26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 409dd82ae030… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 409dd82ae030…. Malware family: Malware. Threat score 100/100. 5/24 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/409dd82ae03009f32397ee056fcf698e7ea1145184fc4749f00b5ed2534de2d5","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","409dd82ae03009f32397ee056fcf698e7ea1145184fc4749f00b5ed2534de2d5"],"about":{"@type":"SoftwareApplication","name":"MFeZQOjlHLloPBO.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"409dd82ae03009f32397ee056fcf698e7ea1145184fc4749f00b5ed2534de2d5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":5,"total":24},"behavioralIndicators":{"malicious":14,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T48f,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp")28:T40e,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp")29:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp")2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2b:T13a0,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-162-0101A4B0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006908-39885-194-0101C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006908-39885-194-0101C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-182-01018190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-182-01018190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-204-01019030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-204-01019030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-137-0101DA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-137-0101DA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-133-0101995D Assembly shows XOR instruction xor esi dword ptr [01020390h] in Stream UID: 00000000-00006908-39885-133-0101995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-133-0101995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-305-01019754 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-305-01019754 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-211-0101D341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-211-0101D341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-195-01018AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-195-01018AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-49-0101EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-126-0101D490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-126-0101D490 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006908-39885-217-01019F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006908-39885-217-01019F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00006908-39885-217-01019F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006908-39885-217-01019F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00006908-39885-217-01019F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006908-39885-217-01019F43 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-161-0101A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-203-010189F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-203-010189F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-158-0101A510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-92-0101E950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-92-0101E950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-198-01018E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-198-01018E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-141-0101D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-141-0101D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-215-010192C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-215-010192C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-199-01017C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-199-01017C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-202-010185B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-202-010185B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-151-0101D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-151-0101D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-135-0101DAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-135-0101DAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-149-0101D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-149-0101D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006908-39885-214-0101C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006908-39885-214-0101C4392c:T256f,"MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000035366b24932f4c71f004f700687d0b7598f4f700705f4c7181e7d255feffffffb4f3f700e2484b7158f3f7000000d67650f4f700fb484b71e0df787408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000e0f3f70000000000080000000000000000000000000000000000000000000000000000004d366b240000000020f4f7006992ae74ffffffff34000000e0f3f70008000000000000000000d67650f4f7002794ae74e8f3f7000b0000000000000038f4f700 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000048d6f700ecd5f700226e6d7400004403000000002d6e6d74331324222d000000ecb77a7570d6f7000000090360b21f03d87a1f031600000080000000b0d5f7000000090334d6f70070c86e7427b7a056feffffff2d000000d0cc89752700000004d6f700856a6f741c23747444d6f700f85f6f7408000000bb696e74b2696e749b1024222d000000ecb77a7527000000d0cc897518d6f7002d000000d0cc89752700000048d6f700856a6f741c23747490d6f7007e8a8875ee8c8875738a887521b9a8ed2d000000ecb77a7527000000d0cc89756c2844030028440321b9a8ed58d6f700fc52c67544d7f700e0848875899e9b98feffffff738a8875 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000d6f187d0d6f00000000d0a9c0760000b9769011ba7668dd1f0300b01a030825210308ecf700feffffffb0eef700506a44775ef56e7bfeffffffc8ecf700eaa9407768dd1f030000000008252103a11400000a000b00b2970d6f5c760d6f68760d6f08252103481c210314000000000000000000000068dd1f03f0ecf700cc2d457708252103000000001425210300000000f800066f00000000cc0d24385ce84377684042770403000019000000110000001000000078bc190328edf7008d9ad673d0b81903541f1f030000000048edf70054bc1903541f1f0360edf7000000066ffeffffff0400000020afd67300000000000000000000066f50edf700 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000001c0000000000440308e2f7000000000000000000a30141771ee2d50cc843ca07d007ac072800000000000000130000000000ac07000000004a0000020000000033030030f02fca07608044030700000000000000200000000000ac07cc01ac070408ac07000000000008ac070000000000e2f700591641771c000000000000000407d76e00004403000000002800000000000000000000000500000002000000000044031c00000000000000105b440320e2f700ee1341771c000000ee13417700000000000000001c000000ffffffff40e2f70050726d7400004403000000001c0000000407d76e (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000407738fdcb0738fdcb0700000000684ecc0720c0cb07b8fbcb070600000030c0cb071100050050f540770837cb070837cb0700000000fb24242268b3ca071829cb072800000078b3ca070a00210050f540777823cc077823cc070000000038fdcb0770c0cb07c81bcc073c00000080c0cb0701003c00700aac0764000000b32424220837cb070837cb0700000000feffffff84706d7498e2f70065706d74000044030000000084706d74472424227823cc077823cc0700000000e32ed36e0837cb07b5cecf6ebfc3e19360e2f700176fd06ef4e2f70070c86e74ffb4a056feffffff84706d740a8ed26e7823cc07f08dd26ec0e2f700a7cecf6e01000000 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000407788fecb0788fecb07000000000000000020c0cb07b8fbcb070c00000050f54077a034cb07a034cb070000000084706d7468b3ca071829cb072100000078b3ca070a002d00e00cac076400000050f540777823cc077823cc070000000088fecb0770c0cb07c81bcc073c00000080c0cb0701003c00700aac0764000000a034cb07a034cb0700000000feffffff84706d7494e2f70065706d74000044030000000084706d744b2424227823cc077823cc0700000000e32ed36ea034cb07b5cecf6e43c3e1935ce2f700176fd06ef4e2f70070c86e74ffb4a056feffffff84706d740a8ed26e7823cc07f08dd26ebce2f700a7cecf6e01000000504bd06e (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000001f035005f872000000002a00ba73fc86b3732a00ba73fb8c41770000000000000000fc86b373c0e2f7000000000000000000000000002a00ba730900000008e71f0309000000fc86b373000000005005f8721800000015276b24932f4c71d0f3f6000000000040e5f700705f4c7181e7d255feffffff80e2f7001a674b7130e2f700000000000000000033674b71ace2f70000000000000000000000000000000000000000000000000001000000000000000100000000000000a8e2f70000000000b8e2f70000000000ace2f7000000000000000000000000004b0005742d276b24c0e2f70084daac7452e2d50cc4e2f700dab9ac740000ef72b8e2f700 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000028c1040b38cf41774c26190394c1040b01000000002619034c26190300261903040000000400000000e0b8740010000094c1040b0100000000261903cd9741779c9741776ac32607b50faf740026190300004177000000006421b4690000000080eeb5740100000000000000f8e2b874000000000400000080a9d6734840b774f8e2b87498c1040b80e81d7458d01f0380e81d7494c1040b0000000080e81d7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006ed2620984d26209 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6266209fe266209 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001e351f0332351f03 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000063462091e346209 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006ed2620984d26209 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000762d62098e2d6209 (UID: 00000000-00004940)2d:T1069,"MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00004940) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000007000000073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300040000044149000088a65e00880b5f00660069006700000020a55e00 (UID: 00000000-00006908) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000007b008000000000000000a1140000accfeb08ee13417780000000ee134177000000000000000080000000f062776e00000000cccfeb0850726d7400007b000000000080000000f062776e02000000002f776ee8cfeb08fb62776e010000008004786e885f6f7400000000fbfc7d0718d0eb08b864776ef42e776e (UID: 00000000-00006908) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281291040000b202a3adb07218000000000000000000000003000000020000000000b2020c000000000000002000000084f5ff07ee13417728129104ee13417700000000000000000c000000a8a6bb0200a6bb029cf5ff0728231c720000b202000000000c00000060429b04a8f5ff072f99046f0c000000 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000b202f010bc0218000000000000000000000003000000020000000000b2020c0000000000000078a9d5747cf09600ee13417728129104ee13417700000000000000000c0000006f01fa6e2812910494f0960028231c720000b202000000000c000000b014f76ea0f096002f99046f0c000000 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001641770c00000000000000000000000000b20240f1960018000000000000000000000003000000020000000000b2020c00000000000000e4f09600e8f09600ee13417700000000ee13417700000000000000000c0000005ff5ab8800f1960028231c720000b202000000000c00000030a5046f0cf196002f99046f0c000000 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281291040000b202a3adb07218000000000000000000000003000000020000000000b2020c0000000000000020000000c4f21f08ee13417728129104ee13417700000000000000000c00000050aebb0200aebb02dcf21f0828231c720000b202000000000c00000020a29b04e8f21f082f99046f0c000000 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000b2027812bc0218000000000000000000000003000000020000000000b2020c0000000000000078a9d5747cf09600ee13417728129104ee13417700000000000000000c0000006f01fa6e2812910494f0960028231c720000b202000000000c000000b014f76ea0f096002f99046f0c000000 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001641770c00000000000000000000000000b20218f1960018000000000000000000000003000000020000000000b2020c00000000000000bcf09600c0f09600ee13417700000000ee13417700000000000000000c0000005ff5ab88d8f0960028231c720000b202000000000c00000030a5046fe4f096002f99046f0c000000 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281291040000b202a3adb07218000000000000000000000003000000020000000000b2020c000000000000002000000024ef1f08ee13417728129104ee13417700000000000000000c00000010adbb0200adbb023cef1f0828231c720000b202000000000c00000020029c0448ef1f082f99046f0c000000 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000001641770c00000000000000000000000000b2028baad57418000000000000000000000003000000020000000000b2020c00000000000000bccabc0258f09600ee13417728129104ee13417700000000000000000c0000006f01fa6e70f0960028231c720000b202000000000c000000b014f76e7cf096002f99046f0c000000 (UID: 00000000-00007480)2e:T631,Found reference to API "11909112128,1268,3024,,RtlGetVersion,NTDLL.dll,"00:42:32.203",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004940.00000000.163342.03270000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp")2f:T1392,"MFeZQOjlHLloPBO.exe" queries volume information of "C:\MFeZQOjlHLloPBO.exe" at 00000000-00004940-00000C15-1558356962 "MFeZQOjlHLloPBO.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00004940-00000C15-1558521127 "MFeZQOjlHLloPBO.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00004940-00000C15-1558687737 "MFeZQOjlHLloPBO.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00004940-00000C15-1559663036 "MFeZQOjlHLloPBO.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00004940-00000C15-1563075110 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006908-00000C15-1567236806 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006908-00000C15-1567476967 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006908-00000C15-1568772515 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006908-00000C15-1568927696 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00006908-00000C15-1568929040 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00006908-00000C15-1568964254 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006908-00000C15-1569092778 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006908-00000C15-1569120202 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006908-00000C15-1569120469 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00006908-00000C15-1569881317 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006908-00000C15-1570189853 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006908-00000C15-1570239029 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006908-00000C15-1570239338 "powershell.exe" queries volume information of "C:\" at 00000000-00006908-00000C15-1570826286 "powershell.exe" queries volume information of "C:\share" at 00000000-00006908-00000C15-1570827650 "powershell.exe" queries volume information of "C:\share" at 00000000-00006908-00000C15-1571556310 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006908-00000C15-1573287239 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006908-00000C15-1573922309 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006908-00000C15-1574106129 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006908-00000C15-157453620330:T5466,"MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004940) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006908) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006908) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007480) "MFeZQOjlHLloPBO.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007480)31:Tbe6a,Found reference to API (Indicator: "LoadImage"; File: "MFeZQOjlHLloPBO.exe") Found reference to API (Indicator: "Sleep"; File: "MFeZQOjlHLloPBO.exe") Found reference to API (Indicator: "GetObject"; File: "MFeZQOjlHLloPBO.exe") Found reference to API (Indicator: "MessageBox"; File: "MFeZQOjlHLloPBO.exe") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004940.00000000.163342.09600000.00000004.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004940.00000000.163342.09600000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004940.00000000.163342.09600000.00000004.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "NtContinue"; Source: "00000000-00004940.00000000.163342.09600000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp, 00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp, 00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp, 00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp, 00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API (Indicator: "LoadImage"; Source: "00000000-00007480.00000000.163922.00522000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007480.00000000.163922.00522000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00007480.00000000.163922.00522000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00007480.00000000.163922.00522000.00000002.mdmp")32:T5ec,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004940.00000000.163342.6ED71000.00000002.mdmp, 00000000-00004940.00000000.163342.6ED95000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006908.00000000.163853.01021000.00000002.mdmp, 00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00006908.00000000.163853.6EF25000.00000002.mdmp")33:T17b4,"SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 39885-182-01018190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 39885-182-01018190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 39885-182-01018190 "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 39885-149-0101D560 "SOFTWARE\Microsoft\PowerShell\3" in Source: 39885-184-0101BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 39885-195-01018AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004940.00000000.163342.03190000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004940.00000000.163342.03190000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp "HKLM\" in Source: 00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004940.00000000.163342.6ECE1000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006908.00000000.163853.005E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006908.00000000.163853.005E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006908.00000000.163853.01011000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006908.00000000.163853.01011000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006908.00000000.163853.01011000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006908.00000000.163853.01011000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006908.00000000.163853.01011000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006908.00000000.163853.01011000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00006908.00000000.163853.045B0000.00000004.mdmp34:T1874,"MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "MFeZQOjlHLloPBO.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:c0000135]35:T49ed,"MFeZQOjlHLloPBO.exe" loaded module "KERNEL32" at base 76ac0000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74d00000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72af0000 "MFeZQOjlHLloPBO.exe" loaded module "ADVAPI32.DLL" at base 73ea0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 729e0000 "MFeZQOjlHLloPBO.exe" loaded module "SHLWAPI.DLL" at base 74ea0000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74750000 "MFeZQOjlHLloPBO.exe" loaded module "VERSION.DLL" at base 73b20000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72230000 "MFeZQOjlHLloPBO.exe" loaded module "USER32.DLL" at base 76b90000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "MSCOREE.DLL" at base 72b40000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77180000 "MFeZQOjlHLloPBO.exe" loaded module "PSAPI.DLL" at base 75040000 "MFeZQOjlHLloPBO.exe" loaded module "KERNEL32.DLL" at base 76ac0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70090000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "RPCRT4.DLL" at base 74de0000 "MFeZQOjlHLloPBO.exe" loaded module "OLE32.DLL" at base 74bc0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738a0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77180000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 720d0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71670000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "UXTHEME.DLL" at base 738a0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f870000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71560000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f0f0000 "MFeZQOjlHLloPBO.exe" loaded module "NTDLL.DLL" at base 773d0000 "MFeZQOjlHLloPBO.exe" loaded module "SHELL32.DLL" at base 75780000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "BCRYPT.DLL" at base 72ca0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71510000 "MFeZQOjlHLloPBO.exe" loaded module "IMM32.DLL" at base 74d00000 "MFeZQOjlHLloPBO.exe" loaded module "COMCTL32.DLL" at base 6f060000 "MFeZQOjlHLloPBO.exe" loaded module "GDI32.DLL" at base 76d60000 "MFeZQOjlHLloPBO.exe" loaded module "GDIPLUS.DLL" at base 73b30000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73b30000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "WLDP.DLL" at base 714f0000 "MFeZQOjlHLloPBO.exe" loaded module "AMSI.DLL" at base 6edd0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73b20000 "MFeZQOjlHLloPBO.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ed80000 "MFeZQOjlHLloPBO.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ece0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76ac0000 "MFeZQOjlHLloPBO.exe" loaded module "USERENV.DLL" at base 6eda0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 73ea0000 "MFeZQOjlHLloPBO.exe" loaded module "WINDOWSCODECS.DLL" at base 72ef0000 "MFeZQOjlHLloPBO.exe" loaded module "NTDLL" at base 773d0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "SSPICLI.DLL" at base 73df0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6e990000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 740c0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73340000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6e860000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75780000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76ac0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 736e0000 "MFeZQOjlHLloPBO.exe" loaded module "MSISO.DLL" at base 6e800000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 749e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 749e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 749e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 749e0000 "powershell.exe" loaded module "KERNEL32" at base 76ac0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72af0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 73ea0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 729e0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74ea0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74750000 "powershell.exe" loaded module "VERSION.DLL" at base 73b20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72230000 "powershell.exe" loaded module "USER32.DLL" at base 76b90000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 749e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 72b40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77180000 "powershell.exe" loaded module "PSAPI.DLL" at base 75040000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76ac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70090000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "RPCRT4.DLL" at base 74de0000 "powershell.exe" loaded module "OLE32.DLL" at base 74bc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 74d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71510000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 73f40000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 749e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 720d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f870000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 77180000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 77180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 773d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 76d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 6ef60000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76d10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73b20000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ef10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6ee70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f0f0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 76ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6eb10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 77180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6e9b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6e9a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71560000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73df0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6e980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e810000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76ac0000 "powershell.exe" loaded module "USERENV.DLL" at base 6ef30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 73ea0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6e800000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6e770000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76ac0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6e740000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e5e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e5b0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e5b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 736e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 749e0000 "powershell.exe" loaded module "MSISO.DLL" at base 6e540000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 72ca0000 "powershell.exe" loaded module "OLEAUT32" at base 74d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 749e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 74690000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e1b0000 "powershell.exe" loaded module "MI.DLL" at base 6e190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 749e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e100000 "powershell.exe" loaded module "GDI32.DLL" at base 76d60000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 749e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ef70000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 749e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 749e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 76ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f070000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6f040000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f030000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ef70000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 749e0000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "OLEAUT32.DLL" at base 74d40000 "MFeZQOjlHLloPBO.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "OLEAUT32" at base 74d40000 "MFeZQOjlHLloPBO.exe" loaded module "C:\VAULTCLI.DLL" at base 0 "MFeZQOjlHLloPBO.exe" loaded module "VAULTCLI.DLL" at base 6ead0000 "MFeZQOjlHLloPBO.exe" loaded module "USER32" at base 76b90000 "MFeZQOjlHLloPBO.exe" loaded module "COMCTL32.DLL" at base 6e8b0000 "MFeZQOjlHLloPBO.exe" loaded module "C:\MFEZQOJLHLLOPBO.EXE" at base 40000036:Tc2e,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "cess += Resolve-Path $Path | Foreach-Obj" (Indicator: "Resolve-Path"; Source: "00000000-00006908.00000000.163853.06D90000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $~" (Indicator: "Test-Path"; Source: "00000000-00006908.00000000.163853.06D90000.00000004.mdmp")37:T185f,"MFeZQOjlHLloPBO.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "MFeZQOjlHLloPBO.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "MFeZQOjlHLloPBO.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "MFeZQOjlHLloPBO.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "MFeZQOjlHLloPBO.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "MFeZQOjlHLloPBO.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "MFeZQOjlHLloPBO.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "MFeZQOjlHLloPBO.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "MFeZQOjlHLloPBO.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "MFeZQOjlHLloPBO.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "MFeZQOjlHLloPBO.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "MFeZQOjlHLloPBO.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "MFeZQOjlHLloPBO.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "MFeZQOjlHLloPBO.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")38:T921,"MFeZQOjlHLloPBO.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "rgiEIPyvHXinrl.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"39:T6bd,"MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "MFeZQOjlHLloPBO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")3a:Tf3c,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004940-00000C28-1490785822] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004940-00000C25-1558076123] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004940-00000C25-1558182251] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004940-00000C25-1558241674] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004940-00000C25-1558330763] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004940-00000C25-1558357920] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004940-00000C25-1558413903] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004940-00000C25-1558491334] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004940-00000C25-1558569952] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004940-00000C25-1558638469] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004940-00000C25-1558795874] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004940-00000C25-1558996706] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004940-00000C25-1559022503] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004940-00000C25-1559065603] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004940-00000C25-1559315893] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004940-00000C25-1560048063] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004940-00000C25-1560072779] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004940-00000C25-1560102002] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004940-00000C25-1561249671] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004940-00000C25-1561386354] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004940-00000C25-1561484831] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004940-00000C25-1563622933] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006908-00000C25-1567113543] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006908-00000C25-1567431091] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006908-00000C25-1567669914]3b:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp")3c:T593,"MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")3d:Ta93,"MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "MFEZQOJLHLLOPBO.EXE"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "MFeZQOjlHLloPBO.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")3e:Tac1,"MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\FLTLIB.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll"3f:T82e,"MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\MFEZQOJLHLLOPBO.EXE.CONFIG" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MFEZQOJLHLLOPBO.EXE.LOG" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\MFeZQOjlHLloPBO.exe.config" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\NVKG" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\MFEZQOJLHLLOPBO.INI" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\MFeZQOjlHLloPBO.INI" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "MFeZQOjlHLloPBO.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"40:T423,"MFeZQOjlHLloPBO.exe" writes file "c:\users\%osuser%\appdata\roaming\rgieipyvhxinrl.exe" "MFeZQOjlHLloPBO.exe" writes file "c:\users\%osuser%\appdata\roaming\rgieipyvhxinrl.exe:zone.identifier" "MFeZQOjlHLloPBO.exe" writes file "c:\users\%osuser%\appdata\local\temp\tmpfd43.tmp" "MFeZQOjlHLloPBO.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\mfezqojlhllopbo.exe.log" "MFeZQOjlHLloPBO.exe" writes file "%appdata%\rgieipyvhxinrl.exe:zone.identifier" "MFeZQOjlHLloPBO.exe" writes file "%appdata%\rgieipyvhxinrl.exe" "MFeZQOjlHLloPBO.exe" writes file "%temp%\tmpfd43.tmp" "MFeZQOjlHLloPBO.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\mfezqojlhllopbo.exe.log" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_krwlfko3.s1q.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_t0t3jzqo.4wl.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive"41:T1980,Heuristic match: "SGh&.In" Heuristic match: "w^.St" Heuristic match: "o" - Source: "00000000-00004940.00000000.163342.6ED81000.00000020.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?euptnwpk" - Source: "00000000-00006908.00000000.163853.005E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006908.00000000.163853.007B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006908.00000000.163853.007B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006908.00000000.163853.06D90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006908.00000000.163853.06D90000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006908.00000000.163853.6EF11000.00000020.mdmp")43:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp")44:Ta14,"MFeZQOjlHLloPBO.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004940) "MFeZQOjlHLloPBO.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004940)45:Tef3,Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004940.00000000.163342.03190000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004940.00000000.163342.03190000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00004940.00000000.163342.09600000.00000004.mdmp") Found string "#aEs" (Indicator: "aes"; Source: "00000000-00004940.00000000.163342.0AB7A000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp, 00000000-00006908.00000000.163853.06D90000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006908.00000000.163853.006BC000.00000004.mdmp, 00000000-00006908.00000000.163853.06D90000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.01011000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00006908.00000000.163853.045B0000.00000004.mdmp") Found string "[-WindowStyle