000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75dc0000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73280000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "MSISO.DLL" at base 72f70000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "SSPICLI.DLL" at base 73c20000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74f40000 "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74880000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 77120000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f40000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f40000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72e60000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75120000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 73f30000 "powershell.exe" loaded module "VERSION.DLL" at base 72e50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 726a0000 "powershell.exe" loaded module "USER32.DLL" at base 75170000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74f40000 "powershell.exe" loaded module "MSCOREE.DLL" at base 72ef0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 73fc0000 "powershell.exe" loaded module "PSAPI.DLL" at base 74870000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75920000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 711c0000 "powershell.exe" loaded module "OLE32.DLL" at base 754a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 73fc0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75ae0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 747f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74f40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 706a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fe80000 "powershell.exe" loaded module "COMBASE.DLL" at base 73fc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 73fc0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77200000 "powershell.exe" loaded module "SHELL32.DLL" at base 75dc0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74210000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 73d40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f700000 "powershell.exe" loaded module "CRYPT32.DLL" at base 73d40000 "powershell.exe" loaded module "AMSI.DLL" at base 73be0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 72e50000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 73b90000 "powershell.exe" loaded module "KERNEL32" at base 74880000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\TBPMQSBN.DLL" at base 739a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 73920000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 735c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 73fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 73570000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 73340000 "powershell.exe" loaded module "SECUR32.DLL" at base 73b80000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73c20000 "powershell.exe" loaded module "WLDP.DLL" at base 73550000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 734d0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 732a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74880000 "powershell.exe" loaded module "USERENV.DLL" at base 73bb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77120000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 73b70000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 73280000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74880000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 73250000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 73470000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6f480000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6f480000 "powershell.exe" loaded module "URLMON.DLL" at base 72f70000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74f40000 "powershell.exe" loaded module "MSISO.DLL" at base 6f3e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6f1b0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 73450000 "powershell.exe" loaded module "OLEAUT32" at base 75ae0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 74f40000 "powershell.exe" loaded module "MSVCRT.DLL" at base 759e0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6eed0000 "powershell.exe" loaded module "MI.DLL" at base 6eeb0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 74f40000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6ee20000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74f40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ee00000 "powershell.exe" loaded module "GDI32.DLL" at base 75860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ed80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ecc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74f40000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74f40000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 74880000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 74f40000 "1232.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffffd090000 "Magic.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffffd090000 "Magic.exe" loaded module "ADVAPI32.DLL" at base 7ff80f740000 "Magic.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff80c490000 "Magic.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff80c490000 "Magic.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff80c490000 "Magic.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffed170000 "Magic.exe" loaded module "SHLWAPI.DLL" at base 7ff80f2b0000 "Magic.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff80c050000 "Magic.exe" loaded module "VERSION.DLL" at base 7ff803e90000 "Magic.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffdcf40000 "Magic.exe" loaded module "USER32.DLL" at base 7ff80f4b0000 "Magic.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff80c490000 "Magic.exe" loaded module "MSCOREE.DLL" at base 7ffffdf10000 "Magic.exe" loaded module "NTDLL" at base 7ff80fc70000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff80d630000 "Magic.exe" loaded module "PSAPI.DLL" at base 4e00000 "Magic.exe" loaded module "RPCRT4.DLL" at base 7ff80d270000 "Magic.exe" loaded module "KERNEL32.DLL" at base 7ff80d140000 "Magic.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffdb940000 "Magic.exe" loaded module "OLE32.DLL" at base 7ff80d940000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff80a600000 "Magic.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff80d630000 "Magic.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff80c490000 "Magic.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffed440000 "Magic.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffdacd0000 "Magic.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffda250000 "Magic.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7fffe5fb0000 "Magic.exe" loaded module "SSPICLI.DLL" at base 7ff80bec0000 "Magic.exe" loaded module "BCRYPT.DLL" at base 7ff80bb20000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff80b460000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff80c8d0000 "Magic.exe" loaded module "SHELL32.DLL" at base 7ff80dc40000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff806690000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 1d970000 "Magic.exe" loaded module "NTDLL.DLL" at base 7ff80fc70000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff808640000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffffe100000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ff80dc40000 "Magic.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff801a10000 "Magic.exe" loaded module "MSISO.DLL" at base 7ffff9780000 "Magic.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffffd090000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff80f740000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff80c490000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff80c490000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff80c490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffed170000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff80f2b0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff80c050000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff803e90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffdcf40000 "powershell.exe" loaded module "USER32.DLL" at base 7ff80f4b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffffdf10000 "powershell.exe" loaded module "NTDLL" at base 7ff80fc70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff80d630000 "powershell.exe" loaded module "PSAPI.DLL" at base 1ce72960000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff80d270000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff80d140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffdb940000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff80d940000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff80d630000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff80d4e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffdacd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffda250000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffffcfe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff80b460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff80c8d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fffd81e0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff80d630000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff80d630000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff80fc70000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff80dc40000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff80c430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff80c430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff80c700000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff800fb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff803e90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff800f90000 "powershell.exe" loaded module "KERNEL32" at base 7ff80d140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\TBPMQSBN.DLL" at base 7fffed3f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fffed350000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fffd8070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fffd7f00000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff80c700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fffd7650000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fffecf90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fffd6ce0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fffd6970000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffed440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fffe9ce0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffe5e70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fffd6890000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fffd6840000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff803370000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff80bec0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff80b0b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff80a600000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fffd6760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff80d140000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff80bef0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff80f740000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff80d630000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff80bb20000 "powershell.exe" loaded module "OLEAUT32" at base 7ff80d4e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7fffd6520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7fffd6470000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff80f6a0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffffdd40000 "powershell.exe" loaded module "MI.DLL" at base 7ff804560000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff8044d0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff80f1f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8028a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff800550000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff800090000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff80d140000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "PSAPI.DLL" at base 24c4d330000 "powershell.exe" loaded module "PSAPI.DLL" at base 21ccd7e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff80c490000 "powershell.exe" loaded module "MSISO.DLL" at base 7ffff9780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7fffd5c30000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffffd090000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffffd090000 "sc.exe" loaded module "RPCRT4.DLL" at base 7ff80d270000 "powershell.exe" loaded module "PSAPI.DLL" at base 20df3bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fffe7de0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fffe7470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fffe7100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fffecff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fffec760000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffe6fc0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fffe6ee0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7fffe5ef0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7fffd74d0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff804bb000041:T217e,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "Magic.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "Magic.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "Magic.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER")42:T85e,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 8,nop ,mov eax, 4,push eax,mov eax, 0,push eax,lea eax, [ebp - 4],push eax,call 0x4015f8,add esp, 0xc,mov eax, 0x4014af,push eax,call 0x401640,mov eax, 1,push eax,call 0x401648,add esp, 4,mov eax, 0x30000,push eax,mov eax, 0x10000,push eax,call 0x401650,add esp, 8,mov eax, dword ptr [0xb26e14],mov ecx, dword ptr [0xb26e18],mov edx, dword ptr [0xb26e1c],mov dword ptr [ebp - 8], eax," "Magic.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "srkzdpdozbne.sys" file has an entrypoint instructions - "mov rax, qword ptr [rip - 0x1f0f],movabs r9, 0x2b992ddfa232,test rax, rax,je 0x15023,cmp rax, r9,jne 0x15052,lea r8, [rip - 0x1f2a],movabs rax, 0xfffff78000000320,mov rax, qword ptr [rax],xor rax, r8,movabs r8, 0xffffffffffff,and rax, r8,cmove rax, r9,mov qword ptr [rip - 0x1f52], rax,not rax,mov qword ptr [rip - 0x1f54], rax,jmp 0x11008,int3 ,int3 ,int3 ,mov eax, 0x50,add byte ptr [rax], al,"43:T695,Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00007356-00000BC0-579370615] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00007356-00000C47-2292571430] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAdwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlA" [Source: 00000000-00007356-00000C47-2292571430], Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00002404-00000BC0-614570402], Observed system executable string:"%WINDIR%\System32\sc.exe" [Source: 00000000-00002404-00000BC0-619707473], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPU" [Source: 00000000-00001676-00000C47-6194565150], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'" [Source: 00000000-00001676-00000C47-66314356851], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\FqLB" [Source: 00000000-00001676-00000C47-103362897991], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsNot" [Source: 00000000-00001676-00000C47-134162336614], Observed system executable string:"%WINDIR%\system32\wusa.exe" [Source: 00000000-00001364-00000C47-1391969862]44:T589,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "Magic.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Magic.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Magic.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")45:T11ce,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll",03,"Microsoft.VisualBasic Version=10.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll",0" [Source: WindowsNotify.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007120-00000C2B-580501890] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007120-00000C2B-581040028] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007120-00000C2B-581279905] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007120-00000C2B-581361644] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007120-00000C2B-581812552] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007120-00000C2B-581851878] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007120-00000C2B-581889573] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007120-00000C2B-581951223] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007120-00000C2B-582739799] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007120-00000C2B-582758654] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007120-00000C2B-583127974] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007120-00000C2B-583210093] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007120-00000C2B-583349433] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007120-00000C2B-583486963] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007120-00000C2B-583711559] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007120-00000C2B-583804970] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007120-00000C2B-584286122] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007120-00000C2B-584642883] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00007120-00000C2B-584821246] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007120-00000C2B-585127234] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007120-00000C2B-585179610] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007120-00000C2B-585208595] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00007120-00000C2B-585247815] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00007120-00000C2B-585272331]46:Tad9,Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAHkAdwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGU ..." (UID: 00000000-00007120, Additional Context: "<#ywu#>Add-MpPreference <#rvn#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#xyl#> -Force <#dwx#>"), Spawned process "1232.exe" (UID: 00000000-00002404), Spawned process "Magic.exe" (UID: 00000000-00001676), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\ ..." (UID: 00000000-00008100), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00004228), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magi ..." (UID: 00000000-00007156), Spawned process "cmd.exe" with commandline "/c wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00001364), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00006964), Spawned process "wusa.exe" with commandline "wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00004100), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00001440), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDAT ..." (UID: 00000000-00007880), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00006276), Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00004432), Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00007948), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Wind ..." (UID: 00000000-00004392), Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00004724), Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00007548), Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00001976), Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00004620), Spawned process "dialer.exe" (UID: 00000000-00003300), Spawned process "sc.exe" with commandline "delete "UVDZCQJN"" (UID: 00000000-00004464), Spawned process "sc.exe" with commandline "create "UVDZCQJN" binpath= "%ALLUSERSPROFILE%\\szaauatzvxbi\\vip ..." (UID: 00000000-00002624) Spawned process "sc.exe" with commandline "start "UVDZCQJN"" (UID: 00000000-00003784) Spawned process "sc.exe" with commandline "stop eventlog" (UID: 00000000-00002412) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00003128)47:Tad9,Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAHkAdwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGU ..." (UID: 00000000-00007120, Additional Context: "<#ywu#>Add-MpPreference <#rvn#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#xyl#> -Force <#dwx#>"), Spawned process "1232.exe" (UID: 00000000-00002404), Spawned process "Magic.exe" (UID: 00000000-00001676), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\ ..." (UID: 00000000-00008100), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00004228), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magi ..." (UID: 00000000-00007156), Spawned process "cmd.exe" with commandline "/c wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00001364), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00006964), Spawned process "wusa.exe" with commandline "wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00004100), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00001440), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDAT ..." (UID: 00000000-00007880), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00006276), Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00004432), Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00007948), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Wind ..." (UID: 00000000-00004392), Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00004724), Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00007548), Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00001976), Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00004620), Spawned process "dialer.exe" (UID: 00000000-00003300), Spawned process "sc.exe" with commandline "delete "UVDZCQJN"" (UID: 00000000-00004464), Spawned process "sc.exe" with commandline "create "UVDZCQJN" binpath= "%ALLUSERSPROFILE%\\szaauatzvxbi\\vip ..." (UID: 00000000-00002624) Spawned process "sc.exe" with commandline "start "UVDZCQJN"" (UID: 00000000-00003784) Spawned process "sc.exe" with commandline "stop eventlog" (UID: 00000000-00002412) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00003128)48:T424,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\1232.exe" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Magic.exe" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ju2cjdj4.5nv.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_wfy0xm3u.oog.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_j1b3ivc0.xrp.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vg2xynwj.lwm.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_a4gy0rv5.oyq.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dyl03bwc.qvj.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_pgbcvbrg.ewu.ps1"49:T76e,"viprecwlnsau.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "Magic.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\Magic.exe]- [targetUID: 00000000-00001676] "powershell.exe.log" has type "CSV ASCII text"- [targetUID: 00000000-00008100] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: 00000000-00008100] "WindowsNotify.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID vy9ybqudk5l2k3h KnownFolderID 3EB685DB-65F9-4CF6-A03A-E3EF65729F3D Archive ctime=Thu Oct 8 16:27:12 2026 atime=Thu Oct 8 16:27:12 2026 mtime=Thu Oct 8 16:27:12 2026 length=36864 window=normal IDListSize 0x0219 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Users\FqLBHJD\AppData\Roaming\WindowsNotify.exe""- [targetUID: N/A] "WindowsNotify.exe.log" has type "CSV ASCII text"- [targetUID: N/A] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00007120] "ModuleAnalysisCache" has type "data"- [targetUID: 00000000-00007120] "srkzdpdozbne.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 6 sections"- [targetUID: N/A] "StartupProfileData-NonInteractive" has type "data"- [targetUID: 00000000-00007120] "1232.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\1232.exe]- [targetUID: 00000000-00002404] "WindowsNotify.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007120]4a:T7a9,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")4b:Te5c,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "3F790D1FC0BAE05463F75C5C2FDA33B7616230A361630DA56E87F7CF26E5FD89.EXE"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")4c:T4a1,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"4d:T504,"powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1"4e:Ta6e,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\FLTLIB.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\MSVCP140.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\MSVCP140.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\PROPSYS.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\PROPSYS.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\CLDAPI.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\CLDAPI.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\AEPIC.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\AEPIC.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\BCRYPT.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\bcrypt.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\edputil.dll" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\URLMON.DLL"4f:Tc09,"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\1232.exe:ZONE.IDENTIFIER" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\1232.exe:Zone.Identifier" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Magic.exe:ZONE.IDENTIFIER" "3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Magic.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.PB378EC07#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\MICROSOFT.POWERSHELL.CONSOLEHOST.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.MANAA57FC8CC#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\SYSTEM.MANAGEMENT.AUTOMATION.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSREADLINE" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSReadline" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.NUMERICS"50:T4d1,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveBufferSize" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendBufferSize" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginSend" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndSend" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Shutdown" in "Magic.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "Magic.exe"51:T1605,Heuristic match: "8t.mo" Pattern match: "v.sm/&bw%" Heuristic match: "2!6#ej.tf" Heuristic match: "-i.gp" Heuristic match: "9iqmgvw,czcthawte," - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsyleo" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4s9_>o10.3.6" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004228.00000000.102898.4D880000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004228.00000000.102898.668A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004228.00000000.102898.668A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004228.00000000.102898.668A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0qr19.yqrjyqrcyqrvyqrqxqraxqrpxqrawqrwqr" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e%wvfglobalsign" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00007120.00000001.103640.02C50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007120.00000001.103640.07252000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007120.00000001.103640.07252000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007120.00000001.103640.07252000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0osoft" - Source: "00000000-00007120.00000001.103640.085B4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czco!yj1.3.132.0.34ecdpdecdthawte," - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02eris>pkcs1.2.840.10045.4.3.31.3.6.1.5.5.7.1.122.16.840.1.113730.1.13system.management.dllsystem.xml.dllsystem.xml.dll1.3.6.1.4.1.311.10.3.42" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsencd2or" - Source: "00000000-00007156.00000000.103706.E77A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007156.00000000.103706.E8470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00007156.00000000.103706.E84E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>(e?2rsa1e4ilxa" - Source: "00000000-00007156.00000000.103706.E84E5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0]db" - Source: "00000000-00007156.00000000.103706.E84E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007156.00000000.103706.E84E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007156.00000000.103706.E84E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007156.00000000.103706.E84E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://wsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007156.00000000.103706.E84E5000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00007156.00000000.103706.E86B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007156.00000000.103706.E86B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00007156.00000000.103706.E86B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt03064-6ft" - Source: "00000000-00007156.00000000.103706.E86B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1jubl20170929084817.684z0washington1redmond1microsoft" - Source: "00000000-00007156.00000000.103706.E86B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007156.00000000.103706.E86B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007156.00000000.103706.E86B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhej??w" - Source: "00000000-00007156.00000001.104365.CD650000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj1.3.132.0.34ecdpdecdthawte," - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02eris>pkcs1.2.840.10045.4.3.31.3.6.1.5.5.7.1.122.16.840.1.113730.1.13system.management.dllsystem.xml.dllsystem.xml.dll1.3.6.1.4.1.311.10.3.42" - Source: "00000000-00007156.00000001.104365.E77A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007156.00000001.104365.E77C1000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00007156.00000001.104365.E77C1000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007156.00000001.104365.E77C1000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007156.00000001.104365.E77C1000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007156.00000001.104365.E77C1000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007156.00000001.104365.E782B000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007156.00000001.104365.E782B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007156.00000001.104365.E8470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!verstral," - Source: "00000000-00007156.00000001.104365.E8470000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00007156.00000001.104365.E8599000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007156.00000001.104365.E86D9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00007880.00000000.104691.00FC2000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007880.00000000.104691.E6F68000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007880.00000000.104691.E6F68000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007880.00000000.104691.E6F68000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcthawte," - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@sg" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsanonymously" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com/windows$u=%-u$%orpo0," - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4s9_>=des=c:\winfa7ejt" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007880.00000000.104691.F4500000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00007880.00000000.104691.F51C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" - Source: "00000000-00007880.00000000.104691.F51C0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00007880.00000000.104691.F51C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007880.00000000.104691.F51C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcthawte," - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@sg" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007880.00000001.105186.F4500000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsanonymously" - Source: "00000000-00007880.00000001.105186.F458A000.00000004.mdmp") Found URL "http://www.microsoft.com/windows$u=%-u$%orpo" - Source: "00000000-00007880.00000001.105186.F458A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4s9_>=des=c:\winfa7ejt" - Source: "00000000-00007880.00000001.105186.F458A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007880.00000001.105186.F458A000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00007880.00000001.105186.F51EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007880.00000001.105186.F51EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmn9iqmgvw,czcdigicert" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%y2.5.29.1bhv*8tpaerver" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.v" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20gcmqc;washington1redmond1microsoft" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpq3tl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hh0t3tt$hl" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://cpdf0cation" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4bsjbv4.0.30319" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microocerf23.c/wwwp.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008100.00000000.102101.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00008100.00000000.102101.75830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008100.00000000.102101.75830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008100.00000000.102101.75830000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00008100.00000001.103370.00FA2000.00000002.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00008100.00000001.103370.10000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00008100.00000001.103370.10000000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn9iqmgvw,czcdigicert" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;0]" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.v" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20gcmqc;washington1redmond1microsoft" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpq3tl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hh0t3t" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://cpdf0cation" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008100.00000001.103370.74B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4p" - Source: "00000000-00008100.00000001.103370.74BB6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008100.00000001.103370.74BB6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microocerf23.c/wwwp.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008100.00000001.103370.74BB6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrgton1microsoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00008100.00000001.103370.75930000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr!'t/woka" - Source: "00000000-00008100.00000001.103370.75930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrAdd-MpPreference <#rvn#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#xyl#> -Force <#dwx#>\")","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe\" has resource with unusual entropy \"RT_ICON:7.990637964828973\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"viprecwlnsau.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- [targetUID: N/A]\n \"Magic.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\Magic.exe]- [targetUID: 00000000-00001676]\n \"srkzdpdozbne.sys\" has type \"PE32+ executable for MS Windows 6.00 (native) x86-64 6 sections\"- [targetUID: N/A]\n \"1232.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\1232.exe]- [targetUID: 00000000-00002404]\n \"WindowsNotify.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe\" wrote 45056 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1232.exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000006872ff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0800 ...\n \"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe\" wrote 36864 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Magic.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 64.188.67.232 on port 8080 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%TEMP%\\Magic.exe\" connects to 64.188.67.232 on port 8080 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 64.188.67.232 on port 8080","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ju2cjdj4.5nv.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_wfy0xm3u.oog.psm1\" for deletion\n \"1232.exe\" marked \"C:\\Windows\\System32\\MRT.exe\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_j1b3ivc0.xrp.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vg2xynwj.lwm.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a4gy0rv5.oyq.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_dyl03bwc.qvj.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ju2cjdj4.5nv.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_wfy0xm3u.oog.psm1\" with delete access\n \"1232.exe\" opened \"C:\\Windows\\System32\\MRT.exe\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_j1b3ivc0.xrp.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vg2xynwj.lwm.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a4gy0rv5.oyq.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_dyl03bwc.qvj.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"Magic.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Magic.exe\" claimed CRC 7563900 while the actual is CRC 78362","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"$5d","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"16/24 Antivirus vendors marked dropped file \"WindowsNotify.exe\" as malicious (classified as \"MSIL.Agent\" with 66% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"16/24 Antivirus vendors marked spawned process \"Magic.exe\" (PID: 1676) as malicious (classified as \"MSIL.Agent\" with 66% detection rate)\n 16/24 Antivirus vendors marked spawned process \"WindowsNotify.exe\" (PID: 4476) as malicious (classified as \"MSIL.Agent\" with 66% detection rate)\n 16/24 Antivirus vendors marked spawned process \"WindowsNotify.exe\" (PID: 7608) as malicious (classified as \"MSIL.Agent\" with 66% detection rate)\n 16/24 Antivirus vendors marked spawned process \"WindowsNotify.exe\" (PID: 6116) as malicious (classified as \"MSIL.Agent\" with 66% detection rate)\n 16/24 Antivirus vendors marked spawned process \"WindowsNotify.exe\" (PID: 7680) as malicious (classified as \"MSIL.Agent\" with 66% detection rate)\n 16/24 Antivirus vendors marked spawned process \"WindowsNotify.exe\" (PID: 5468) as malicious (classified as \"MSIL.Agent\" with 66% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"Installation/Persistence","name":"Injects into remote processes","description":"$5e","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00001676\" as \"Detects AsyncRAT\"\n YARA signature \"MALWARE_Win_AsyncRAT\" matched file \"Magic.exe\" as \"Detects AsyncRAT\"\n YARA signature \"MALWARE_Win_XWorm\" matched file \"Magic.exe\" as \"Detects XWorm\"\n YARA signature \"MALWARE_Win_AsyncRAT\" matched file \"WindowsNotify.exe\" as \"Detects AsyncRAT\"\n YARA signature \"MALWARE_Win_XWorm\" matched file \"WindowsNotify.exe\" as \"Detects XWorm\"\n YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00007356\" as \"Detects AsyncRAT\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\\\\Magic.exe'\" (UID: 00000000-00008100)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'\" (UID: 00000000-00007156)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\\\WindowsNotify.exe'\" (UID: 00000000-00007880)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsNotify.exe'\" (UID: 00000000-00004392)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"System Security","name":"Starts service using SC.exe","description":"Process \"sc.exe\" with commandline \"start \"UVDZCQJN\"\" (UID: 00000000-00003784)","origin":"Monitored Target","mitre_attack_id":"T1569.002","relevance":10,"id":"target-303","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"System Security","name":"Stops or deletes service using sc.exe","description":"$60","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-150","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$61","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Injects into remote processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Stops or deletes service using sc.exe"}],"sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"References security-related Windows services"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]}],"intel_graph":{"map":{"Adversary:0a25b12bfa46d37b75a898a5bd6f07f1b69d7ad0db481781cdd119236850ef92":{"type":"Adversary","value":"PLUMP SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300":{"type":"Adversary","value":"BLIND SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"File:11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5":{"type":"File","value":"11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"},"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89":{"type":"File","value":"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LXDropper","Detected relationship with a Threat Xworm","Match on yara rule CrowdStrike_Xworm_03","confirmed malicious file","confirmed relationship with a Threat LXDropper","confirmed relationship with an Adversary BLIND SPIDER","confirmed relationship with an Adversary PLUMP SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:8a009043a4d93dcfd86793378ff3e854ac30bcea646145abc8fa0ffd8969c393":{"type":"File","value":"8a009043a4d93dcfd86793378ff3e854ac30bcea646145abc8fa0ffd8969c393"},"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537":{"type":"File","value":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Xworm","Match on yara rule CrowdStrike_Xworm_03","confirmed relationship with an Adversary BLIND SPIDER","confirmed relationship with an Adversary PLUMP SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:a23fe432a4e05a3dd928afb473446c0c0c79b28786df6b786e8d0bfc530d1c6a":{"type":"File","value":"a23fe432a4e05a3dd928afb473446c0c0c79b28786df6b786e8d0bfc530d1c6a"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd":{"type":"File","value":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},"File:cd2f64f49991708cc57bf47f03ad57a90d26440030339cfc435ec6687b233a48":{"type":"File","value":"cd2f64f49991708cc57bf47f03ad57a90d26440030339cfc435ec6687b233a48"},"File:cdc2fe5839395e09c6f0195a23df86c991b6f407dc7a13b8ddcacabdfcd8214d":{"type":"File","value":"cdc2fe5839395e09c6f0195a23df86c991b6f407dc7a13b8ddcacabdfcd8214d"},"Ip:64.188.67.232":{"type":"Ip","value":"64.188.67.232"},"Threat:2b711a7954461abe73161fadbfa0c5947692a682d3a17d4234950b56f44143bc":{"type":"Threat","value":"Xworm","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Xworm","confirmed relationship with an Adversary BLIND SPIDER","confirmed relationship with an Adversary PLUMP SPIDER"]}},"Threat:461df973eddd981fa200dc8531fea6104650ef0cd905bcd588990ea6dc98a0b4":{"type":"Threat","value":"LXDropper","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected relationship with a Threat LXDropper"]}},"Url:29fde0170469dd2b4d5e3c5bc5fd4b5e0bc6e420566d850e0ed93887f534edac":{"type":"Url","value":"unspec://64.188.67.232:8080","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1557779779937580204","root":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","edges":[],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LXDropper","Detected relationship with a Threat Xworm","Match on yara rule CrowdStrike_Xworm_03","confirmed malicious file","confirmed relationship with a Threat LXDropper","confirmed relationship with an Adversary BLIND SPIDER","confirmed relationship with an Adversary PLUMP SPIDER"]}},{"id":"1557779793347760342","root":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","edges":[{"edge_kind":"is_threat","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"Threat:461df973eddd981fa200dc8531fea6104650ef0cd905bcd588990ea6dc98a0b4"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1557779789908444494","root":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","edges":[{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537"},{"edge_kind":"is_threat","from_key":"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","to_key":"Threat:2b711a7954461abe73161fadbfa0c5947692a682d3a17d4234950b56f44143bc"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with an Adversary BLIND SPIDER","confirmed relationship with an Adversary PLUMP SPIDER"]}},{"id":"1557779783723481234","root":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","edges":[{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537"},{"edge_kind":"contains_c2_config","from_key":"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","to_key":"Url:29fde0170469dd2b4d5e3c5bc5fd4b5e0bc6e420566d850e0ed93887f534edac"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1557779787168560324","root":"Threat:2b711a7954461abe73161fadbfa0c5947692a682d3a17d4234950b56f44143bc","edges":[{"edge_kind":"used_by","from_key":"Threat:2b711a7954461abe73161fadbfa0c5947692a682d3a17d4234950b56f44143bc","to_key":"Adversary:0a25b12bfa46d37b75a898a5bd6f07f1b69d7ad0db481781cdd119236850ef92"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1557779787164366018","root":"Threat:2b711a7954461abe73161fadbfa0c5947692a682d3a17d4234950b56f44143bc","edges":[{"edge_kind":"used_by","from_key":"Threat:2b711a7954461abe73161fadbfa0c5947692a682d3a17d4234950b56f44143bc","to_key":"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1557779787168560323","root":"Threat:2b711a7954461abe73161fadbfa0c5947692a682d3a17d4234950b56f44143bc","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","edges":[{"edge_kind":"contacted_ip","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"Ip:64.188.67.232"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","edges":[{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:cd2f64f49991708cc57bf47f03ad57a90d26440030339cfc435ec6687b233a48"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:a23fe432a4e05a3dd928afb473446c0c0c79b28786df6b786e8d0bfc530d1c6a"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:cd2f64f49991708cc57bf47f03ad57a90d26440030339cfc435ec6687b233a48"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:8a009043a4d93dcfd86793378ff3e854ac30bcea646145abc8fa0ffd8969c393"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},{"edge_kind":"extracted","from_key":"File:3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","to_key":"File:cdc2fe5839395e09c6f0195a23df86c991b6f407dc7a13b8ddcacabdfcd8214d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":73,"spawned_processes_count":73,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":38,"imported_dlls_count":135,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":43,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":43,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":1,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","rat","loader","lxdropper","xworm","criminal","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6ac7bda69a09fe5650098f38","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.NanoCore","contacted_countries":["DEU"],"submit_name":"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe","analysis_start_time":"2026-10-08T15:58:41+00:00","indicators_count":{"informative":228,"suspicious":66,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"64.188.67.232","port":8080,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]}],"dns_resolutions":null,"http_requests":null,"embedded_urls":[{"value":"unspec://64.188.67.232:8080","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}],"processes":[{"pid":7356,"ppid":0,"name":"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe","command_line":"","sha256":"3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89","normalized_path":"C:\\3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89.exe","uid":"00000000-00007356","icon":"$62"},{"pid":7120,"ppid":7356,"name":"powershell.exe","command_line":"-EncodedCommand \"PAAjAHkAdwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAeQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAdwB4ACMAPgA=\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007356","uid":"00000000-00007120"},{"pid":2404,"ppid":7356,"name":"1232.exe","command_line":"","sha256":"7c18da62a91e8d9b4403efa31d048748bf45e7a352dda1a1d6c7cdc9a3694ca7","normalized_path":"%TEMP%\\1232.exe","parent_uid":"00000000-00007356","uid":"00000000-00002404"},{"pid":4228,"ppid":2404,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002404","uid":"00000000-00004228"},{"pid":1364,"ppid":2404,"name":"cmd.exe","command_line":"/c wusa /uninstall /kb:890830 /quiet /norestart","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002404","uid":"00000000-00001364"},{"pid":4100,"ppid":1364,"name":"wusa.exe","command_line":"wusa /uninstall /kb:890830 /quiet /norestart","sha256":"64101be948b314c22f6218b07e52fa9148061927c4eccd376bf4be169d9ee59e","normalized_path":"%WINDIR%\\system32\\wusa.exe","parent_uid":"00000000-00001364","uid":"00000000-00004100"},{"pid":6964,"ppid":2404,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00006964"},{"pid":1440,"ppid":2404,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00001440"},{"pid":6276,"ppid":2404,"name":"sc.exe","command_line":"stop wuauserv","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00006276"},{"pid":4432,"ppid":2404,"name":"sc.exe","command_line":"stop bits","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00004432"},{"pid":7948,"ppid":2404,"name":"sc.exe","command_line":"stop dosvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00007948"},{"pid":4724,"ppid":2404,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00002404","uid":"00000000-00004724"},{"pid":7548,"ppid":2404,"name":"powercfg.exe","command_line":"/x -standby-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00002404","uid":"00000000-00007548"},{"pid":1976,"ppid":2404,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00002404","uid":"00000000-00001976"},{"pid":4620,"ppid":2404,"name":"powercfg.exe","command_line":"/x -standby-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00002404","uid":"00000000-00004620"},{"pid":3300,"ppid":2404,"name":"dialer.exe","command_line":"","sha256":"470900766d31d902852fffa8d5cbd18f7b430128e491ba15241f535dfbb37bf5","normalized_path":"%WINDIR%\\system32\\dialer.exe","parent_uid":"00000000-00002404","uid":"00000000-00003300"},{"pid":576,"ppid":3300,"name":"winlogon.exe","command_line":"","sha256":"b0f6d64a6651cdcb5ba1d1a48cdb2236ad01c75d05001e58cdb1c75de42553c7","normalized_path":"%WINDIR%\\System32\\winlogon.exe","parent_uid":"00000000-00003300","uid":"00000000-00000576"},{"pid":768,"ppid":3300,"name":"svchost.exe","command_line":"-k dcomlaunch -p -s PlugPlay","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00000000-00003300","uid":"00000000-00000768"},{"pid":976,"ppid":3300,"name":"svchost.exe","command_line":"-k dcomlaunch -p -s LSM","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00000000-00003300","uid":"00000000-00000976"},{"pid":352,"ppid":3300,"name":"dwm.exe","command_line":"","sha256":"350e74e4acd565847af53661b401c21f6bb8ce9e8513ef90133160dbb5dbe64b","normalized_path":"%WINDIR%\\System32\\dwm.exe","parent_uid":"00000000-00003300","uid":"00000000-00000352"},{"pid":380,"ppid":3300,"name":"svchost.exe","command_line":"-k networkservice -s TermService","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00000000-00003300","uid":"00000000-00000380"},{"pid":676,"ppid":3300,"name":"OSPPSVC.EXE","command_line":"","sha256":"1dd0dd35e4158f95765ee6639f217df03a0a19e624e020dba609268c08a13846","normalized_path":"%COMMONPROGRAMFILES%\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE","parent_uid":"00000000-00003300","uid":"00000000-00000676"},{"pid":7300,"ppid":3300,"name":"sedsvc.exe","command_line":"","sha256":"1bc49171277e8540e3affbad12e88c9999ad3e3b37b0ac46a578fd1b07f676c4","normalized_path":"%PROGRAMFILES%\\rempl\\sedsvc.exe","parent_uid":"00000000-00003300","uid":"00000000-00007300"},{"pid":1056,"ppid":3300,"name":"viprecwlnsau.exe","command_line":"","sha256":"7c18da62a91e8d9b4403efa31d048748bf45e7a352dda1a1d6c7cdc9a3694ca7","normalized_path":"%ALLUSERSPROFILE%\\szaauatzvxbi\\viprecwlnsau.exe","parent_uid":"00000000-00003300","uid":"00000000-00001056"},{"pid":7984,"ppid":1056,"name":"cmd.exe","command_line":"/c wusa /uninstall /kb:890830 /quiet /norestart","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001056","uid":"00000000-00007984"},{"pid":4240,"ppid":7984,"name":"wusa.exe","command_line":"wusa /uninstall /kb:890830 /quiet /norestart","sha256":"64101be948b314c22f6218b07e52fa9148061927c4eccd376bf4be169d9ee59e","normalized_path":"%WINDIR%\\system32\\wusa.exe","parent_uid":"00000000-00007984","uid":"00000000-00004240"},{"pid":7412,"ppid":1056,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00001056","uid":"00000000-00007412"},{"pid":4644,"ppid":1056,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00001056","uid":"00000000-00004644"},{"pid":6248,"ppid":1056,"name":"sc.exe","command_line":"stop wuauserv","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00001056","uid":"00000000-00006248"},{"pid":4580,"ppid":1056,"name":"sc.exe","command_line":"stop bits","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00001056","uid":"00000000-00004580"},{"pid":1280,"ppid":1056,"name":"sc.exe","command_line":"stop dosvc","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00001056","uid":"00000000-00001280"},{"pid":7264,"ppid":1056,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00001056","uid":"00000000-00007264"},{"pid":4604,"ppid":1056,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00001056","uid":"00000000-00004604"},{"pid":7364,"ppid":1056,"name":"powercfg.exe","command_line":"/x -standby-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00001056","uid":"00000000-00007364"},{"pid":5472,"ppid":1056,"name":"powercfg.exe","command_line":"/x -standby-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00001056","uid":"00000000-00005472"},{"pid":5436,"ppid":1056,"name":"dialer.exe","command_line":"","sha256":"470900766d31d902852fffa8d5cbd18f7b430128e491ba15241f535dfbb37bf5","normalized_path":"%WINDIR%\\system32\\dialer.exe","parent_uid":"00000000-00001056","uid":"00000000-00005436"},{"pid":2992,"ppid":5436,"name":"dllhost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\System32\\dllhost.exe","parent_uid":"00000000-00005436","uid":"00000000-00002992"},{"pid":5968,"ppid":5436,"name":"dllhost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\System32\\dllhost.exe","parent_uid":"00000000-00005436","uid":"00000000-00005968"},{"pid":4544,"ppid":5436,"name":"sc.exe","command_line":"stop wuauserv","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00005436","uid":"00000000-00004544"},{"pid":7748,"ppid":5436,"name":"sc.exe","command_line":"stop bits","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00005436","uid":"00000000-00007748"},{"pid":2068,"ppid":5436,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00005436","uid":"00000000-00002068"},{"pid":5520,"ppid":5436,"name":"powercfg.exe","command_line":"/x -standby-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00005436","uid":"00000000-00005520"},{"pid":2180,"ppid":5436,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00005436","uid":"00000000-00002180"},{"pid":6424,"ppid":5436,"name":"powercfg.exe","command_line":"/x -standby-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00005436","uid":"00000000-00006424"},{"pid":4356,"ppid":5436,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2e8,0x7fffe7ac0f18,0x7fffe7ac0f24,0x7fffe7ac0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005436","uid":"00000000-00004356"},{"pid":4704,"ppid":5436,"name":"dllhost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\System32\\dllhost.exe","parent_uid":"00000000-00005436","uid":"00000000-00004704"},{"pid":1464,"ppid":1056,"name":"dialer.exe","command_line":"","sha256":"470900766d31d902852fffa8d5cbd18f7b430128e491ba15241f535dfbb37bf5","normalized_path":"%WINDIR%\\system32\\dialer.exe","parent_uid":"00000000-00001056","uid":"00000000-00001464"},{"pid":5892,"ppid":1464,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001464","uid":"00000000-00005892"},{"pid":8108,"ppid":1464,"name":"viprecwlnsau.exe","command_line":"","sha256":"7c18da62a91e8d9b4403efa31d048748bf45e7a352dda1a1d6c7cdc9a3694ca7","normalized_path":"%ALLUSERSPROFILE%\\szaauatzvxbi\\viprecwlnsau.exe","parent_uid":"00000000-00001464","uid":"00000000-00008108"},{"pid":1660,"ppid":8108,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008108","uid":"00000000-00001660"},{"pid":8008,"ppid":8108,"name":"cmd.exe","command_line":"/c wusa /uninstall /kb:890830 /quiet /norestart","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008108","uid":"00000000-00008008"},{"pid":3020,"ppid":8108,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00008108","uid":"00000000-00003020"},{"pid":240,"ppid":1056,"name":"WerFault.exe","command_line":"-u -p 1056 -s 376","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001056","uid":"00000000-00000240"},{"pid":6196,"ppid":1056,"name":"WerFault.exe","command_line":"-u -p 1056 -s 376","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001056","uid":"00000000-00006196"},{"pid":7132,"ppid":3300,"name":"dllhost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\System32\\dllhost.exe","parent_uid":"00000000-00003300","uid":"00000000-00007132"},{"pid":4464,"ppid":2404,"name":"sc.exe","command_line":"delete \"UVDZCQJN\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00004464"},{"pid":2624,"ppid":2404,"name":"sc.exe","command_line":"create \"UVDZCQJN\" binpath= \"%ALLUSERSPROFILE%\\szaauatzvxbi\\viprecwlnsau.exe\" start= \"auto\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00002624"},{"pid":3784,"ppid":2404,"name":"sc.exe","command_line":"start \"UVDZCQJN\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00003784"},{"pid":2412,"ppid":2404,"name":"sc.exe","command_line":"stop eventlog","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00002404","uid":"00000000-00002412"},{"pid":1676,"ppid":7356,"name":"Magic.exe","command_line":"","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","normalized_path":"%TEMP%\\Magic.exe","parent_uid":"00000000-00007356","uid":"00000000-00001676"},{"pid":8100,"ppid":1676,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\\Magic.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001676","uid":"00000000-00008100"},{"pid":7156,"ppid":1676,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Magic.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001676","uid":"00000000-00007156"},{"pid":7880,"ppid":1676,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\WindowsNotify.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001676","uid":"00000000-00007880"},{"pid":4392,"ppid":1676,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsNotify.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001676","uid":"00000000-00004392"},{"pid":7104,"ppid":1676,"name":"schtasks.exe","command_line":"/create /f /RL HIGHEST /sc minute /mo 1 /tn \"WindowsNotify\" /tr \"%APPDATA%\\WindowsNotify.exe\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00001676","uid":"00000000-00007104"},{"pid":3128,"ppid":0,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00003128","icon":"$63"},{"pid":4476,"ppid":0,"name":"WindowsNotify.exe","command_line":"","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","normalized_path":"%APPDATA%\\WindowsNotify.exe","uid":"00000000-00004476","icon":"$64"},{"pid":7608,"ppid":0,"name":"WindowsNotify.exe","command_line":"","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","normalized_path":"%APPDATA%\\WindowsNotify.exe","uid":"00000000-00007608","icon":"$65"},{"pid":7536,"ppid":0,"name":"svchost.exe","command_line":"-k WerSvcGroup","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","uid":"00000000-00007536","icon":"$66"},{"pid":6100,"ppid":7536,"name":"WerFault.exe","command_line":"-pss -s 524 -p 1056 -ip 1056","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007536","uid":"00000000-00006100"},{"pid":6116,"ppid":0,"name":"WindowsNotify.exe","command_line":"","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","normalized_path":"%APPDATA%\\WindowsNotify.exe","uid":"00000000-00006116","icon":"$67"},{"pid":7680,"ppid":0,"name":"WindowsNotify.exe","command_line":"","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","normalized_path":"%APPDATA%\\WindowsNotify.exe","uid":"00000000-00007680","icon":"$68"},{"pid":5468,"ppid":0,"name":"WindowsNotify.exe","command_line":"","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","normalized_path":"%APPDATA%\\WindowsNotify.exe","uid":"00000000-00005468","icon":"$69"}],"all_imported_dlls":["gdi32full.dll","propsys.dll","System.Xml.ni.dll","sppc.dll","user32.dll","msvcrt.dll","sspicli.dll","slc.dll","wow64.dll","vcruntime140_clr0400.dll","System.Management.Automation.ni.dll","Microsoft.PowerShell.Security.ni.dll","apphelp.dll","VxSSL32.dll","ntmarta.dll","TbpMqSBn.dll","wldp.dll","sechost.dll","ucrtbase_clr0400.dll","mscoree.dll","msasn1.dll","mscoreei.dll","userenv.dll","System.Management.ni.dll","cryptbase.dll","vcruntime140.dll","OneCoreUAPCommonProxyStub.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","atl.dll","KernelBase.dll","ws2_32.dll","clbcatq.dll","System.DirectoryServices.dll","wshext.dll","xmllite.dll","Microsoft.Management.Infrastructure.Native.dll","advapi32.dll","mscorlib.ni.dll","miutils.dll","wbemcomn.dll","cfgmgr32.dll","cldapi.dll","rsaenh.dll","System.Configuration.Install.dll","wbemsvc.dll","System.Numerics.ni.dll","wow64win.dll","kernel.appcore.dll","Microsoft.AppV.AppvClientComConsumer.dll","Microsoft.Management.Infrastructure.Native.ni.dll","ntdll.dll","wow64cpu.dll","System.Data.dll","Microsoft.PowerShell.Commands.Management.dll","dpx.dll","msvcp_win.dll","vcruntime140_1.dll","uxtheme.dll","System.ni.dll","MpClient.dll","win32u.dll","gpapi.dll","System.Numerics.dll","Microsoft.PowerShell.Security.dll","msisip.dll","dpapi.dll","System.Data.ni.dll","oleaut32.dll","aepic.dll","winnsi.dll","windows.storage.dll","System.Core.ni.dll","cryptnet.dll","urlmon.dll","clr.dll","Microsoft.PowerShell.Commands.Utility.dll","System.DirectoryServices.ni.dll","msIso.dll","MpOAV.dll","Microsoft.VisualBasic.ni.dll","shell32.dll","Microsoft.PowerShell.ConsoleHost.dll","System.Management.dll","normaliz.dll","wbemprox.dll","ucrtbase.dll","bcrypt.dll","edputil.dll","wintrust.dll","nsi.dll","Microsoft.AppV.AppVClientPowerShell.dll","wininet.dll","bcryptprimitives.dll","shlwapi.dll","gdi32.dll","msvcp140.dll","Microsoft.Management.Infrastructure.ni.dll","System.Configuration.ni.dll","System.Transactions.ni.dll","wtsapi32.dll","imagehlp.dll","mi.dll","rpcrt4.dll","combase.dll","profapi.dll","iertutil.dll","IPHLPAPI.DLL","ole32.dll","version.dll","secur32.dll","AppxSip.dll","System.Configuration.Install.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","cryptsp.dll","Windows.StateRepositoryPS.dll","Microsoft.BitLocker.Structures.dll","VxSSL64.dll","imm32.dll","clrjit.dll","System.Management.Automation.dll","psapi.dll","coml2.dll","pwrshsip.dll","wmidcom.dll","fastprox.dll","crypt32.dll","amsi.dll","System.Transactions.dll","OpcServices.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","kernel32.dll","SHCore.dll","fltLib.dll","powrprof.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537.exe","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"viprecwlnsau.exe","sha256":"cd2f64f49991708cc57bf47f03ad57a90d26440030339cfc435ec6687b233a48","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"srkzdpdozbne.sys","sha256":"11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"WindowsNotify.exe","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"WindowsNotify.lnk","sha256":"a23fe432a4e05a3dd928afb473446c0c0c79b28786df6b786e8d0bfc530d1c6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"1232.exe","sha256":"cd2f64f49991708cc57bf47f03ad57a90d26440030339cfc435ec6687b233a48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Magic.exe","sha256":"8cb30efb114a970ca398f52f14701a6e0b74d1ad3ab51f67c864ddd882726537","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"ModuleAnalysisCache","sha256":"8a009043a4d93dcfd86793378ff3e854ac30bcea646145abc8fa0ffd8969c393","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"WindowsNotify.exe.log","sha256":"cdc2fe5839395e09c6f0195a23df86c991b6f407dc7a13b8ddcacabdfcd8214d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\1232.exe","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\Magic.exe","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ju2cjdj4.5nv.ps1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_wfy0xm3u.oog.psm1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_a4gy0rv5.oyq.ps1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dyl03bwc.qvj.psm1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_j1b3ivc0.xrp.ps1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vg2xynwj.lwm.psm1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pgbcvbrg.ewu.ps1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_gbuxulxq.cfz.psm1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ztjxo1ks.gxx.ps1","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7356:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\SM0:7356:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"SM0:7356:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7356:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7356:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\SM0:7120:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"SM0:7120:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7120:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7120:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\SM0:4100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\QhCYaY6N14by7ZAy","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1676:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1676:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"SM0:1676:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\SM0:1676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"QhCYaY6N14by7ZAy","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"Local\\SM0:1676:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"SM0:8100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7880:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"SM0:7880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac7bda69a09fe5650098f38"}]}]}},"report_ids":{"sandbox_job_ids":["6ac7bda69a09fe5650098f38"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious LXDropper Sample 3f790d1fc0ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3f790d1fc0ba…. Malware family: LXDropper. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89"}],["$","meta","4",{"property":"og:title","content":"Malicious LXDropper Sample 3f790d1fc0ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3f790d1fc0ba…. Malware family: LXDropper. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious LXDropper Sample 3f790d1fc0ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3f790d1fc0ba…. Malware family: LXDropper. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6a","11",{}]]